e3a1a48cdf662f39b6ae3730bf63652aa15805682d6564e8a4031f7d4f3b73ac

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 19:25

Target

NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe
Size

2.0MB
MD5

6fbc87abc18320e60c38c76deaea2a8f
SHA1

d4a02a35bd1036b41159d6aeb175565204409acd
SHA256

e3a1a48cdf662f39b6ae3730bf63652aa15805682d6564e8a4031f7d4f3b73ac
SHA512

7a0883024fbe4fb6853533e495181ea9eae7aa04b48b035b0faf809d7d7739381fae893dc16c81b977e6b6cd09bd04e0aa7f4deaddb829f15463e5795f62f9fe
SSDEEP

49152:QJF4FbTChxKCnFnQXBbrtgb/iQvu0UHOa59:QJF4F6hxvWbrtUTrUHOW

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28
PID 1816 wrote to memory of 2464	1816	NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-27_6fbc87abc18320e60c38c76deaea2a8f_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2464