stealc | 316c6807d8bfcf659bb87afce11bca97bab6f9b4934c6a587e7555581e1df989

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 22:20

Target

2692-18-0x0000000000400000-0x0000000000718000-memory.exe
Size

3.1MB
MD5

4d35c67a9e8b36d29d09d26d5243de4f
SHA1

8f351e7589b740e8f5c22d4488e89f9fa7a7cd9f
SHA256

316c6807d8bfcf659bb87afce11bca97bab6f9b4934c6a587e7555581e1df989
SHA512

d4e7d4e8aa6040c87c0e3f0ff57cdc1e9323d747f9401e4a18da21412eeb856c32541f2c65df5090cb11e3dcd9493e0bdcff5dbb1c6e499af9e27416d9255d4b
SSDEEP

3072:KwZx7tPwbpTK8Q5Uzf4JElJvIT4oZeiRqsNNSPs7v:bZ1xwbJKAzAElJA8TA

Score

10^/10

stealc stealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	2440	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2432	2440	2692-18-0x0000000000400000-0x0000000000718000-memory.exe	28
PID 2440 wrote to memory of 2432	2440	2692-18-0x0000000000400000-0x0000000000718000-memory.exe	28
PID 2440 wrote to memory of 2432	2440	2692-18-0x0000000000400000-0x0000000000718000-memory.exe	28
PID 2440 wrote to memory of 2432	2440	2692-18-0x0000000000400000-0x0000000000718000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2692-18-0x0000000000400000-0x0000000000718000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2692-18-0x0000000000400000-0x0000000000718000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 36
  2⤵
  - Program crash
  PID:2432

memory/2440-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download