blackguard | edc045eca80f0ca41c2e4efd0e45867dc6d502b6eae18bdffb4fba96dcab1626

Analysis

max time kernel
21s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 16:27

Target

S3M.exe
Size

50.9MB
MD5

60343d91b173d06833f4b140e350402e
SHA1

f860fd75d740a6e5fb8d60da3dc16937e59367c5
SHA256

edc045eca80f0ca41c2e4efd0e45867dc6d502b6eae18bdffb4fba96dcab1626
SHA512

6af0679af6375214fedb36a030784aa3333265910b5cb7d2b466ee54f7442050d5ce572bbd85849627777bb7c5107280a6edbba29f4aea2f8578b88f6f52279f
SSDEEP

786432:vQQQQQQQQQQQQQQQbQQQQQQQQQQQQQQQqQQQQQQQ:vhhhhhhhehhhhhhhXhhh

Score

10^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	S3M.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2744	2540	S3M.exe	29
PID 2540 wrote to memory of 2744	2540	S3M.exe	29
PID 2540 wrote to memory of 2744	2540	S3M.exe	29

C:\Users\Admin\AppData\Local\Temp\S3M.exe
"C:\Users\Admin\AppData\Local\Temp\S3M.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2540 -s 892
  2⤵
  PID:2744

memory/2540-0-0x000007FEF5DB3000-0x000007FEF5DB4000-memory.dmp

Filesize
4KB

Download
memory/2540-1-0x0000000000EE0000-0x00000000041C2000-memory.dmp

Filesize
50.9MB

Download
memory/2540-2-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp

Filesize
9.9MB

Download
memory/2540-3-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp

Filesize
9.9MB

Download
memory/2540-4-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp

Filesize
9.9MB

Download
memory/2540-5-0x000007FEF5DB3000-0x000007FEF5DB4000-memory.dmp

Filesize
4KB

Download
memory/2540-6-0x000007FEF5DB0000-0x000007FEF679C000-memory.dmp

Filesize
9.9MB

Download