0bfaf17eca96254ee40cd586b9741b4af344b7452e368db56dfaa44601eb8d1d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 17:00

Target

Swift_copy_MT103.scr
Size

483KB
MD5

f5f16eeed6eee9590c6d8dfc2e75b4bb
SHA1

e0f1175ecb442acc5cb064da164c09a9a0d18928
SHA256

0bfaf17eca96254ee40cd586b9741b4af344b7452e368db56dfaa44601eb8d1d
SHA512

484fde7aa869c7d9cedd4427574a8bef28404a2b509d343c7e03f8876632bd72cd04627f60439df4e7c6a570e0f106fd91d6f23595ce8226df3d3a537898adc4
SSDEEP

12288:orTA9qzGVSha8tmTGZv8F2ePxLhiQcVdTZZBDG:f9cGMhPtmc0F2KxLkTC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2868	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	Swift_copy_MT103.scr

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2692	2868	Swift_copy_MT103.scr	30
PID 2868 wrote to memory of 2692	2868	Swift_copy_MT103.scr	30
PID 2868 wrote to memory of 2692	2868	Swift_copy_MT103.scr	30
PID 2868 wrote to memory of 2692	2868	Swift_copy_MT103.scr	30

C:\Users\Admin\AppData\Local\Temp\Swift_copy_MT103.scr
"C:\Users\Admin\AppData\Local\Temp\Swift_copy_MT103.scr" /S
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 748
  2⤵
  - Program crash
  PID:2692

memory/2868-1-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2868-0-0x0000000000A40000-0x0000000000AC0000-memory.dmp

Filesize
512KB

Download
memory/2868-2-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/2868-3-0x0000000000480000-0x00000000004C6000-memory.dmp

Filesize
280KB

Download
memory/2868-4-0x0000000000990000-0x00000000009D4000-memory.dmp

Filesize
272KB

Download
memory/2868-5-0x00000000009D0000-0x00000000009FC000-memory.dmp

Filesize
176KB

Download
memory/2868-6-0x0000000000A00000-0x0000000000A2C000-memory.dmp

Filesize
176KB

Download
memory/2868-7-0x00000000021D0000-0x000000000221C000-memory.dmp

Filesize
304KB

Download
memory/2868-8-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2868-9-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download