061108f14dfd3dfe4f50a708e14a17f50ec2baf59cf6d8caee06d9adc162c861

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 00:50

Target

2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe
Size

2.2MB
MD5

85d5439e5b9b81a86908f704c6bf325e
SHA1

1d76f2cc21ddc42014601893efdd68503f5ff51d
SHA256

061108f14dfd3dfe4f50a708e14a17f50ec2baf59cf6d8caee06d9adc162c861
SHA512

9bd345904afac0c0c8678f64d880453bb047df6cd0447a5674df2157c2bb001037f8a34b295b7575fc909ad7aafcf4d7e202c95be91f03a155e70b163ca1a1ba
SSDEEP

24576:dXiEBiT/qgffPvKjVwYm4vUMwIOaf3XHjC7rWCiC/9K8G416Jh1eSvyebYe/G3bd:dfgffPvKjNvUcFHrCb/9H1167jKd

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1556	2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	1556	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1556	2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe
1556	2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2300	1556	2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe	28
PID 1556 wrote to memory of 2300	1556	2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe	28
PID 1556 wrote to memory of 2300	1556	2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe	28
PID 1556 wrote to memory of 2300	1556	2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_85d5439e5b9b81a86908f704c6bf325e_icedid.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 344
  2⤵
  - Program crash
  PID:2300

\Users\Admin\AppData\Local\Temp\shis.dll

Filesize
199KB

MD5
149c9c4ec430e6be010793f582753a88

SHA1
9c9d465459299d0204b4449b8ebc55d3c7e23c13

SHA256
68318ab70e1f3522c770d6352dbc47f0c85310937befac635104301cd6e91385

SHA512
b19cc9b2a052d5d41ca95ad70c777a4acd850d0cbca3d981fb2d4566dadfbc496361f270d30b4e2a90a8b9baa4445099f53c3cccd530674312ef72e22127ee8c

Download Submit