blackguard | 02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 01:13

Target

02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe
Size

54.0MB
MD5

21c9cd8cd3d8f14b6e601f4d6aaee607
SHA1

e85b841777ddc6d7da5cf977f8cca803b393267d
SHA256

02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2
SHA512

9aed04209fd09964f9b977fe37656365e87003643bfb7e80ebe231e3c1e186ca853fd3fabf45ec4cc65ac29f95c0197dfa6ebed451793cdd36d7e58c6cfe0014
SSDEEP

393216:KY6uCeynGGeetRrjdWJjcbjpKzaBedV6zFJ4BdxEaLFjUjl6w8:+jcjmjEdVkyhdjUjc

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe

description	pid	process	target process
PID 1664 wrote to memory of 2632	1664	02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe	WerFault.exe
PID 1664 wrote to memory of 2632	1664	02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe	WerFault.exe
PID 1664 wrote to memory of 2632	1664	02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe
"C:\Users\Admin\AppData\Local\Temp\02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1664 -s 520
  2⤵
  PID:2632

memory/1664-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/1664-1-0x0000000000900000-0x0000000003E90000-memory.dmp

Filesize
53.6MB

Download
memory/1664-2-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download