phemedrone | b0c22f4878dacf6fcbbc585599aa5685f06646958d2f41afa237eed18e99e2ab

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 02:03

Target

1684-1-0x0000000000460000-0x000000000047E000-memory.exe
Size

120KB
MD5

a98612096908dc10ddfb8b7d39037547
SHA1

fd1e2fd5bea052b016c876dbe88d94af8e4a977a
SHA256

b0c22f4878dacf6fcbbc585599aa5685f06646958d2f41afa237eed18e99e2ab
SHA512

30b2c89e47b2cefc4f58e914042835e2efcafef2e330c645d24b1fc14b548dbaec3c3a7428b75c4e7382ff7a1779ea30f159ed97243a43d5b2ce86fbcc4c7429
SSDEEP

3072:oFM13HiPeK2hS5TbZuwEKSKe9jVQPnkk+:De2hExEKy9jV

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2316 2112 WerFault.exe 1684-1-0x0000000000460000-0x000000000047E000-memory.exe

pid	pid_target	process	target process
2316	2112	WerFault.exe	1684-1-0x0000000000460000-0x000000000047E000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1684-1-0x0000000000460000-0x000000000047E000-memory.exe

description	pid	process	target process
PID 2112 wrote to memory of 2316	2112	1684-1-0x0000000000460000-0x000000000047E000-memory.exe	WerFault.exe
PID 2112 wrote to memory of 2316	2112	1684-1-0x0000000000460000-0x000000000047E000-memory.exe	WerFault.exe
PID 2112 wrote to memory of 2316	2112	1684-1-0x0000000000460000-0x000000000047E000-memory.exe	WerFault.exe
PID 2112 wrote to memory of 2316	2112	1684-1-0x0000000000460000-0x000000000047E000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1684-1-0x0000000000460000-0x000000000047E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1684-1-0x0000000000460000-0x000000000047E000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 548
  2⤵
  - Program crash
  PID:2316

memory/2112-0-0x0000000001350000-0x000000000136E000-memory.dmp

Filesize
120KB

Download
memory/2112-1-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-2-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download