phemedrone | 9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-10-2023 14:30

Target

9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4.exe
Size

83KB
MD5

82f85b726de92d4eb9923d087b0845ea
SHA1

50cb73f3eaabd48988a3b7f04fff4eda01e351e2
SHA256

9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4
SHA512

13e44bdbde9b43c90d0a88da871e25e2a47392ad7438d667bb7bead0006210f4c1481bb68cb1c181b5b946d59a5855468490c0a95133d22a069fcf12b20e991e
SSDEEP

1536:YMthu5yZ5Ua8PGTtMwZ6YWKSO5T3rZxSwEKSKe9jzpmV:YMtrZ5UFP0hU5S5TbZ0wEKSKe9jVA

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4.exe

description	pid	process	target process
PID 1724 wrote to memory of 1668	1724	9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4.exe	WerFault.exe
PID 1724 wrote to memory of 1668	1724	9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4.exe	WerFault.exe
PID 1724 wrote to memory of 1668	1724	9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4.exe
"C:\Users\Admin\AppData\Local\Temp\9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 520
  2⤵
  PID:1668

memory/1724-0-0x0000000000C00000-0x0000000000C1C000-memory.dmp

Filesize
112KB

Download
memory/1724-1-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1724-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download