blackguard | 115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 01:12

Target

115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d.exe
Size

2.3MB
MD5

12381e187f78be2110adaf171f8afef5
SHA1

14e05a79705b58262418a825a5c0588e9823b946
SHA256

115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d
SHA512

a63baafc02516807f7a7b8aec92c36ee7f04d60b3a1ce23896c08986b72eec2da9a078706fd7ec3a00b5f08fb0f986f39ceaee9a60c7544815578b83cca30f74
SSDEEP

49152:p5GJy5YYULFaatZKT3POnougfL8JMHT9ktH8PveUcKsjX3X3XYAGZU+:p8Jy5YXLoatZKT3/ugfASzK8XeUcKk

Score

10^/10

Family

blackguard

http://91.194.11.85/

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2700	2300	115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d.exe	29
PID 2300 wrote to memory of 2700	2300	115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d.exe	29
PID 2300 wrote to memory of 2700	2300	115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d.exe	29

C:\Users\Admin\AppData\Local\Temp\115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d.exe
"C:\Users\Admin\AppData\Local\Temp\115e548adcb17b7079eabf7988346fc57dafc98ed5a371be63ba72dd3184510d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2300 -s 1072
  2⤵
  PID:2700

memory/2300-0-0x0000000000E70000-0x00000000010BE000-memory.dmp

Filesize
2.3MB

Download
memory/2300-1-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2300-2-0x000000001AF40000-0x000000001AFC0000-memory.dmp

Filesize
512KB

Download
memory/2300-3-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2300-4-0x000000001AF40000-0x000000001AFC0000-memory.dmp

Filesize
512KB

Download