9dfd9793dd172c0c6c730d2e2b3c9b5c9daa0c7e317ff4148b19c3aa95558471

Analysis

Target
iceix_1.2.7.0.vir.exe
Size 204KB
Sample200719-p75xbbxfve
SHA256 9dfd9793dd172c0c6c730d2e2b3c9b5c9daa0c7e317ff4148b19c3aa95558471
MD5 b92b8f41fdbf4ab686b0d596b102f67c
SHA1 ecdfcdd954d17b4033ad01510e1206d021db9df3
SHA512 dc02c9c9e4e505af9920f268f9d3d95164b0e5dd6e1e957859cef745138afc561b540921c5e1034547a7ac048d1e4b4ae9b033e6bae25a4395c52e97fbdb1153
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	iceix_1.2.7.0.vir.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67
PID 3828 wrote to memory of 3896	3828	iceix_1.2.7.0.vir.exe	67

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 3896	3828	iceix_1.2.7.0.vir.exe	67

C:\Users\Admin\AppData\Local\Temp\iceix_1.2.7.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\iceix_1.2.7.0.vir.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3828
- C:\Users\Admin\AppData\Local\Temp\iceix_1.2.7.0.vir.exe
  "C:\Users\Admin\AppData\Local\Temp\iceix_1.2.7.0.vir.exe"
  2⤵
  PID:3896

memory/3896-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3896-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download