32da20060ad7e2a649d22526ab5c5ed40ccdf7048a46184c0d6bf487ac4cc313

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift copy.exe
Size 598KB
Sample240723-lnrx2ayhjd
SHA256 a073edb1dacc3f6cbb7b416c6196f7d56a8d6d195a337952524e1e8ee5921461
MD5 aa175e1bf43f1c940ffd2e23f853a070
SHA1 bf01a6051d30abac10ba726e7ef40a68c17799f6
SHA512 65e1295e92dc6bd4bbf68c8769312cc024e84b1264e84b44d31cdec28f484dc9ac8026b42b83ff22848724e65ee57b0c9d777bce3896b84c497a668921e2487f
SSDEEP 12288:mYV6MorX7qzuC3QHO9FQVHPF51jgc/Ppf5/6KLrA5v5Jg:lBXu9HGaVH5hC6k5Bq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1364-0-0x00000000003C0000-0x0000000000517000-memory.dmp	upx
behavioral2/memory/1364-12-0x00000000003C0000-0x0000000000517000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1364-12-0x00000000003C0000-0x0000000000517000-memory.dmp	autoit_exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1364	WerFault.exe	83

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1364	Swift copy.exe
1364	Swift copy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3976	1364	Swift copy.exe	87
PID 1364 wrote to memory of 3976	1364	Swift copy.exe	87
PID 1364 wrote to memory of 3976	1364	Swift copy.exe	87

C:\Users\Admin\AppData\Local\Temp\Swift copy.exe
"C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"
  2⤵
  PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 632
  2⤵
  - Program crash
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1364 -ip 1364
1⤵
PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-0-0x00000000003C0000-0x0000000000517000-memory.dmp

Download

memory/1364-11-0x00000000005F0000-0x00000000005F4000-memory.dmp

Download

memory/1364-12-0x00000000003C0000-0x0000000000517000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads