24bd618853e87a3f81a949d0426b34cdbd0c39025872fd391d9b3163a9abea3c

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/08/2023, 15:18

Target

80eb8b555c2f8b52b53dacb05aab3d00_icedid_JC.exe
Size

1016KB
MD5

80eb8b555c2f8b52b53dacb05aab3d00
SHA1

f3b0a9cac8575919cadc1e38a22e005e75bb9466
SHA256

24bd618853e87a3f81a949d0426b34cdbd0c39025872fd391d9b3163a9abea3c
SHA512

16a240f4c3235f48ff6d96204495860e042e1a4abd3e3831e22d040111a057e6519ce2865e962e7a33cc28b838f9e84d2afe23b13a121124087daecfdcbea3b6
SSDEEP

12288:IyiP4NKFqoxWAB0bJXDAReMWHD5QlA6WkO0fI2uBafN7Uio7nbFOU2EVrOyR:NE4NKFqh3zAGHF8u0Uk76rbF52EQ0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	1580	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 912	1580	80eb8b555c2f8b52b53dacb05aab3d00_icedid_JC.exe	28
PID 1580 wrote to memory of 912	1580	80eb8b555c2f8b52b53dacb05aab3d00_icedid_JC.exe	28
PID 1580 wrote to memory of 912	1580	80eb8b555c2f8b52b53dacb05aab3d00_icedid_JC.exe	28
PID 1580 wrote to memory of 912	1580	80eb8b555c2f8b52b53dacb05aab3d00_icedid_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\80eb8b555c2f8b52b53dacb05aab3d00_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\80eb8b555c2f8b52b53dacb05aab3d00_icedid_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 216
  2⤵
  - Program crash
  PID:912