blackguard | 18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/02/2025, 01:04 UTC

Target

18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1.exe
Size

8.6MB
MD5

6ff8f8dc34f44ccf48d6f0f40ef5d262
SHA1

6a3c7442b26239522305c6113f8bedfdc50e85f8
SHA256

18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1
SHA512

c0581504f7f949df8de33eccbb6282765c793d78e1a5d6af08ef04d0a80a0d4bb9c8f7ff787d65553e6f7c18300fffbeedabfc58cc45569993a1667e11fda064
SSDEEP

98304:ZJKtnBQ7Lnx43sDQFnwJI3nDCc5Y3eEmBXIEvR/GT:ZJKtnBQ3nIwwOcWuBBXv/G

Score

10^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2152	2236	18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1.exe	30
PID 2236 wrote to memory of 2152	2236	18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1.exe	30
PID 2236 wrote to memory of 2152	2236	18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1.exe	30

C:\Users\Admin\AppData\Local\Temp\18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1.exe
"C:\Users\Admin\AppData\Local\Temp\18bf5da9f469b001ac2555b3909e0a4e5fce9480d1d5be1b146bc83d04e859b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2236 -s 500
  2⤵
  PID:2152

memory/2236-0-0x000007FEF5AA3000-0x000007FEF5AA4000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x0000000001280000-0x0000000001B1A000-memory.dmp

Filesize
8.6MB

Download