blackguard | be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 01:07

Target

be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3.exe
Size

1.5MB
MD5

fc66670c438d6e3da68b6d133660195e
SHA1

f0facf1e3e4666c7d3e6367e7f726f4dd3ad1cf3
SHA256

be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3
SHA512

955ed5f8afa85ef78cf5a51ad204e900903e1dfa159ff7bdff6b0f3cb708f840369f3b6e2098090d5600964b70944b09b85a607ce2819792290ec5896ad9d778
SSDEEP

24576:rSJC7sobydM6xX5d14L70oxEeVrIcJd/U82k+zkg5Y5812k+Iek+I0sDs0Wk21kn:lbSPHxZN/HEk

Score

10^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2872	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1960	2872	be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3.exe	28
PID 2872 wrote to memory of 1960	2872	be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3.exe	28
PID 2872 wrote to memory of 1960	2872	be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3.exe	28
PID 2872 wrote to memory of 1960	2872	be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3.exe	28

C:\Users\Admin\AppData\Local\Temp\be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3.exe
"C:\Users\Admin\AppData\Local\Temp\be6da316f8f786d73dc2e901d53b3591d6f2349997453c69b560e5823822c1c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 528
  2⤵
  - Program crash
  PID:1960

memory/2872-0-0x0000000001380000-0x0000000001508000-memory.dmp

Filesize
1.5MB

Download
memory/2872-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download
memory/2872-2-0x0000000074AD0000-0x00000000751BE000-memory.dmp

Filesize
6.9MB

Download