d5d55f71d7bef00d97ff2efb7afd9914bbfb2cb97653e5262457e1bedc44bd71

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:09

Target
2026-08-07_d201fa7d2175efa4782f9bffb0d6e553_cobalt-strike_icedid.exe
Size 1.2MB
Sample260807-m9f84afd69
SHA256 d5d55f71d7bef00d97ff2efb7afd9914bbfb2cb97653e5262457e1bedc44bd71
MD5 d201fa7d2175efa4782f9bffb0d6e553
SHA1 bceb01f1c0bda2336acfcd1566a4bb49ebf5868c
SHA512 1f7523e8ab0a26f98ff3282530c81699334ea00bbd0857ca3aa6324f002a848c8908a4339bcf33c15072f3649c1c6dea1cda0af44bd581928ebfa785ac28c59b
SSDEEP 24576:h7tg1VTuQ1Uxo/f/a2FuXyIiGt8KDg0HjR1qKEC5QSa4eJz8NsFEwHniZB45/rR/:Ztg1VTuoUe/f/a2FuXyIiGt8KDg0HjRm
TLSH
T16145F9EBDD4815BBEC4D2B7D09944F0587B0C217A922D89DF3001AC919C7FD56AAFB82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 4520	5184	2026-08-07_d201fa7d2175efa4782f9bffb0d6e553_cobalt-strike_icedid.exe	89
PID 5184 wrote to memory of 4520	5184	2026-08-07_d201fa7d2175efa4782f9bffb0d6e553_cobalt-strike_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_d201fa7d2175efa4782f9bffb0d6e553_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d201fa7d2175efa4782f9bffb0d6e553_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe"
  2⤵
  PID:4520

memory/4520-5-0x00000235B1910000-0x00000235B192F000-memory.dmp

Download

memory/4520-4-0x00000235B15D0000-0x00000235B15EA000-memory.dmp

Download

memory/4520-6-0x00000235B1910000-0x00000235B192F000-memory.dmp

Download

memory/5184-0-0x00007FFFB8580000-0x00007FFFB87E3000-memory.dmp

Download

memory/5184-1-0x00007FFFB6920000-0x00007FFFB69E7000-memory.dmp

Download