stealc | f877b30eeeb1de72703902875e96d75315fbf613c502918dfcb9a087a41c8ad3

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 20:47

Target

NEAS.2782890a84bc1064d367ed5bd9239e10.exe
Size

2.2MB
MD5

2782890a84bc1064d367ed5bd9239e10
SHA1

a13ba922add3ec58c505e22e68b89f3af2334980
SHA256

f877b30eeeb1de72703902875e96d75315fbf613c502918dfcb9a087a41c8ad3
SHA512

1dc30089d8fdbad82969d804e52ed7d4141e52312b483342abd0170a75a42997131ea9dfecaca0f332de19e94bdcfc15052e5e85e432919f9e2c29376ec9273c
SSDEEP

1536:yVKECInJMPyh2NgSxktJ+lt96JfSzEL757i4Tj5+WNkZtc4NgmTRYaGL7uIo:CKE1EgSzlt96JMg97i4f5T4NltG+I

Score

10^/10

stealc stealer

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1028	1660	WerFault.exe	86
5056	1660	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1028	1660	NEAS.2782890a84bc1064d367ed5bd9239e10.exe	93
PID 1660 wrote to memory of 1028	1660	NEAS.2782890a84bc1064d367ed5bd9239e10.exe	93
PID 1660 wrote to memory of 1028	1660	NEAS.2782890a84bc1064d367ed5bd9239e10.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.2782890a84bc1064d367ed5bd9239e10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2782890a84bc1064d367ed5bd9239e10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 220
  2⤵
  - Program crash
  PID:1028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 220
  2⤵
  - Program crash
  PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1660 -ip 1660
1⤵
PID:1816

memory/1660-0-0x0000000010000000-0x000000001022D000-memory.dmp

Filesize
2.2MB

Download