e4a08c61655f32c1885cbb15f74d3fb4e439e44c3bec7d7886d439d22cc4ca14

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:32

Target
2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid.exe
Size 112KB
Sample260804-qs3bsafp8x
SHA256 e4a08c61655f32c1885cbb15f74d3fb4e439e44c3bec7d7886d439d22cc4ca14
MD5 f0ab2f8f4108bd996e1e6246cfb802d9
SHA1 374426fb086164041659f8ba441a2c98309e864a
SHA512 a6c279768ed9aa45d594228a0adaeac14fd5684538eee82a2258beee6cc037880bae8e44b75d4dc6f9a830f634cfc5d63d888491d2e70adde6b4313646883faa
SSDEEP 3072:IZQuZiq6Krbt/0AtFcO+2jDIV5+iFjW5:Du8xKn1FcrFj
TLSH
T173B38CC3BBB1B6D9E06E9BBBDB7A8C41572DECBA18117F3E1A4451049E941C18F68C31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1020	4348	2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f0ab2f8f4108bd996e1e6246cfb802d9_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\svc_load.dll",Run
  2⤵
  PID:1020

svc_load.dll

Path C:\Users\Admin\AppData\Local\Temp\svc_load.dll
Size 109KB
SHA256 b049e4b51ff1c74be70db7073afbc0883229e010110ff7396b1be34b8219172a
MD5 b8006471ba0f29ac0f82b89aa5ec579d
SHA1 35f42cb31dc797afb20de420def7e67c61531602
SHA512 9d8cd35ce166e58c2de4d338f2e5d3f44e320917cd392ac12419f00feff054247648c2175c15091e24d38a9e6884ad2370f9be8a277caaf83465d7ada2c8ad8f
SSDEEP 3072:THRj6A6Vn5ZvaG7giHUFOIFPNRRWJZQ7+QKxyO6nz3u:THl6A6V5Z5gbIOLkQuxp6nbu
TLSH
T19AB3122CCCD572A6D1900B3214D8FE5CEFE789A493B14AE452E02ABE65DD9411EF3CB4
MD5 SHA1 SHA512 SSDEEP TLSH