5caaeafb71c9032d48d97083478c772a5e95bf335dea5709fa266e2773a51b77

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 16:52

Target

2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe
Size

2.0MB
MD5

18f8fd9591e19f37eae99b3d72801c96
SHA1

e2493418265c524e103a704e818300fbcfb835c8
SHA256

5caaeafb71c9032d48d97083478c772a5e95bf335dea5709fa266e2773a51b77
SHA512

1662f202766b707dd436b3f9c14cd6a49f0a0e3c5d982f5da19fd3a88fb41d3338211377b311440dc68862ae993c3c6d1c5e91503f898f11ee482d58d9677846
SSDEEP

49152:Wx/Iop1bTChxKCnFnQXBbrtgb/iQvu0UHO2:O/Iop16hxvWbrtUTrUHO2

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28
PID 1684 wrote to memory of 2292	1684	2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_18f8fd9591e19f37eae99b3d72801c96_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:2292

memory/1684-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1684-1-0x0000000000850000-0x00000000008A4000-memory.dmp

Filesize
336KB

Download
memory/1684-2-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download