aca3b17ad65e58e4f813c511650dfdfbf61d67a634c49bef0c885eb84126da8b

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 22:45

Target
2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe
Size 10.2MB
Sample261029-2phzhstvdw
SHA256 aca3b17ad65e58e4f813c511650dfdfbf61d67a634c49bef0c885eb84126da8b
MD5 9b81d86cf723654af497ba687edcf7b0
SHA1 b1a276e7a4836cd4a3b965f0d2df784a76573437
SHA512 6640c59faf845d21477440755961d44c9af227a8a240cd338b9d46482db648c3e0124343475c4e001d113b634fbe5874df68edf1806fea802c74332db21ddc99
SSDEEP 98304:m6Hir8DdYkutMue/JpoG2Fet5koKwKEAz6oy7dtPbCWAsfZuUBborQROr:m6y85Vukpo/FetGo5KEDp5ykZ9BMrME
TLSH
T170B67D433693EC47964B3856C06FEC711D2C9CAA088EEA7AC43DE2DF9D9A1532C27571
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 3004	1800	2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe	89

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3004	1800	2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe	89
PID 1800 wrote to memory of 3004	1800	2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9b81d86cf723654af497ba687edcf7b0_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:3004

memory/3004-0-0x0000000140000000-0x0000000140979000-memory.dmp

Download