c6cc0e552885b02bbcc24128f3985bcdcffd263fa06b3e46d5692ff679e86508

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 21:36

Target
2026-10-05_76c1c3d1b2f7466c279463b1f9fdfbdf_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 3.5MB
Sample261006-1fx7eage79
SHA256 c6cc0e552885b02bbcc24128f3985bcdcffd263fa06b3e46d5692ff679e86508
MD5 76c1c3d1b2f7466c279463b1f9fdfbdf
SHA1 8bb46d5b3fd46db1b997f7eca21ceccb5bb7c940
SHA512 320d56e2946c4d1f9998c58d8b5859253b30188226018e0bf5f5f9d14b26430f2c4496662efb791638878b213b7b0b8d81afaaf99678861ed772c1d0c0b06072
SSDEEP 49152:t/4MnYYJ2ZhqSGLHyqatglYqatgluCC5lqy6i1zuajsauZjakoeW4SkZP4sz9Mb:KID41vd5lqtWfkZc
TLSH
T1AA065B5AB3F842A6E0B38175C5A69696FE7278111B3087CF1354933C2F277D0EA39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3188	3060	2026-10-05_76c1c3d1b2f7466c279463b1f9fdfbdf_amadey_elex_glassworm_icedid_njrat_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-05_76c1c3d1b2f7466c279463b1f9fdfbdf_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_76c1c3d1b2f7466c279463b1f9fdfbdf_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 932
  2⤵
  PID:3188

memory/3060-0-0x00007FFF2DC4A000-0x00007FFF2DC4B000-memory.dmp

Download

memory/3060-1-0x00007FFF2D950000-0x00007FFF2E388000-memory.dmp

Download

memory/3060-2-0x00007FFF2D950000-0x00007FFF2E388000-memory.dmp

Download

memory/3060-3-0x00007FFF2D950000-0x00007FFF2E388000-memory.dmp

Download

memory/3060-6-0x00007FFF2D950000-0x00007FFF2E388000-memory.dmp

Download