blackguard | 886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 01:36

Target

886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08.exe
Size

14.7MB
MD5

3b7d7c535849df330cd94243f2b688f9
SHA1

f2d3a8384713679dce56971d0c0d9a51ce7f18c9
SHA256

886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08
SHA512

03cad023c06fcc7efbc94202149881ddfdedc95c6f639a842d4c044beccff088079d275d33dee2cecfc18f275879466a6f0e4541ffe988fef178846dd308a700
SSDEEP

393216:2JT0SHUCy0WyNUHKoc8tQsvcsM+o4YkSdOTByWR:2JTNRyx9Hpc8astK9OIU

Score

10^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	2076	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2592	2076	886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08.exe	28
PID 2076 wrote to memory of 2592	2076	886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08.exe	28
PID 2076 wrote to memory of 2592	2076	886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08.exe	28
PID 2076 wrote to memory of 2592	2076	886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08.exe	28

C:\Users\Admin\AppData\Local\Temp\886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08.exe
"C:\Users\Admin\AppData\Local\Temp\886cbeba2ec2a0c0bc0baf9562dd7c0d0c98ee25c1aa0a393d60e99e79ea7c08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 748
  2⤵
  - Program crash
  PID:2592

memory/2076-1-0x0000000000A00000-0x00000000018BA000-memory.dmp

Filesize
14.7MB

Download
memory/2076-0-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/2076-2-0x0000000005780000-0x00000000057C0000-memory.dmp

Filesize
256KB

Download
memory/2076-3-0x00000000088B0000-0x0000000008B8A000-memory.dmp

Filesize
2.9MB

Download
memory/2076-4-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/2076-5-0x0000000005780000-0x00000000057C0000-memory.dmp

Filesize
256KB

Download