8a75c8853ee688d0293031a7f774203babd1e9c2f4876dc4f4b25667dd4db31b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 01:37

Target

Swift copy.exe
Size

662KB
MD5

9624862352627382f26305daa2c7eb99
SHA1

a235a32a645b9c6c15952ab17283eaaf4d82d004
SHA256

5113ea26b73acede1685c8c2e12ebac42fc5d43a439023624221d8976a80df5e
SHA512

d1e21be19bae7300150f6b9d0715f1cf382922a994b99267431ae0bf0e5348a4e02df1ade95fa1a73c8d9ece577eb07f603bd2ba17c19dd254eb5eaec8b20da8
SSDEEP

12288:LDiAEfD2OzF+77bc8p1bDaHkoCjJiqkD4baQUZtsAjmSG7/nlBE7QUD:XRE7M77Q8FoCgqkcBUEAqSA/nlBDU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1640	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1172	1640	Swift copy.exe	28
PID 1640 wrote to memory of 1172	1640	Swift copy.exe	28
PID 1640 wrote to memory of 1172	1640	Swift copy.exe	28
PID 1640 wrote to memory of 1172	1640	Swift copy.exe	28

C:\Users\Admin\AppData\Local\Temp\Swift copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 648
  2⤵
  - Program crash
  PID:1172

memory/1640-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/1640-1-0x00000000000A0000-0x000000000014C000-memory.dmp

Filesize
688KB

Download
memory/1640-2-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/1640-3-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download