51eecb61e28ce7daa14890d261650ec00585084176e1e5c82388ad821181dc55

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 12:30

Target

2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe
Size

275KB
MD5

497a38c4ff9c680723d1706a73b96061
SHA1

17bc24e8b672534b9dac82b2253318920f9c7dac
SHA256

51eecb61e28ce7daa14890d261650ec00585084176e1e5c82388ad821181dc55
SHA512

0e0849d02f4f80a2e3e9a2a9bae7a7168cd84695f7b98ce17b00fb778b9a887627d640a56dd54f8b8899a526c38dc1118c07a3edf578c325cfb287a54a122b6f
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
116	.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\.exe	2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe
File opened for modification	C:\Program Files\.exe	2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3344	4900	WerFault.exe	82
5076	4900	WerFault.exe	82

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 116	4900	2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe	83
PID 4900 wrote to memory of 116	4900	2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe	83
PID 4900 wrote to memory of 116	4900	2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_497a38c4ff9c680723d1706a73b96061_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files\.exe
  "C:\Program Files\\.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1004
  2⤵
  - Program crash
  PID:3344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1044
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4900 -ip 4900
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4900 -ip 4900
1⤵
PID:4808

C:\Program Files\.exe

Filesize
275KB

MD5
130182f7e26b212890dcc78b8c1cdac7

SHA1
dec10c2c31eb8ececf566b43d5cba428a49f5af8

SHA256
2b8fe081161fe41e3261c2f8d251086d060bc4e203dcfab27b7acb04da33aa65

SHA512
2fe7d12993cb63088d29785f03ebbd7f208d699981d74f40312cb3f6d240380f3401e37620668c1e64ad5ba1382b6ca46ef164cf0d8d856b04bef6ceeb9fb4db

Download Submit