5f090414e7879bf04a172e08266ae540ce5ce2d5332ae99df604b97b5122d4fd

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 18:46

Target

GalaxySwapper v2.0.3/Galaxy Swapper v2.0.3.exe
Size

953KB
MD5

3ec47bf3670f6260e1bb7aded9cce989
SHA1

7d90a117705a7d863a6edbb41415fcbb6f75a394
SHA256

5d7e20eb7734242f28f5edb1583bb45db3d490bbc38c05ee55ccf370e02115bc
SHA512

e8e9588ddb273c37a579f7d5d38d294f1280e779ad8fa88ed2f81ffec3345dfb1204f83b6e39dff85cb6d6de04f6fb7e4cff421704b6d43efd8ff9887a3534f5
SSDEEP

24576:aCZIdQCtwqBLRON6NUd73+MrOpR00mmZU0sLQXjt:GwqBLRONuHkOpR00FGRLQ5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2384 2060 WerFault.exe Galaxy Swapper v2.0.3.exe

pid	pid_target	process	target process
2384	2060	WerFault.exe	Galaxy Swapper v2.0.3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Galaxy Swapper v2.0.3.exe

description	pid	process	target process
PID 2060 wrote to memory of 2384	2060	Galaxy Swapper v2.0.3.exe	WerFault.exe
PID 2060 wrote to memory of 2384	2060	Galaxy Swapper v2.0.3.exe	WerFault.exe
PID 2060 wrote to memory of 2384	2060	Galaxy Swapper v2.0.3.exe	WerFault.exe
PID 2060 wrote to memory of 2384	2060	Galaxy Swapper v2.0.3.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\GalaxySwapper v2.0.3\Galaxy Swapper v2.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\GalaxySwapper v2.0.3\Galaxy Swapper v2.0.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 96
2⤵
- Program crash
PID:2384

memory/2060-0-0x0000000000100000-0x000000000015B000-memory.dmp

Filesize
364KB

Download