7b6e288d77bb8a009f928586e158aa5c8ba49078b5429e282457b1be925ab371

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 18:00

Target
2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe
Size 272KB
Sample260815-wlrvcseq81
SHA256 7b6e288d77bb8a009f928586e158aa5c8ba49078b5429e282457b1be925ab371
MD5 7c8112f765daf632a99f5f04a264d084
SHA1 4686237d3ca6e1b1109d8de0ec5d2151c823eee8
SHA512 d6b98d74ce1f9f3c78cc67db877625a59130c731d4dfeec6e00234ea47bf3a7ec236922a33dd325ef3b43a6454ff8a3242335d92494a45524d185751479ba7bf
SSDEEP 6144:hY8B5SzdvMyXvqF+rHt/RJoPLg9xMvic86El:hdszdvlXvrdO0vzmEl
TLSH
T18854AE1BFFA634E9E0AF8139C865159BE771743907A0DADF069442772E336D09E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4932	4772	2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe	86
PID 4772 wrote to memory of 4932	4772	2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe	86
PID 4772 wrote to memory of 4932	4772	2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe	86
PID 4772 wrote to memory of 4932	4772	2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe	86
PID 4772 wrote to memory of 4932	4772	2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe	86
PID 4772 wrote to memory of 4932	4772	2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe	86
PID 4772 wrote to memory of 4932	4772	2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-15_7c8112f765daf632a99f5f04a264d084_cobalt-strike_icedid_njrat.exe"
  2⤵
  PID:4932

memory/4772-0-0x0000000140000000-0x0000000140079000-memory.dmp

Download

memory/4772-1-0x0000000140000000-0x0000000140079000-memory.dmp

Download