blackguard | c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 01:16

Target

c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc.exe
Size

4.5MB
MD5

d437ad50875e85144fd996766128fb46
SHA1

43f0be0840e292711dde4dc632c1df56b67d2e2a
SHA256

c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc
SHA512

58e382d42d076e89a4e5932356cdeb6801cdf7d0e19a6c1556b9eb20ee256f389ce3df531c8de5513342fe208e5fd48866fb7840bec6275d839d83e9eee35f58
SSDEEP

98304:iQw8W2rsSMlXzmcwZXR3uvYgwz2HzLis/dh:rhazmjZEi23/P

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2888	768	c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc.exe	31
PID 768 wrote to memory of 2888	768	c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc.exe	31
PID 768 wrote to memory of 2888	768	c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc.exe	31

C:\Users\Admin\AppData\Local\Temp\c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc.exe
"C:\Users\Admin\AppData\Local\Temp\c27ecdc151265f38144458569f020665a362e2f35550a949905718a7cf8c32bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 768 -s 1096
  2⤵
  PID:2888

C:\ProgramData\ETUVA\EASET.xml

Filesize
1KB

MD5
63804d4b5f68f502555e9d5e7287bf08

SHA1
58dae40f00b7f951e05cb10858e06aef86438dae

SHA256
bcdc4437531e81b272643614d726ba37fb58fb752d0385d8aab94a77e4681108

SHA512
5656a088195e3b3741c1061c1f46394379debcb66b84598459f9db32b72568c172c324d4e6671d37ad12aca98d2e426c377a9eedcf880b8717cd91a39d3a7b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\50E5C95F83CFA2A62760985E8C452772\simplewpf.dll

Filesize
21KB

MD5
6949b56eefede827d7a82acef8ea303e

SHA1
dccec3108c724a477154099cb970d1a6cbc6f0f5

SHA256
108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f

SHA512
43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e

Download Submit
memory/768-0-0x000007FEF5DA3000-0x000007FEF5DA4000-memory.dmp

Filesize
4KB

Download
memory/768-1-0x0000000000850000-0x0000000000CDE000-memory.dmp

Filesize
4.6MB

Download
memory/768-7-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/768-9-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/768-18-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download