c8a643a77d35c6f1acbc3c3fea8cd789d10ecf4a2f78fd6f2248858616e83154

Analysis

max time kernel
92s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 21:39

Target

2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe
Size

283KB
MD5

6a90fab20859046a6fb478556bf827b9
SHA1

61d17729eb48d309b094891de9650769764e500f
SHA256

c8a643a77d35c6f1acbc3c3fea8cd789d10ecf4a2f78fd6f2248858616e83154
SHA512

0c0c83c056b72656b01c47a98132500f348bfed5068d84f77c41b8ea8f499348b9391a1305fc47664ac2502c2bf147e7e0af35b88ec6c8dd0a8be770c4157c85
SSDEEP

3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
820	Synthesis.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Multimedia\Synthesis.exe	2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe
File opened for modification	C:\Program Files\Multimedia\Synthesis.exe	2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4020	4808	WerFault.exe	85
2904	4808	WerFault.exe	85

Suspicious use of SetWindowsHookEx 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 820	4808	2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe	87
PID 4808 wrote to memory of 820	4808	2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe	87
PID 4808 wrote to memory of 820	4808	2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_6a90fab20859046a6fb478556bf827b9_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files\Multimedia\Synthesis.exe
  "C:\Program Files\Multimedia\Synthesis.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1012
  2⤵
  - Program crash
  PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 940
  2⤵
  - Program crash
  PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4808 -ip 4808
1⤵
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4808 -ip 4808
1⤵
PID:3340

C:\Program Files\Multimedia\Synthesis.exe

Filesize
284KB

MD5
78b288e72b6b4537910a0846a501fca3

SHA1
e503b50587a826bdadc18db5be8971c1f4faafea

SHA256
9ba4d2d7c4dac4adbd2f541fc54cc8fba782918221e2fb6c399df0d3873a6165

SHA512
3d4e6013ebc4fbcd6b82d9bda565364b5985fc2d3c2cde89d6a247cc4118ba47383dc6dd6430ca6df8896780f63e10172cd17083dd4132531fecfc731c88b802

Download Submit