36919646f6c29a9422c53ab31e8299f92093e1c8169b063aeafd9023667a1536

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/04/2023, 09:48

Target

stealer.exe
Size

7.2MB
MD5

5c4750c9a5ed3e46da5475728bbcc4d4
SHA1

ea391857bc6ff1bc86767e28998da3d3b46e8711
SHA256

36919646f6c29a9422c53ab31e8299f92093e1c8169b063aeafd9023667a1536
SHA512

2e3b1bd5c468d23445e8a7e32a5d8de62e75649989d77a36dbd56894ce166eb5a85c8b62397abe442d2b9066ed296e523b33c5f3f25d35658cd3029d430bef1a
SSDEEP

196608:tjauUxbAQ5owejuJDUX47dwdW0LB6cYPZ1hzAx:axCaUX47d4b83

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
972	stealer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 972	2040	stealer.exe	28
PID 2040 wrote to memory of 972	2040	stealer.exe	28
PID 2040 wrote to memory of 972	2040	stealer.exe	28

C:\Users\Admin\AppData\Local\Temp\stealer.exe
"C:\Users\Admin\AppData\Local\Temp\stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\stealer.exe"
  2⤵
  - Loads dropped DLL
  PID:972

C:\Users\Admin\AppData\Local\Temp\_MEI20402\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20402\python311.dll

Filesize
5.5MB

MD5
1fe47c83669491bf38a949253d7d960f

SHA1
de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

SHA256
0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

SHA512
05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

Download Submit