ee4d1c36adaa180d8bb191c988b11a9fd50893415f486a60969b0af8f0654aeb

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 09:25

Target

2024-11-14_de7c81f064918aed14c35f3a30d568f8_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe
Size

14.3MB
MD5

de7c81f064918aed14c35f3a30d568f8
SHA1

0151430f268d76a28fb05bde6d4ee3fe5f292623
SHA256

ee4d1c36adaa180d8bb191c988b11a9fd50893415f486a60969b0af8f0654aeb
SHA512

419540042fe83ab63ac46d85dba5f92a957893baa4c758325b787930c70137f3b10bda02cecf2a1fe4fd1261bb639fc6ecfa3527a8df681e5df5b2bd04f2c552
SSDEEP

98304:i14ytCmr9D3cbrerQQVwEc0NdhIwt9yUQe9xmHP/uRZEUDcusR+G:i14y3t3cbK1VwxW/5J9xCG6UDS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-11-14_de7c81f064918aed14c35f3a30d568f8_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe

description	pid	Process	procid_target
PID 1048 wrote to memory of 1812	1048	2024-11-14_de7c81f064918aed14c35f3a30d568f8_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	28
PID 1048 wrote to memory of 1812	1048	2024-11-14_de7c81f064918aed14c35f3a30d568f8_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	28
PID 1048 wrote to memory of 1812	1048	2024-11-14_de7c81f064918aed14c35f3a30d568f8_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-11-14_de7c81f064918aed14c35f3a30d568f8_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-14_de7c81f064918aed14c35f3a30d568f8_frostygoop_luca-stealer_poet-rat_sliver_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1048 -s 20
  2⤵
  PID:1812