stealc | 20378e0d6d0b4e4b9e23ee683bace4f16edb27cd893140efe68cbdc1979670e9

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 18:10

Target

2620-0-0x0000000001F00000-0x000000000212D000-memory.exe
Size

2.2MB
MD5

5e76a74f9c385188b322a8f1b805e497
SHA1

082ae19e32d5568e35f71196b568b7b36803202d
SHA256

20378e0d6d0b4e4b9e23ee683bace4f16edb27cd893140efe68cbdc1979670e9
SHA512

733489f3f6b23b38647f0161ad9ecfb90505dfadecca2d5bf94937c0330380dae75290edd2473e96a40175d609af779d1119e56283df188fe2d8b74c8fd647ce
SSDEEP

1536:20ipRuR8dlktLKAWh2JxIImQGWhx/ysaTRuLjRAdRZIN4bYv0ZiCwahOLX92RGws:2ZR+tLKAWwxWEChuv4bZx8LXURq

Score

10^/10

stealc stealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	1660	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2204	1660	2620-0-0x0000000001F00000-0x000000000212D000-memory.exe	28
PID 1660 wrote to memory of 2204	1660	2620-0-0x0000000001F00000-0x000000000212D000-memory.exe	28
PID 1660 wrote to memory of 2204	1660	2620-0-0x0000000001F00000-0x000000000212D000-memory.exe	28
PID 1660 wrote to memory of 2204	1660	2620-0-0x0000000001F00000-0x000000000212D000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2620-0-0x0000000001F00000-0x000000000212D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2620-0-0x0000000001F00000-0x000000000212D000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 36
  2⤵
  - Program crash
  PID:2204

memory/1660-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download