ca55e36df9fa3ab2a632c30302ce71f9b7a4cd02ca93fbea51c9d9c000478e8a

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:32

Target
2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe
Size 2.9MB
Sample260831-e54jtsdk51
SHA256 ca55e36df9fa3ab2a632c30302ce71f9b7a4cd02ca93fbea51c9d9c000478e8a
MD5 c9923d78392f199d7997ccacc4a54fbd
SHA1 48cc1fe9b613da92fbb5bc8c31c1cc526f92440e
SHA512 c81d9b9d7179412479aab3078dd5101b85aa9f19771a0ae5a3567a47d0b9c21a173bb67388ef142d2ad0160b8e8c8343b3598d1d593703bf1b06892c9551aefc
SSDEEP 49152:4LOmFgbaGibLiDHcq3ZLo+GBU+LfOIzWNNmnUYPLjuDj/7vd2ayLkB:0Gia8q3XGpOIzWG3ubvd2XkB
TLSH
T1C5E54A22BA5B99FCC19EC470874646736A31B4CA0B22BAEF41D445353F6ABF01F78758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3592	2480	2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe	90
PID 2480 wrote to memory of 3336	2480	2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_c9923d78392f199d7997ccacc4a54fbd_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --inheritcursor --width 118 --height 28 --signal 0x254 --server 0x22c
  2⤵
  PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3336