stealc | 767dba0ea0b39c3c85999a16f12b7d2cc29cfd4cdc04059c5ad0fff8d25be48d

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 23:32

Target

2204-2-0x0000000000400000-0x000000000062D000-memory.exe
Size

2.2MB
MD5

a1dd3453c5ff99606b1ede27fe247ce3
SHA1

d1d738f7d3027d59387ee12e7d535ed4b4314f04
SHA256

767dba0ea0b39c3c85999a16f12b7d2cc29cfd4cdc04059c5ad0fff8d25be48d
SHA512

64381a0f70f4b5096cb72fe877f121577db386105e405014329a7e33b28b39a8bd3d20f2da67298661042d58b74729f1e1316492934020109c14e8ee2c1950c8
SSDEEP

3072:YGIRh3wQ5jXl9t6Swu6bCYf5z46CyOVfF1z2Y8KI:fIRhgQ9jtpf4DHO/F20

Score

10^/10

stealc stealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	2560	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1668	2560	2204-2-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2560 wrote to memory of 1668	2560	2204-2-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2560 wrote to memory of 1668	2560	2204-2-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2560 wrote to memory of 1668	2560	2204-2-0x0000000000400000-0x000000000062D000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2204-2-0x0000000000400000-0x000000000062D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2204-2-0x0000000000400000-0x000000000062D000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 36
  2⤵
  - Program crash
  PID:1668

memory/2560-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download