313109fe73a4253c8d6f85dde57b3b871318c96418b34f262ce14e5455ace304

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 22:41

Target
IceFree.exe
Size 719KB
Sample260701-2mjs2ahs3x
SHA256 313109fe73a4253c8d6f85dde57b3b871318c96418b34f262ce14e5455ace304
MD5 d2086590858273df2a16cfec1da82a9f
SHA1 ec2f3687bfd297636f2131c8c2eea9b4ba034e80
SHA512 84d5ff06e5ffddd2b6f2f36feb50cb29c553e514dc95b0c5b771bdd5d11db59bb59fac1e8d8ed8ff7e517cbe832841615ba62356d29561770a8ec88d64ace460
SSDEEP 12288:HGhXXZmmyoR0Gt81PcZWg/inN6GYFkzpXtmi+ntHZHHbScfvX:H2ty6ZZOw/otmi+nnH7Sc
TLSH
T1E4F49E06F2E952E8D07BD1789696A51FFB713854073086CF63E045A91FB37E06BBA702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1800	640	IceFree.exe	86
PID 1800 wrote to memory of 756	1800	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\IceFree.exe
"C:\Users\Admin\AppData\Local\Temp\IceFree.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=65 lines=30
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\mode.com
    mode con cols=65 lines=30
    3⤵
    PID:756