ca55e36df9fa3ab2a632c30302ce71f9b7a4cd02ca93fbea51c9d9c000478e8a

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:32

Target
2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe
Size 2.9MB
Sample260831-e54jtsdk51
SHA256 ca55e36df9fa3ab2a632c30302ce71f9b7a4cd02ca93fbea51c9d9c000478e8a
MD5 c9923d78392f199d7997ccacc4a54fbd
SHA1 48cc1fe9b613da92fbb5bc8c31c1cc526f92440e
SHA512 c81d9b9d7179412479aab3078dd5101b85aa9f19771a0ae5a3567a47d0b9c21a173bb67388ef142d2ad0160b8e8c8343b3598d1d593703bf1b06892c9551aefc
SSDEEP 49152:4LOmFgbaGibLiDHcq3ZLo+GBU+LfOIzWNNmnUYPLjuDj/7vd2ayLkB:0Gia8q3XGpOIzWG3ubvd2XkB
TLSH
T1C5E54A22BA5B99FCC19EC470874646736A31B4CA0B22BAEF41D445353F6ABF01F78758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 4448	716	2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe	86
PID 716 wrote to memory of 1512	716	2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --inheritcursor --width 118 --height 28 --signal 0x214 --server 0x210
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1512