blackguard | 8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 01:55

Target

8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261.exe
Size

4.5MB
MD5

2880b52b92a1bc960cffb2e90377ff4b
SHA1

6811988179db0f2ca320029e34dc5c53068e5bb5
SHA256

8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261
SHA512

b10caa8dc1481e60f13b2b584234c82c799d04e51e4a4c69d5bfb8678646a2f9740a18373873bb148482208b6b82684528874a2ca09f0e1795ad93813b03a3ed
SSDEEP

98304:UQw8W2rsSMlXzmcwZXR3uvYgwz2HzLisxd:ZhazmjZEi23x

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2912	2956	8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261.exe	31
PID 2956 wrote to memory of 2912	2956	8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261.exe	31
PID 2956 wrote to memory of 2912	2956	8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261.exe	31

C:\Users\Admin\AppData\Local\Temp\8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261.exe
"C:\Users\Admin\AppData\Local\Temp\8fa97d878c2b1238dedec4583ccc0ecec3fbbf74549e73143c09442464c3a261.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 1100
  2⤵
  PID:2912

C:\ProgramData\ETUVA\EASET.xml

Filesize
1KB

MD5
63804d4b5f68f502555e9d5e7287bf08

SHA1
58dae40f00b7f951e05cb10858e06aef86438dae

SHA256
bcdc4437531e81b272643614d726ba37fb58fb752d0385d8aab94a77e4681108

SHA512
5656a088195e3b3741c1061c1f46394379debcb66b84598459f9db32b72568c172c324d4e6671d37ad12aca98d2e426c377a9eedcf880b8717cd91a39d3a7b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\50E5C95F83CFA2A62760985E8C452772\simplewpf.dll

Filesize
21KB

MD5
6949b56eefede827d7a82acef8ea303e

SHA1
dccec3108c724a477154099cb970d1a6cbc6f0f5

SHA256
108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f

SHA512
43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e

Download Submit
memory/2956-0-0x000007FEF5CD3000-0x000007FEF5CD4000-memory.dmp

Filesize
4KB

Download
memory/2956-1-0x0000000000090000-0x0000000000520000-memory.dmp

Filesize
4.6MB

Download
memory/2956-7-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2956-9-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/2956-18-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download