1089430b22ba44e3e20691ef74553daac2b6cc283808a08c8c547ec4adff5b0f | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/06/2023, 08:17

Sharing

Report Analysis Logs

General

Target

SWIFT COPY.exe
Size

850KB
MD5

176692d86cc4d89bf731ae3639eb5313
SHA1

022a777e22b8066b907c57113d6a7547a1d31cc1
SHA256

1c4ce65bd75a1093b173417455db9fe48fc948cd5e35ea9418018b33e0dcecf4
SHA512

f1224c75bb418edccc696e71c5e02ff20455e27fbca1396ad0caa6f6175d71e3350724cfd62ef9f82d67ecf80bcbced2a5da846c4b2a8e6bba28be11e72f9ef7
SSDEEP

24576:l1iewlqB6pYmppeD/QcccsTyWImuxpUzznI1zU6:lQe2q8p1ELFVxpx1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1764	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1312	1764	SWIFT COPY.exe	28
PID 1764 wrote to memory of 1312	1764	SWIFT COPY.exe	28
PID 1764 wrote to memory of 1312	1764	SWIFT COPY.exe	28
PID 1764 wrote to memory of 1312	1764	SWIFT COPY.exe	28

C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 656
  2⤵
  - Program crash
  PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-54-0x0000000001200000-0x00000000012DA000-memory.dmp

Filesize
872KB

Download
memory/1764-55-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1764-56-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download