944506019bd6905244fcf42398012eea559c615a2d9500ccacd06f6e9e5858fd

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 09:27

Target
2026-08-11_78ebb12d648c3dc31f7ed5c3c3fea0e4_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
Size 40.0MB
Sample260811-let12adf27
SHA256 944506019bd6905244fcf42398012eea559c615a2d9500ccacd06f6e9e5858fd
MD5 78ebb12d648c3dc31f7ed5c3c3fea0e4
SHA1 e41270939e580e549821999c517aa7cc55bf3f5f
SHA512 a9cfdb182f458f8263e1d66253dcb4233547b7e377f6b616cf8f0f8c69fd1d95da750af962772ac3fd2acf82f46df04f9e741a7c50e682adbfb421f06e45ae98
SSDEEP 196608:3bKAVx+2l63QSNIlcOHJEc4M11vMu/oVPKRjCtIKE:3bTVx2NEcONnVsKRjC7
TLSH
T13A973853B8A5C4D4D1959234C1A2D6D3BAB13C954B2563C33BDCAF2F2F72AC09A7A701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4852	4476	2026-08-11_78ebb12d648c3dc31f7ed5c3c3fea0e4_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-11_78ebb12d648c3dc31f7ed5c3c3fea0e4_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_78ebb12d648c3dc31f7ed5c3c3fea0e4_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:4852