3d22844322dd416de699efbdacce8c3ef36e3ca745e4aab6f8e730d8753c0848

Analysis

max time kernel
42s
max time network
133s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/02/2023, 07:15

Target

swift-copy.exe
Size

6KB
MD5

3cac4d7c5a529353dfb7359b4dbc462f
SHA1

cc6d47b507661c461f4a7e1a3f50399f12531e9f
SHA256

3d22844322dd416de699efbdacce8c3ef36e3ca745e4aab6f8e730d8753c0848
SHA512

911d5a4a9905efc15cfd30360113159a0f1c0967d7a77977da98b7405c7662bb037292bd6bf67ae1747f44e948571e2d2f789f199b82466c8533ad0d06b9117c
SSDEEP

48:6tPof0vWVuF97+VykI1QpI/LRNMIE+f9P3W4A4u5P6spsmqBHUkZ4tiOllSpvqF9:x+HkI1QgzNfPmrk0KwnSplFnU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	1756	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	swift-copy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1716	1756	swift-copy.exe	27
PID 1756 wrote to memory of 1716	1756	swift-copy.exe	27
PID 1756 wrote to memory of 1716	1756	swift-copy.exe	27
PID 1756 wrote to memory of 1716	1756	swift-copy.exe	27

C:\Users\Admin\AppData\Local\Temp\swift-copy.exe
"C:\Users\Admin\AppData\Local\Temp\swift-copy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 1696
  2⤵
  - Program crash
  PID:1716

memory/1756-54-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/1756-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download