blackguard | 02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 02:39

Target

02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe
Size

54.0MB
MD5

21c9cd8cd3d8f14b6e601f4d6aaee607
SHA1

e85b841777ddc6d7da5cf977f8cca803b393267d
SHA256

02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2
SHA512

9aed04209fd09964f9b977fe37656365e87003643bfb7e80ebe231e3c1e186ca853fd3fabf45ec4cc65ac29f95c0197dfa6ebed451793cdd36d7e58c6cfe0014
SSDEEP

393216:KY6uCeynGGeetRrjdWJjcbjpKzaBedV6zFJ4BdxEaLFjUjl6w8:+jcjmjEdVkyhdjUjc

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2252	1340	02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe	28
PID 1340 wrote to memory of 2252	1340	02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe	28
PID 1340 wrote to memory of 2252	1340	02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe	28

C:\Users\Admin\AppData\Local\Temp\02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe
"C:\Users\Admin\AppData\Local\Temp\02414126b1413ff5558b2bff6dd03f6aebcb2ebdbd9508559521d9f954a9c6b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1340 -s 516
  2⤵
  PID:2252

memory/1340-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/1340-1-0x00000000012A0000-0x0000000004830000-memory.dmp

Filesize
53.6MB

Download