blackguard | 0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 01:31

Target

0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5.exe
Size

1.4MB
MD5

34e4e8fe8530bfe92a7803052141fd80
SHA1

2e3b4893999fe88beb4d5d9a1796eaa728eeb86f
SHA256

0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5
SHA512

b870131b272d8ed53ef2620da4cfa5e0ec07b4608e49e51327d7b0c5638384c6d737cf802a4fe531e63e83bc9d3345f70a41d822ad3f41151bc4cd5490f1a123
SSDEEP

12288:kRRw/6E8BAjShgA0tJgPMyP1POcpZ7EEBoK5QkHHpm3GNMphciYYJh:kkOejShgA0tePMuOcZXH3yJh

Score

10^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	2348	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 904	2348	0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5.exe	28
PID 2348 wrote to memory of 904	2348	0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5.exe	28
PID 2348 wrote to memory of 904	2348	0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5.exe	28
PID 2348 wrote to memory of 904	2348	0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5.exe	28

C:\Users\Admin\AppData\Local\Temp\0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5.exe
"C:\Users\Admin\AppData\Local\Temp\0630f24a56c1210efc4271eb5d8250c884c4125f07ce263c768509bbeff005d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 532
  2⤵
  - Program crash
  PID:904

memory/2348-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2348-0-0x0000000001170000-0x00000000012E6000-memory.dmp

Filesize
1.5MB

Download
memory/2348-2-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download