a4f9c596e92cf3dafa7ea50beea52b3df9f244a55d088ec141be2269eba3de2d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 23:32

Target

2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe
Size

275KB
MD5

7615de76c585b788491088c179241f7f
SHA1

e2f655866bd48557305f501811cd3848be5742a8
SHA256

a4f9c596e92cf3dafa7ea50beea52b3df9f244a55d088ec141be2269eba3de2d
SHA512

0f345f3e77a381188a72bec367f74b4b4e45c7d33edaf6d49aae984d144cd028b6583176aac970f437862a3ac48c4d2a346fd9bfce7ebafaead34293ccd2c9e4
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4576	previous.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\instead\previous.exe	2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe
File opened for modification	C:\Program Files\instead\previous.exe	2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4896	5068	WerFault.exe	85
5012	5068	WerFault.exe	85

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4576	5068	2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe	86
PID 5068 wrote to memory of 4576	5068	2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe	86
PID 5068 wrote to memory of 4576	5068	2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_7615de76c585b788491088c179241f7f_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\instead\previous.exe
  "C:\Program Files\instead\previous.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1048
  2⤵
  - Program crash
  PID:4896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1044
  2⤵
  - Program crash
  PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5068 -ip 5068
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5068 -ip 5068
1⤵
PID:4328

C:\Program Files\instead\previous.exe

Filesize
275KB

MD5
b7111a8a083517c09451f81f6eccf552

SHA1
b3afbbc5a0b81f7bfb1c2629c22c82ebc539a97d

SHA256
56a38aec9537fb9399c3b150724ea990ac364528bdb88ddd0977300c4cef11d9

SHA512
76220e56ed59dff4ee200ece3fc19e515854427c07c92b7ccb008aefad8ecb2d74dfe6741af8698cc144435b71645d7f13382b1c58e652770fcfbb30ce01f9be

Download Submit