blackguard | 4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 01:27

Target

4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9.exe
Size

14.2MB
MD5

f7cab7cb83b2bed7c3d9d864ad2da747
SHA1

906a3252a963927b601a52c4722d6a662ef7b37c
SHA256

4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9
SHA512

831ea772742c4e701d4a7ccd8841d1411acfc2b03fa51113f8951fa9a930e3df41410fc2c77d7f445230fae33c15d91afa2ad25c6001f211f47a4b7c79a6088f
SSDEEP

393216:Q5TkSHry0WyNUHKoc8tQsvcsM+o4YkSdOTByWR:Q5T9ryx9Hpc8astK9OIU

Score

10^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2760	2992	4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9.exe	28
PID 2992 wrote to memory of 2760	2992	4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9.exe	28
PID 2992 wrote to memory of 2760	2992	4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9.exe	28
PID 2992 wrote to memory of 2760	2992	4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9.exe	28

C:\Users\Admin\AppData\Local\Temp\4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9.exe
"C:\Users\Admin\AppData\Local\Temp\4adcdb6d6303480efb94e225bf05368d963b3f5321b2beacf1c77b3e3204add9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 752
  2⤵
  - Program crash
  PID:2760

memory/2992-0-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-1-0x0000000000220000-0x0000000001060000-memory.dmp

Filesize
14.2MB

Download
memory/2992-2-0x0000000005860000-0x00000000058A0000-memory.dmp

Filesize
256KB

Download
memory/2992-3-0x0000000008780000-0x0000000008A5A000-memory.dmp

Filesize
2.9MB

Download
memory/2992-4-0x0000000074A60000-0x000000007514E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-5-0x0000000005860000-0x00000000058A0000-memory.dmp

Filesize
256KB

Download