4a553b2e2ff7003b55a8923047d2f76cacd258317810b0107004aa7101e0fca2 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 13:02

Sharing

Report Analysis Logs

General

Target

Galaxy Swapper v2.0.3.exe
Size

532KB
MD5

c812ecf0e689b3e85a15d43943f6e077
SHA1

7b39ca11c6144c256f605441477ae49058405ef8
SHA256

4a553b2e2ff7003b55a8923047d2f76cacd258317810b0107004aa7101e0fca2
SHA512

bd2348e1d82fe0fbe2674bbff32e4cad7cf574c7adfd56a94edad9cb61aff8c38bbc72232af4aea5bbc4205a286031a73cdcd386f152dca2d75dd1ad161829ba
SSDEEP

12288:PG0AUBSdefuBqAMF0qBy5Q5SD31MrgEFa1+l1n2EO:PG0AFdeffHPy+SDwLy+lYt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	1680	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2864	1680	Galaxy Swapper v2.0.3.exe	28
PID 1680 wrote to memory of 2864	1680	Galaxy Swapper v2.0.3.exe	28
PID 1680 wrote to memory of 2864	1680	Galaxy Swapper v2.0.3.exe	28
PID 1680 wrote to memory of 2864	1680	Galaxy Swapper v2.0.3.exe	28

C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.0.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 96
  2⤵
  - Program crash
  PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download