vidar | 2d6de52c2d409ae51954c32bb0b5047963be89f54a45937aa4f01dae97c18943

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 06:54

Target

624-116-0x0000000001180000-0x0000000001725000-memory.exe
Size

5.6MB
MD5

494b65a8e14650cf79fb56c95d517b88
SHA1

0881aacff85a368c9bd744a99225615df8d88a95
SHA256

2d6de52c2d409ae51954c32bb0b5047963be89f54a45937aa4f01dae97c18943
SHA512

8c037eaf2f369f43a3b8bdff323b68f62506561614f1c20ec8c1e7715d6e5ccbe79ff1a2e3a7b8d9ec3e8b81f90139dcc4cb90811ab1d1ba5360088de307bb0b
SSDEEP

49152:l1gAEzhvvykh5g/A0T7IH5tw+SXdea0G8NFKYA5P:l1gAWXyk04aIfw+SQzNFKdP

Score

10^/10

vidar stealer

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2028-0-0x0000000001180000-0x0000000001725000-memory.dmp	family_vidar_v7

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1984	2028	624-116-0x0000000001180000-0x0000000001725000-memory.exe	28
PID 2028 wrote to memory of 1984	2028	624-116-0x0000000001180000-0x0000000001725000-memory.exe	28
PID 2028 wrote to memory of 1984	2028	624-116-0x0000000001180000-0x0000000001725000-memory.exe	28
PID 2028 wrote to memory of 1984	2028	624-116-0x0000000001180000-0x0000000001725000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\624-116-0x0000000001180000-0x0000000001725000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\624-116-0x0000000001180000-0x0000000001725000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
  2⤵
  - Program crash
  PID:1984

memory/2028-0-0x0000000001180000-0x0000000001725000-memory.dmp

Filesize
5.6MB

Download