stealc | fc5e36c7a281931e1c91db735e85333f5f45c613174c2c1bcc5606703a5a89d6

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 22:58

Target

2188-3-0x0000000000400000-0x000000000062D000-memory.exe
Size

2.2MB
MD5

8bf3b430962a40211d881bf03807cd91
SHA1

a2f47f59a18482e7697e1b236af3ab3018c628c3
SHA256

fc5e36c7a281931e1c91db735e85333f5f45c613174c2c1bcc5606703a5a89d6
SHA512

f8c40b5cfbdb07d24103f2567cbdeaad68260900e026428556552dedd931e2dd75bce6efc62bca311820cdcca70b150d1da1ec36cdbae57c1f96036701360a4c
SSDEEP

1536:1V/6ogcasplKQJa1HmAlfR9Rwk/Tr2GreyjS0Pz+Tcgr6SzI41jfwsLkWT0kTNuC:n/vgwFJ0mi2kWGreC41jBF0kZu

Score

10^/10

stealc stealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 636	2220	2188-3-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2220 wrote to memory of 636	2220	2188-3-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2220 wrote to memory of 636	2220	2188-3-0x0000000000400000-0x000000000062D000-memory.exe	28
PID 2220 wrote to memory of 636	2220	2188-3-0x0000000000400000-0x000000000062D000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2188-3-0x0000000000400000-0x000000000062D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2188-3-0x0000000000400000-0x000000000062D000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 36
  2⤵
  - Program crash
  PID:636

memory/2220-0-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download