blackguard | 67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 01:30

Target

67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605.exe
Size

7.8MB
MD5

3585cc07d218db18e522eda47655b3eb
SHA1

558d54938303ed0833c3cbb1a234a47ac8cc3830
SHA256

67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605
SHA512

7afea314f4fa2cca8a92e83583970c475b1459b23cd09eac092442eff287a3ad12c578373978a695450f1712beb575cdc885135c32814856f74197ae6b6800f6
SSDEEP

98304:3oUGsGmJBQ7Lnx43sDQFnwJI3nDCc5YBcET4:3XGwJBQ3nIwwOcWBcET

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3044	2104	67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605.exe	30
PID 2104 wrote to memory of 3044	2104	67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605.exe	30
PID 2104 wrote to memory of 3044	2104	67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605.exe	30

C:\Users\Admin\AppData\Local\Temp\67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605.exe
"C:\Users\Admin\AppData\Local\Temp\67c380933e051c75d006bca663635fa71227a3126526acf41b8f71f38fc88605.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2104 -s 500
  2⤵
  PID:3044

memory/2104-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2104-1-0x0000000000080000-0x000000000085C000-memory.dmp

Filesize
7.9MB

Download
memory/2104-2-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download