stealc | 5132c2deabbf00b418e03f9f91520965e3254431a366c2307d79fde3bd8eae73

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 05:45

Target

2880-13-0x0000000000400000-0x000000000062D000-memory.exe
Size

2.2MB
MD5

e3cb8a29ac7849d4d05a80aaaecd2218
SHA1

2c8bb8cf913dc74fd2a7b95a9dbaaadc7e79bf7a
SHA256

5132c2deabbf00b418e03f9f91520965e3254431a366c2307d79fde3bd8eae73
SHA512

bdb2fd9ad751b22d33be2c13c91424c08cee60e012302cc7cce39d5dd360da2e9ee472ca01e6e8e99b02cc32d586f95234666688d41bae4f2de282112f0ea763
SSDEEP

3072:x+QZx7YwQ5jXl9t6Swu6bCYf5z46CyOVfFexADV:MQZ1/Q9jtpf4DHO/

Score

10^/10

stealc stealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	2228	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2024	2228	2880-13-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2228 wrote to memory of 2024	2228	2880-13-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2228 wrote to memory of 2024	2228	2880-13-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2228 wrote to memory of 2024	2228	2880-13-0x0000000000400000-0x000000000062D000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2880-13-0x0000000000400000-0x000000000062D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2880-13-0x0000000000400000-0x000000000062D000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 36
  2⤵
  - Program crash
  PID:2024

memory/2228-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download