c28a9fa719c5d4107f71b81333f21b32a654fc49b7ba7dc249166bd809b1fc54

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 23:29

Target

2024-02-01_b5bb0601d571161eba68a0585bb175c2_icedid.exe
Size

1016KB
MD5

b5bb0601d571161eba68a0585bb175c2
SHA1

b3ea03c1a2be6704449eac3ca6321d3a3ba653cb
SHA256

c28a9fa719c5d4107f71b81333f21b32a654fc49b7ba7dc249166bd809b1fc54
SHA512

94ae034c9bbab89b804b213c779e8d60ae60f8dbc94ec1d0ffd44d7a19cfa9295f4c89c98bea08429c45e5d5fa05ed534509b5152a624944ee155c84b702480c
SSDEEP

12288:IyiP4NKFqoxWAB0bJXDAReMWHD5QlA6WkO0fI2uBIfN1UiK7nbFOU2EVrOyR:NE4NKFqh3zAGHF8u0Ue18rbF52EQ0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2724	WerFault.exe	9

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2628	2724	2024-02-01_b5bb0601d571161eba68a0585bb175c2_icedid.exe	28
PID 2724 wrote to memory of 2628	2724	2024-02-01_b5bb0601d571161eba68a0585bb175c2_icedid.exe	28
PID 2724 wrote to memory of 2628	2724	2024-02-01_b5bb0601d571161eba68a0585bb175c2_icedid.exe	28
PID 2724 wrote to memory of 2628	2724	2024-02-01_b5bb0601d571161eba68a0585bb175c2_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-01_b5bb0601d571161eba68a0585bb175c2_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_b5bb0601d571161eba68a0585bb175c2_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 216
  2⤵
  - Program crash
  PID:2628