ddaba8f83f15822c8ecf10787496b82f7c14234a66949d8c2bf4baaeade2f072

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 16:09

Target

2024-05-24_3049fc67cc9e9e05410deb3a2eb9a8fb_bkransomware_icedid.exe
Size

916KB
MD5

3049fc67cc9e9e05410deb3a2eb9a8fb
SHA1

2216f1dfb25fe9b8f196476a3bd63aa017d8123a
SHA256

ddaba8f83f15822c8ecf10787496b82f7c14234a66949d8c2bf4baaeade2f072
SHA512

116b5d300aed4f60be1f61197e02befaccea3b8dba1cbc8267ecaf36b3ff4c30d6e29722006e8dd08678297a5a411c32b598ffd82dd58fdd89b0cd0ee5c687da
SSDEEP

24576:nFg6z4FK5bLwYm8ScVdDP8O+z2sZiYME:nFg6zmK5bEYm8lVB8O+ztp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	1600	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2260	1600	2024-05-24_3049fc67cc9e9e05410deb3a2eb9a8fb_bkransomware_icedid.exe	28
PID 1600 wrote to memory of 2260	1600	2024-05-24_3049fc67cc9e9e05410deb3a2eb9a8fb_bkransomware_icedid.exe	28
PID 1600 wrote to memory of 2260	1600	2024-05-24_3049fc67cc9e9e05410deb3a2eb9a8fb_bkransomware_icedid.exe	28
PID 1600 wrote to memory of 2260	1600	2024-05-24_3049fc67cc9e9e05410deb3a2eb9a8fb_bkransomware_icedid.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-24_3049fc67cc9e9e05410deb3a2eb9a8fb_bkransomware_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_3049fc67cc9e9e05410deb3a2eb9a8fb_bkransomware_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 216
  2⤵
  - Program crash
  PID:2260