7023f2c5e99db19bc82a8ca0487a4a83a2b9c9c945fdea196b14613a3564aa02

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 07:34

Target

2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe
Size

269KB
MD5

8d83badec8034224836389cc64d9cb5e
SHA1

a20ca83c55bb7e1e297c424ad5151159b09c0ce1
SHA256

7023f2c5e99db19bc82a8ca0487a4a83a2b9c9c945fdea196b14613a3564aa02
SHA512

47e78e32acc2df5901c4f68e9c505391eaae733a2069edc138b2b38ee52afbb13fded3169bf57e3dc26b30af7e830bf93aa683e62afd33d85b71269a03306dac
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2488	Before.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\optional\Before.exe	2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe
File opened for modification	C:\Program Files\optional\Before.exe	2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2620	1232	WerFault.exe	82
3220	1232	WerFault.exe	82

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2488	1232	2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe	83
PID 1232 wrote to memory of 2488	1232	2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe	83
PID 1232 wrote to memory of 2488	1232	2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_8d83badec8034224836389cc64d9cb5e_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files\optional\Before.exe
  "C:\Program Files\optional\Before.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 964
  2⤵
  - Program crash
  PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1028
  2⤵
  - Program crash
  PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1232 -ip 1232
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1232 -ip 1232
1⤵
PID:4784

C:\Program Files\optional\Before.exe

Filesize
269KB

MD5
7801568396e3798e04e87b4c660434b2

SHA1
c2952357804936949b185cfaaa0efa22da43d399

SHA256
6b41a3e94763d346d63f749bff8cbb0195ab00f6916257abfcb3a976135c8a12

SHA512
33a77affed08c44c28eafe941d6e7aecbb10e19f9b0cec105917ebda0a44ee75f549670361c58e5a550abf4200ff092f480ff0363106305c9326a96057122706

Download Submit