be441c973187c3a354aa9725ad1a442938278f0699697621feb24367fe704217

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 06:38

Target
2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe
Size 1.4MB
Sample260816-hd9hjsbf97
SHA256 be441c973187c3a354aa9725ad1a442938278f0699697621feb24367fe704217
MD5 bac63b81f9963d8996c938565fe69abf
SHA1 0f982461e71f5e0bae1a876a4870586533806dc6
SHA512 87bccf06402878c0de4ca038757877539cb8664373e76507e8cc36a0f4f5471d07d93020b37c29955a864a72fd361189800484fb6af74879fc49588d1291863e
SSDEEP 24576:53CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqKJFzz:53CTQQjxKWjFUsTWDcN20k5nQsrivkd1
TLSH
T18B65AE0673E6C1E8DEBB90B6C525A223D771781407389BDB24E0592EDFB3AD05B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 540 set thread context of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89
PID 540 wrote to memory of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89
PID 540 wrote to memory of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89
PID 540 wrote to memory of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89
PID 540 wrote to memory of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89
PID 540 wrote to memory of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89
PID 540 wrote to memory of 1280	540	2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_bac63b81f9963d8996c938565fe69abf_glassworm_icedid.exe"
  2⤵
  PID:1280

memory/540-0-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/540-3-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1280-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1280-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download