blackguard | 8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 01:13

Target

8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe
Size

1.3MB
MD5

82162ebb53033079dd0fc5d2dfd7ba9d
SHA1

88b8426fe8bdaeda2614c066d67f4c44d6fe78c8
SHA256

8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4
SHA512

7c8b97b54f979b45b2e1e7575acd5cb28fde3be93eb1688eb44b3ee2d0b8aa8fb44ffdcaff7c8a47828c9409a9e497c0c24fed445621a3f869061ae93ef436f3
SSDEEP

24576:a0QukIVdOGqwnyM/XCOU6YT0ijDY/j4eO:aAgTaXCn6y+ja

Score

10^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2664	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2816	2664	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	31
PID 2664 wrote to memory of 2816	2664	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	31
PID 2664 wrote to memory of 2816	2664	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	31
PID 2664 wrote to memory of 2816	2664	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	31

C:\Users\Admin\AppData\Local\Temp\8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe
"C:\Users\Admin\AppData\Local\Temp\8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 524
  2⤵
  - Program crash
  PID:2816

memory/2664-0-0x0000000074BBE000-0x0000000074BBF000-memory.dmp

Filesize
4KB

Download
memory/2664-1-0x0000000000EC0000-0x000000000101A000-memory.dmp

Filesize
1.4MB

Download
memory/2664-2-0x0000000074BBE000-0x0000000074BBF000-memory.dmp

Filesize
4KB

Download