3d07b09f83f2fc5dcb7f2429cac9a37160181da77df5a429e37b98dd685f239f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 16:44

Target

swizzzz.exe
Size

352KB
MD5

a74811b7e2d71612463144c69c0ca7e2
SHA1

900132a2213f70aed06e9982e47cfdcc8964b710
SHA256

3d07b09f83f2fc5dcb7f2429cac9a37160181da77df5a429e37b98dd685f239f
SHA512

c4c5bef04693f000ae1f45d2a2d28f67609f36a635464d5025a50b939eaf9cc8d7766355990847f5679375f3d4b760e035dd92914f754ae64df6923da1cecebe
SSDEEP

6144:IsCv/QNuZNjDPp9XC2Fgd6dwiJLR8ATGb5gBJYgEltzK5d5Sw+tuhdZUui/EO:I/+uZNjDPNGeR85+YgEf25CtuhLi/EO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	1704	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2524	1704	swizzzz.exe	30
PID 1704 wrote to memory of 2524	1704	swizzzz.exe	30
PID 1704 wrote to memory of 2524	1704	swizzzz.exe	30
PID 1704 wrote to memory of 2524	1704	swizzzz.exe	30

C:\Users\Admin\AppData\Local\Temp\swizzzz.exe
"C:\Users\Admin\AppData\Local\Temp\swizzzz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 52
  2⤵
  - Program crash
  PID:2524

memory/1704-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1704-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download