blackguard | 2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-02-2025 01:03

Target

2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f.exe
Size

4.5MB
MD5

bb7bb897403203b1b72b73c3219d63e9
SHA1

84e58fa1424584be5ade5a7921c42d6babe778c1
SHA256

2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f
SHA512

8d23dc0748a6417ffe3a81002e831cbb2b6d446442108bc3d3d4367b1a2b2826e7419a71786b13e5a73a8e67204c39a6d018e444ef8f080601303f3b8bfe1d24
SSDEEP

98304:OQw8W2rsSMlXzmcwZXR3uvYgwz2HzLisldf:nhazmjZEi23lZ

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3016	2116	2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f.exe	31
PID 2116 wrote to memory of 3016	2116	2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f.exe	31
PID 2116 wrote to memory of 3016	2116	2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f.exe	31

C:\Users\Admin\AppData\Local\Temp\2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f.exe
"C:\Users\Admin\AppData\Local\Temp\2cf63cf0f0a2c085fc2a5f6066587f9ff2dca24b0c65e67760e19bcf2de6eb1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2116 -s 1084
  2⤵
  PID:3016

C:\ProgramData\ETUVA\EASET.xml

Filesize
1KB

MD5
63804d4b5f68f502555e9d5e7287bf08

SHA1
58dae40f00b7f951e05cb10858e06aef86438dae

SHA256
bcdc4437531e81b272643614d726ba37fb58fb752d0385d8aab94a77e4681108

SHA512
5656a088195e3b3741c1061c1f46394379debcb66b84598459f9db32b72568c172c324d4e6671d37ad12aca98d2e426c377a9eedcf880b8717cd91a39d3a7b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\50E5C95F83CFA2A62760985E8C452772\simplewpf.dll

Filesize
21KB

MD5
6949b56eefede827d7a82acef8ea303e

SHA1
dccec3108c724a477154099cb970d1a6cbc6f0f5

SHA256
108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f

SHA512
43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e

Download Submit
memory/2116-0-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x00000000012E0000-0x000000000176E000-memory.dmp

Filesize
4.6MB

Download
memory/2116-7-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-9-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2116-18-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download