blackguard | 7f6453437b84cd7518a1e628565a13f76bf09aa376eab94224fc269e3ef804a5

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 09:44

Target

tmp.exe
Size

3.5MB
MD5

296fd972f13fe3f371d16ff2430a3e81
SHA1

056a3fbe0a88a39348e8b99f0cffb3c6e63b5655
SHA256

7f6453437b84cd7518a1e628565a13f76bf09aa376eab94224fc269e3ef804a5
SHA512

35c8a54f60f440333bb282459eb4db7f62f5abfb4c16fa0655df8d5a434f66b49bbb7a49543741462f60439ee6bf8b2b9547b7241954e500687cc06bd226ccb1
SSDEEP

98304:46UJZSh7kjoRtHOrpMsgD+TPzxpCQcYOi:pwQh7kjoihFTZOi

Score

10^/10

Family

blackguard

http://94.142.138.111

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2628	2692	tmp.exe	29
PID 2692 wrote to memory of 2628	2692	tmp.exe	29
PID 2692 wrote to memory of 2628	2692	tmp.exe	29

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 604
  2⤵
  PID:2628

memory/2692-0-0x0000000000230000-0x000000000059C000-memory.dmp

Filesize
3.4MB

Download
memory/2692-1-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2692-2-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Filesize
9.9MB

Download
memory/2692-3-0x000000001B780000-0x000000001B800000-memory.dmp

Filesize
512KB

Download
memory/2692-4-0x000000001BA20000-0x000000001BD68000-memory.dmp

Filesize
3.3MB

Download
memory/2692-5-0x000000001B780000-0x000000001B800000-memory.dmp

Filesize
512KB

Download