cce98af35b513aa9b81afd1a47d4a362045aa1cfd3d0b9214622f36b3230e5d8

Analysis

max time kernel
164s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 01:39

Target

2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe
Size

248KB
MD5

3468145d2251ac2223c53013028a91de
SHA1

e712f6e30aca429719bf8c41000b3edd09a4e669
SHA256

cce98af35b513aa9b81afd1a47d4a362045aa1cfd3d0b9214622f36b3230e5d8
SHA512

0a4336a96c3f6ab29e6deba9138f38edb583ce0cd6fea57f3779da1de9c74d4575b4f23787575a7fde9c5abe9efd8600dee2284e9e4949aa6f557bedc16b6f4b
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1388	.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\.exe	2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe
File opened for modification	C:\Program Files\.exe	2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4100	3104	WerFault.exe	83
4684	3104	WerFault.exe	83

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 1388	3104	2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe	87
PID 3104 wrote to memory of 1388	3104	2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe	87
PID 3104 wrote to memory of 1388	3104	2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe	87

C:\Users\Admin\AppData\Local\Temp\2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_3468145d2251ac2223c53013028a91de_icedid_JC.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Program Files\.exe
  "C:\Program Files\\.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1016
  2⤵
  - Program crash
  PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1020
  2⤵
  - Program crash
  PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3104 -ip 3104
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3104 -ip 3104
1⤵
PID:3332

C:\Program Files\.exe

Filesize
248KB

MD5
d5e2b9d97b854271adfcc8c2d671b73c

SHA1
a9749da8747038b57545d701fefae80e098ed07b

SHA256
2609b8703aac879ae1b733fb34b7fccb6b76da156adbee7d739aac55aa0a550a

SHA512
fb97664b53358f3f18d99f7bfa9c6b9a77437a7831a1da84430ff4baa27bb7da788c1839b89dc34de41c54aaee23a5ff9c081d479ffb9871324ad2dcfd1e9e72

Download Submit
C:\Program Files\.exe

Filesize
248KB

MD5
d5e2b9d97b854271adfcc8c2d671b73c

SHA1
a9749da8747038b57545d701fefae80e098ed07b

SHA256
2609b8703aac879ae1b733fb34b7fccb6b76da156adbee7d739aac55aa0a550a

SHA512
fb97664b53358f3f18d99f7bfa9c6b9a77437a7831a1da84430ff4baa27bb7da788c1839b89dc34de41c54aaee23a5ff9c081d479ffb9871324ad2dcfd1e9e72

Download Submit