30a0085b1eb42f2639ad4df142501b3653825db391748f7d6d20f7877b077ef9

Analysis

max time kernel
166s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:57

Target

2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe
Size

250KB
MD5

c28689082a33238f951306593b93ac26
SHA1

83dfd3e594377604e03275015929e372df6c994b
SHA256

30a0085b1eb42f2639ad4df142501b3653825db391748f7d6d20f7877b077ef9
SHA512

208bc42a1cc5dedbe158889a7b47abd04c04aaa0c598a263027071feefbf4ee06ae50c72a77d40509760568581edbeab79ed1a4087eb497943ea080b3d6deb89
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3132	.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\.exe	2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe
File opened for modification	C:\Program Files\.exe	2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2768	2608	WerFault.exe	84
4248	2608	WerFault.exe	84

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3132	2608	2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe	85
PID 2608 wrote to memory of 3132	2608	2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe	85
PID 2608 wrote to memory of 3132	2608	2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-25_c28689082a33238f951306593b93ac26_icedid_JC.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files\.exe
  "C:\Program Files\\.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1020
  2⤵
  - Program crash
  PID:2768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1036
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2608 -ip 2608
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2608 -ip 2608
1⤵
PID:4948

C:\Program Files\.exe

Filesize
250KB

MD5
4cf5a7f93632351cbc4b2e79d3f3be4d

SHA1
998692b2658e874da30beaeab6c2b75362efa597

SHA256
d22751d4808b6708508f0ad7504807ab8b29f10d39da19b8872c2d1063f39ec3

SHA512
e72f3928b0b58e28e8e0f52fc34161a10277857c01c417d0094b7ac3a4a5fe54871e140c26d6c34ff9cc42caa331d7056ea2e358b84569037d6dfe4dc42f2721

Download Submit
C:\Program Files\.exe

Filesize
250KB

MD5
4cf5a7f93632351cbc4b2e79d3f3be4d

SHA1
998692b2658e874da30beaeab6c2b75362efa597

SHA256
d22751d4808b6708508f0ad7504807ab8b29f10d39da19b8872c2d1063f39ec3

SHA512
e72f3928b0b58e28e8e0f52fc34161a10277857c01c417d0094b7ac3a4a5fe54871e140c26d6c34ff9cc42caa331d7056ea2e358b84569037d6dfe4dc42f2721

Download Submit