33d9a1bb8c236416a04f49094de801e3b8cb75df51caf18a567c462c4429d9a9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 15:11

Target

2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe
Size

13.7MB
MD5

78f5d22613f9ccab6db3e8b4bdc18e8b
SHA1

a9c5a297c179d84f6eb373d49fa42ee6a10c78c3
SHA256

33d9a1bb8c236416a04f49094de801e3b8cb75df51caf18a567c462c4429d9a9
SHA512

0bcd76e68343171d2c6669960079a0a2052b9ebd1f4cf649c04d6c42d435486c9109c8d2def6184ef34505a2916aa05221c1d18c0bd5c7f46b5c6465ada5c2f8
SSDEEP

393216:pp3RAs7/m+NtWKIoLjJMY9H4QPWvHE74L4GECcqkM:R4+2GLdLlZc1L4GTcc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	3044	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe
3044	2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2372	3044	2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe	28
PID 3044 wrote to memory of 2372	3044	2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe	28
PID 3044 wrote to memory of 2372	3044	2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe	28
PID 3044 wrote to memory of 2372	3044	2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_78f5d22613f9ccab6db3e8b4bdc18e8b_icedid_JC.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 328
  2⤵
  - Program crash
  PID:2372