13e30e40d92b3c4ca0f712f41c7b416ced3d29eb4764e497d5c7b86c92c91e83

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:40

Target
2026-08-09_e64d41d8d96f4293a37a252e809b0466_cobalt-strike_icedid_satacom.exe
Size 33.5MB
Sample260809-ns3lfaac44
SHA256 13e30e40d92b3c4ca0f712f41c7b416ced3d29eb4764e497d5c7b86c92c91e83
MD5 e64d41d8d96f4293a37a252e809b0466
SHA1 65d66090f88796c46fdfb3d5abded95b23ee9916
SHA512 3e4ba63e3a71a4e3f6839b106728d76848d88138b7459c247f8f1ec3d572c52dba488db182adab5ff8c95f35e36114b1fba8b444825e5e7bd1cf32e932c07d45
SSDEEP 786432:62nnng9ZlQ5BSy3w/cv3svDJBVvRAQxopL7MglgRq/Ubs:68g9vQ5BSQw/cv3GbVaQxo51lr/
TLSH
T12977334492E9747BE5A508F259A740B17B8089B2DF6F87B72CE1C1801F7B6934D3A3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2708	3368	2026-08-09_e64d41d8d96f4293a37a252e809b0466_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_e64d41d8d96f4293a37a252e809b0466_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e64d41d8d96f4293a37a252e809b0466_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:2708