3e3ace661c7cf6edcb45af3e5d75eb2d27cc73182c2da71316cba6b0b444e1ee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 03:21

Target

SwiftErrorHandler.exe
Size

9.4MB
MD5

fc6c61dc16f8e3331492144dcc1b3c6f
SHA1

47e89b74870392a62ea401da9e96848547124564
SHA256

3e3ace661c7cf6edcb45af3e5d75eb2d27cc73182c2da71316cba6b0b444e1ee
SHA512

e7eeeaad40259ecc07d6e693aef661bc6b47495e0124f76dc42b2953d2c36cc1f9deffb70d97d5b740702541f576076c4a38ffea9a22df0837754d82b4747c68
SSDEEP

196608:CMRh3xymvNm1E8giq1g98eNMHFJMIDJ+gsAGKkRJH3lI:mm1m1Nqq4Fqy+gs1xV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2832	SwiftErrorHandler.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c8f-41.dat	upx
behavioral1/memory/2832-43-0x000007FEF6500000-0x000007FEF696E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2832	2444	SwiftErrorHandler.exe	30
PID 2444 wrote to memory of 2832	2444	SwiftErrorHandler.exe	30
PID 2444 wrote to memory of 2832	2444	SwiftErrorHandler.exe	30

C:\Users\Admin\AppData\Local\Temp\SwiftErrorHandler.exe
"C:\Users\Admin\AppData\Local\Temp\SwiftErrorHandler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\SwiftErrorHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\SwiftErrorHandler.exe"
  2⤵
  - Loads dropped DLL
  PID:2832

C:\Users\Admin\AppData\Local\Temp\_MEI24442\python310.dll

Filesize
1.4MB

MD5
fc7bd515b12e537a39dc93a09b3eaad6

SHA1
96f5d4b0967372553cb106539c5566bc184f6167

SHA256
461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

SHA512
a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

Download Submit
memory/2832-43-0x000007FEF6500000-0x000007FEF696E000-memory.dmp

Filesize
4.4MB

Download