blackguard | 55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 01:06

Target

55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755.exe
Size

8.4MB
MD5

7c3d9553395be44129bc81b1845b6582
SHA1

a08b7781f8c84489a873eb855ea34e0d2d936fd2
SHA256

55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755
SHA512

2620b4eeff89b8ed25609240835a65858423d2a22dc45b61c1fc7f3344ad0f4ca9e2939037f9d63198abbf5dbe89a1a7aadfd17980b73915caa20a31a3dd79bc
SSDEEP

98304:9gIIUkw5UtBQ7Lnx43sDQFnwJI3nDCc5Yh/wbD2wF:TkVtBQ3nIwwOcWh/eDZ

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2288	2516	55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755.exe	30
PID 2516 wrote to memory of 2288	2516	55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755.exe	30
PID 2516 wrote to memory of 2288	2516	55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755.exe	30

C:\Users\Admin\AppData\Local\Temp\55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755.exe
"C:\Users\Admin\AppData\Local\Temp\55073a86f7cdae39bcaf9a70974f25e8eb95a9b6217d6c2fbc406c642af2c755.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2516 -s 500
  2⤵
  PID:2288

memory/2516-0-0x000007FEF5C13000-0x000007FEF5C14000-memory.dmp

Filesize
4KB

Download
memory/2516-1-0x00000000001A0000-0x00000000009FE000-memory.dmp

Filesize
8.4MB

Download