a47f40396d4b6612484ee2e238d87ad00b2a75a8ea854ee41c5fa993b16e7c5f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 05:44

Target
2026-07-22_8e1c99a72152b2c53489cc580859b22b_cobalt-strike_icedid.exe
Size 1.1MB
Sample260722-gfgpwaba69
SHA256 a47f40396d4b6612484ee2e238d87ad00b2a75a8ea854ee41c5fa993b16e7c5f
MD5 8e1c99a72152b2c53489cc580859b22b
SHA1 4f67ce698b46a70897499814c08c6837268f7afb
SHA512 5584dfbef3d907768de53d1f3cbdce924531256ee7ae042de0f6d69884a06a09b60c06f076c88aeb0941e05a715a8a47d6cf9c208c5d9fc0c69080c9cf46f117
SSDEEP 24576:6RRVHq7ZbZaEZw62OsVJ0ZIkqokSf3dfEYS1WdzjDucvfxZXHd1epaMYPfnUvPjG:
TLSH
T11645DF8CD10C6D5D96BF08BD0AF96D4B82B4577A33574C9353A200A486F13DE61F2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3348	2924	2026-07-22_8e1c99a72152b2c53489cc580859b22b_cobalt-strike_icedid.exe	89
PID 2924 wrote to memory of 3348	2924	2026-07-22_8e1c99a72152b2c53489cc580859b22b_cobalt-strike_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_8e1c99a72152b2c53489cc580859b22b_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_8e1c99a72152b2c53489cc580859b22b_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe"
  2⤵
  PID:3348

memory/3348-1-0x0000024529B10000-0x0000024529B28000-memory.dmp

Download