12147c7cebe7e1096d2e45d187fda91fb11e6d84c03c33bc946e404b1cd7a6a9

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:56

Target
2026-08-02_83c14af9e1234f512feb2e9c4205e776_cobalt-strike_conti.exe
Size 538KB
Sample260802-dfcjdacc43
SHA256 12147c7cebe7e1096d2e45d187fda91fb11e6d84c03c33bc946e404b1cd7a6a9
MD5 83c14af9e1234f512feb2e9c4205e776
SHA1 e361ad788085fdee3f69dced93247799bbed7ff3
SHA512 b036d0cf7f7c10f4d5a830e79772b8cfd620c55941e6f6fa2b208638bf6b999d2e0597e3ce5d287583775ac5538c0a74cf7ab59fed47b7c9558c5008b09e2ee7
SSDEEP 12288:pUr5659uji+qhkp538wtA8uFLO/dXBEDfvYFk7o5C:pp59ujitmp/ELO/dXOfvYFk7o5C
TLSH
T118C4E085E7D06CEBE615133D45E38722233AF6C047538B1B6A34E6361F17ED0BE8A619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 2236	6020	2026-08-02_83c14af9e1234f512feb2e9c4205e776_cobalt-strike_conti.exe	89
PID 2236 wrote to memory of 5236	2236	calc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_83c14af9e1234f512feb2e9c4205e776_cobalt-strike_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_83c14af9e1234f512feb2e9c4205e776_cobalt-strike_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5236