stealc | 13f4ddcb4ed8fd62a64d942e4eaf4d639725fab195792c3c725db4d75d092de4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 16:29

Target

1944-108-0x0000000000790000-0x000000000138C000-memory.exe
Size

12.0MB
MD5

970bfa06f8d8814cd00f802e93c154b4
SHA1

2f0a778e1623ec24a818a622f2b141bffffa78a5
SHA256

13f4ddcb4ed8fd62a64d942e4eaf4d639725fab195792c3c725db4d75d092de4
SHA512

76f3d8fae01d1887f0595192c112c121325ae2975ffafb34565e10ae586f378f440d91d08a68b1ea37a5d24d43ceea54a98e3213cacd9593e784776f1c125bc9
SSDEEP

98304:o8GsHNjA2hWu5xuJKqS9Q/oP2VaHO+Mi5JHn2ibOycfnoWyOcg:5GEwWd9tLO+MaLbOroWQ

Score

10^/10

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 1760 WerFault.exe 1944-108-0x0000000000790000-0x000000000138C000-memory.exe

pid	pid_target	process	target process
1184	1760	WerFault.exe	1944-108-0x0000000000790000-0x000000000138C000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1944-108-0x0000000000790000-0x000000000138C000-memory.exe

description	pid	process	target process
PID 1760 wrote to memory of 1184	1760	1944-108-0x0000000000790000-0x000000000138C000-memory.exe	WerFault.exe
PID 1760 wrote to memory of 1184	1760	1944-108-0x0000000000790000-0x000000000138C000-memory.exe	WerFault.exe
PID 1760 wrote to memory of 1184	1760	1944-108-0x0000000000790000-0x000000000138C000-memory.exe	WerFault.exe
PID 1760 wrote to memory of 1184	1760	1944-108-0x0000000000790000-0x000000000138C000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1944-108-0x0000000000790000-0x000000000138C000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1944-108-0x0000000000790000-0x000000000138C000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 36
2⤵
- Program crash
PID:1184

memory/1760-0-0x0000000000790000-0x000000000138C000-memory.dmp

Filesize
12.0MB

Download