blackguard | b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 01:30

Target

b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1.exe
Size

4.5MB
MD5

aec2d8c2cdb68c3fd3b8bd06fa1d8310
SHA1

6d0cdb1d723ee001b8ca2aeb203a96d4f82e5118
SHA256

b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1
SHA512

f0b5f51206ddbb67368ec79f8f1da6af56862619e5b130aabc9ef04685d668407bbd8ccc620b36d301e421afbfee83e227297358da4e3c579ba517fc0f6a773f
SSDEEP

98304:UQw8W2rsSMlXzmcwZXR3uvYgwz2HzLisCdC:ZhazmjZEi23CM

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2120	1940	b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1.exe	32
PID 1940 wrote to memory of 2120	1940	b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1.exe	32
PID 1940 wrote to memory of 2120	1940	b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1.exe	32

C:\Users\Admin\AppData\Local\Temp\b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1.exe
"C:\Users\Admin\AppData\Local\Temp\b5a72562707f2f4f2f07c554f1870edd48b8dfd2c0666ec8d2a88cbea50235e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1940 -s 1088
  2⤵
  PID:2120

C:\ProgramData\ETUVA\EASET.xml

Filesize
1KB

MD5
63804d4b5f68f502555e9d5e7287bf08

SHA1
58dae40f00b7f951e05cb10858e06aef86438dae

SHA256
bcdc4437531e81b272643614d726ba37fb58fb752d0385d8aab94a77e4681108

SHA512
5656a088195e3b3741c1061c1f46394379debcb66b84598459f9db32b72568c172c324d4e6671d37ad12aca98d2e426c377a9eedcf880b8717cd91a39d3a7b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\50E5C95F83CFA2A62760985E8C452772\simplewpf.dll

Filesize
21KB

MD5
6949b56eefede827d7a82acef8ea303e

SHA1
dccec3108c724a477154099cb970d1a6cbc6f0f5

SHA256
108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f

SHA512
43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e

Download Submit
memory/1940-0-0x000007FEF5D53000-0x000007FEF5D54000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x0000000001030000-0x00000000014C0000-memory.dmp

Filesize
4.6MB

Download
memory/1940-7-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download
memory/1940-9-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/1940-18-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

Filesize
9.9MB

Download