491951b8a84f49dd5a5c0bdea5370223a8ac834d47d53a526f628733325dd5c9

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 13:39

Target

swift copy.exe
Size

1.1MB
MD5

e9c6a41856090c8eb226b8342166c58a
SHA1

217fdcfe9df26442e307ba60ebef9255633f13b8
SHA256

491951b8a84f49dd5a5c0bdea5370223a8ac834d47d53a526f628733325dd5c9
SHA512

d2a99a05836dd861badc291952db513bcdfb0b5b7f18e733c9fff01ed85559391d1f1dac3ef1ea21ba870fc827ad95db25be98f58132fa59bbc3fdaf2e765ebe
SSDEEP

24576:8AHnh+eWsN3skA4RV1Hom2KXMmHa46VQzGOd23X5:bh+ZkldoPK8Ya46qzLdE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4296 4612 WerFault.exe swift copy.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

swift copy.exe

pid process

4612 swift copy.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

swift copy.exe

pid process

4612 swift copy.exe
4612 swift copy.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

swift copy.exe

pid process

4612 swift copy.exe
4612 swift copy.exe

pid	pid_target	process	target process
4296	4612	WerFault.exe	swift copy.exe

pid	process
4612	swift copy.exe

pid	process
4612	swift copy.exe
4612	swift copy.exe

pid	process
4612	swift copy.exe
4612	swift copy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

swift copy.exe

description	pid	process	target process
PID 4612 wrote to memory of 888	4612	swift copy.exe	svchost.exe
PID 4612 wrote to memory of 888	4612	swift copy.exe	svchost.exe
PID 4612 wrote to memory of 888	4612	swift copy.exe	svchost.exe
PID 4612 wrote to memory of 888	4612	swift copy.exe	svchost.exe

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"
2⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 692
2⤵
- Program crash
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4612 -ip 4612
1⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
1⤵
PID:4880

memory/4612-10-0x0000000001550000-0x0000000001554000-memory.dmp

Filesize
16KB

Download