vidar | 43cd1e12828d7e6c9bf16972e62d77466953701c5029ede496a77f08fc678a50

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-12-2023 11:56

Target

1820-3-0x0000000000400000-0x00000000007D3000-memory.exe
Size

3.8MB
MD5

6bfd40e3f156bf51e950b29c0f891cd2
SHA1

6c9ca8301bd05069553edf47e5731553af313771
SHA256

43cd1e12828d7e6c9bf16972e62d77466953701c5029ede496a77f08fc678a50
SHA512

c1f0e0e410bb5ab11572a76528e5c2459969aead506540eaa519213df9b2864747319551b9e5096b9df5fcdb4fe12a662a85d1113698f5b97755fb37c77dd2e1
SSDEEP

3072:ffysv34+VEjY9c5WuSIfSJKTuz1F/nMR8yPUxcrmnUlnrnTfmJ/qIsn8qqVnCdBw:ffyKE89+WyPTuz70R8yTnrjQQhp

Score

10^/10

vidar stealer

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2208 2880 WerFault.exe 1820-3-0x0000000000400000-0x00000000007D3000-memory.exe

pid	pid_target	process	target process
2208	2880	WerFault.exe	1820-3-0x0000000000400000-0x00000000007D3000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1820-3-0x0000000000400000-0x00000000007D3000-memory.exe

description	pid	process	target process
PID 2880 wrote to memory of 2208	2880	1820-3-0x0000000000400000-0x00000000007D3000-memory.exe	WerFault.exe
PID 2880 wrote to memory of 2208	2880	1820-3-0x0000000000400000-0x00000000007D3000-memory.exe	WerFault.exe
PID 2880 wrote to memory of 2208	2880	1820-3-0x0000000000400000-0x00000000007D3000-memory.exe	WerFault.exe
PID 2880 wrote to memory of 2208	2880	1820-3-0x0000000000400000-0x00000000007D3000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1820-3-0x0000000000400000-0x00000000007D3000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1820-3-0x0000000000400000-0x00000000007D3000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 36
2⤵
- Program crash
PID:2208

memory/2880-0-0x0000000000400000-0x0000000000649000-memory.dmp

Filesize
2.3MB

Download