a9f6d8fc29033f62113daf70fc52e819cfaa5589a9aabdba39e4d9ef1f60ec9a

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:27

Target
2026-10-04_e701bc969f7bfffcb37a931bfab5b58d_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 2.2MB
Sample261004-3fdtwas14k
SHA256 a9f6d8fc29033f62113daf70fc52e819cfaa5589a9aabdba39e4d9ef1f60ec9a
MD5 e701bc969f7bfffcb37a931bfab5b58d
SHA1 cfa97ccb14e5a7deb39ed51a77084a30bf9ab6fe
SHA512 ff418f5b2f700a7a07114d4556a5d4592289ab8256780157f16640a87425cbe6a41ef39fa88f26a598fd7e27705bd9a218db71d2dddfe7ea3710dc3b6a4867c5
SSDEEP 49152:t/4MnYYJ2ZhqSGLHyqatglYqatgluCC53Xpd2c4:KID41vd5fG
TLSH
T1CBB57C46B7D55572E5B30231886B42A26F76BC211F2193DF2390B22D6F337C0BA36766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4864	1268	2026-10-04_e701bc969f7bfffcb37a931bfab5b58d_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-04_e701bc969f7bfffcb37a931bfab5b58d_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_e701bc969f7bfffcb37a931bfab5b58d_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 920
  2⤵
  PID:4864

memory/1268-0-0x00007FFD56EAA000-0x00007FFD56EAB000-memory.dmp

Download

memory/1268-1-0x00007FFD56BB0000-0x00007FFD575E8000-memory.dmp

Download

memory/1268-4-0x00007FFD56BB0000-0x00007FFD575E8000-memory.dmp

Download

memory/1268-5-0x00007FFD56BB0000-0x00007FFD575E8000-memory.dmp

Download