e399a9afabaa83a4ca71bd3db70066afc25b3c65f66a2d2421ac73fc0a5dd31b

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 02:09

Target
2026-07-15_1c5703b552d91c108860bad21f3e4b51_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.3MB
Sample260716-clfbsaev4t
SHA256 e399a9afabaa83a4ca71bd3db70066afc25b3c65f66a2d2421ac73fc0a5dd31b
MD5 1c5703b552d91c108860bad21f3e4b51
SHA1 3a8991e012760d8dd1cb5041c6210e8b2f79ebe2
SHA512 5ed669a4b5ce61c56c1e9f54e81a9c1d871b044c595f40571067b3dea0fe0966c1bef84fb243b0e1b25f14d82a99a41af07fed3097af96ab413482093a93576a
SSDEEP 98304:W5bjQsDmpo6duKHLUjVumvBh8huTXrzAE9X:WhrWdP4jtx
TLSH
T16C764A07FCA514E5C0AEC2358A639513BF617C485B2223E72BA0F6283F76BD0ADB5754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 6044	3048	2026-07-15_1c5703b552d91c108860bad21f3e4b51_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-15_1c5703b552d91c108860bad21f3e4b51_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1c5703b552d91c108860bad21f3e4b51_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  PID:6044