f14dcaee108309f92e9971ba79371a195ac34b8c4b0a3e35a45449d716a8a8fe

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 07:30

Target

2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe
Size

271KB
MD5

9d88439b5795fb2c876821eb469c52be
SHA1

6bf65d2b666adbf2a1ab2948811a3a0239d25908
SHA256

f14dcaee108309f92e9971ba79371a195ac34b8c4b0a3e35a45449d716a8a8fe
SHA512

c8657990034d2178f3cf05e00c06350118b79f590abdb90d7ce62afbfedab8d22b9d2600759654f7af574025fc7b425fe00c53fa3210586ec145e50767c3c99d
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
428	.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\.exe	2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe
File opened for modification	C:\Program Files\.exe	2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1180	1488	WerFault.exe	85
2164	1488	WerFault.exe	85

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 428	1488	2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe	87
PID 1488 wrote to memory of 428	1488	2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe	87
PID 1488 wrote to memory of 428	1488	2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_9d88439b5795fb2c876821eb469c52be_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files\.exe
  "C:\Program Files\\.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1040
  2⤵
  - Program crash
  PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1056
  2⤵
  - Program crash
  PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1488 -ip 1488
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1488 -ip 1488
1⤵
PID:224

C:\Program Files\.exe

Filesize
272KB

MD5
9f62dc44f25e7ca318a7f32828447e58

SHA1
e0811651480b49ffa674e20f59a961ab2a6f8229

SHA256
86f33ad22c606653bee69e1df24c6ef881d75965626f9601612bb939d980e390

SHA512
2e2990f2d7e7d2b11e486950d568c34876f4f1ca6be21ffa54607976071f0cc395bd7084cc3140662bf7dd3a697252b39abe6cf5541529ab668cd9bf316a686a

Download Submit