stealc | f877b30eeeb1de72703902875e96d75315fbf613c502918dfcb9a087a41c8ad3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06-11-2023 20:47

Target

NEAS.2782890a84bc1064d367ed5bd9239e10.exe
Size

2.2MB
MD5

2782890a84bc1064d367ed5bd9239e10
SHA1

a13ba922add3ec58c505e22e68b89f3af2334980
SHA256

f877b30eeeb1de72703902875e96d75315fbf613c502918dfcb9a087a41c8ad3
SHA512

1dc30089d8fdbad82969d804e52ed7d4141e52312b483342abd0170a75a42997131ea9dfecaca0f332de19e94bdcfc15052e5e85e432919f9e2c29376ec9273c
SSDEEP

1536:yVKECInJMPyh2NgSxktJ+lt96JfSzEL757i4Tj5+WNkZtc4NgmTRYaGL7uIo:CKE1EgSzlt96JMg97i4f5T4NltG+I

Score

10^/10

stealc stealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	1248	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2208	1248	NEAS.2782890a84bc1064d367ed5bd9239e10.exe	28
PID 1248 wrote to memory of 2208	1248	NEAS.2782890a84bc1064d367ed5bd9239e10.exe	28
PID 1248 wrote to memory of 2208	1248	NEAS.2782890a84bc1064d367ed5bd9239e10.exe	28
PID 1248 wrote to memory of 2208	1248	NEAS.2782890a84bc1064d367ed5bd9239e10.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2782890a84bc1064d367ed5bd9239e10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2782890a84bc1064d367ed5bd9239e10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 36
  2⤵
  - Program crash
  PID:2208

memory/1248-0-0x0000000010000000-0x000000001022D000-memory.dmp

Filesize
2.2MB

Download