stealc | 351e84b29754a646630d18b7676a53532e351632277e6ef6224538f3c99d042a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:21

Target

25443afbdb5625191ebba66d983283f7.exe
Size

12.0MB
MD5

25443afbdb5625191ebba66d983283f7
SHA1

9a7d11aa149d5b6bc55c9129b76a090189b1b59a
SHA256

351e84b29754a646630d18b7676a53532e351632277e6ef6224538f3c99d042a
SHA512

161ae739e16a8bf844e7675028b2c4e4558a2a611f44620297842788a1402269f716afe5b88c86e5d01440d5d46a2721259dd155b16493c8788f7e096eb51ca2
SSDEEP

98304:30xIvFwzCsUepwry/RAWkimsnioeCRSPjfiAr8e5shasPgPEXIFrU4To:ExDppwryJAKmsnioez58e4aYlXIFxE

Score

10^/10

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2044 2220 WerFault.exe 25443afbdb5625191ebba66d983283f7.exe

pid	pid_target	process	target process
2044	2220	WerFault.exe	25443afbdb5625191ebba66d983283f7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

25443afbdb5625191ebba66d983283f7.exe

description	pid	process	target process
PID 2220 wrote to memory of 2044	2220	25443afbdb5625191ebba66d983283f7.exe	WerFault.exe
PID 2220 wrote to memory of 2044	2220	25443afbdb5625191ebba66d983283f7.exe	WerFault.exe
PID 2220 wrote to memory of 2044	2220	25443afbdb5625191ebba66d983283f7.exe	WerFault.exe
PID 2220 wrote to memory of 2044	2220	25443afbdb5625191ebba66d983283f7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\25443afbdb5625191ebba66d983283f7.exe
"C:\Users\Admin\AppData\Local\Temp\25443afbdb5625191ebba66d983283f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 36
2⤵
- Program crash
PID:2044

memory/2220-0-0x0000000000A30000-0x0000000001624000-memory.dmp

Filesize
12.0MB

Download