92f65d88cc989ced6937282d1699ebc6edd6eb4d3b5c15f8b1ec9df4acca03cb

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 20:08

Target

swift copy USD65000.exe
Size

1.2MB
MD5

d67619795ee32a6b35742c92786cbe0d
SHA1

1b2f340c71f4d1b0ad14984588672b9afb3dfc9c
SHA256

92f65d88cc989ced6937282d1699ebc6edd6eb4d3b5c15f8b1ec9df4acca03cb
SHA512

2c7a1dafb9367769ff39c76093bcdadb1cff2b506481ea5d41d52503209cd514ecca583a1daa73a6756f3556b719328c6b4057cc05ceb31b3a724231068d3828
SSDEEP

24576:iAHnh+eWsN3skA4RV1Hom2KXMmHaSx/YvOVfbb+j7btw5:lh+ZkldoPK8YaSx/YMb8A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	1544	WerFault.exe	81

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1544	swift copy USD65000.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1544	swift copy USD65000.exe
1544	swift copy USD65000.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1544	swift copy USD65000.exe
1544	swift copy USD65000.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2908	1544	swift copy USD65000.exe	85
PID 1544 wrote to memory of 2908	1544	swift copy USD65000.exe	85
PID 1544 wrote to memory of 2908	1544	swift copy USD65000.exe	85

C:\Users\Admin\AppData\Local\Temp\swift copy USD65000.exe
"C:\Users\Admin\AppData\Local\Temp\swift copy USD65000.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\swift copy USD65000.exe"
  2⤵
  PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 724
  2⤵
  - Program crash
  PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1544 -ip 1544
1⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\aut491F.tmp

Filesize
265KB

MD5
6ab4d799d9fcee60bcab78f1a07aedb9

SHA1
fa4844eb95127c4ffe4aa3604fd422f4c9a4965b

SHA256
f906c24eb74ca0e3605825fdb2dbda67a3fe4fe78f3d9394468de76a54882e32

SHA512
38adf3a554033441be302140b877c4cf81e901186a58cc46fd0e7bd32bcbfbf583cc1a0c8e1917b3a4f711423dbcd3e41a8ad3d4f579b1cc6cf28adcddf82634

Download Submit
memory/1544-12-0x0000000001ED0000-0x0000000001ED4000-memory.dmp

Filesize
16KB

Download