WWCService.sys

Malicious 方正科技集团股份有限公司 2021-10-05 12:01 VT 19/73

Driver Name: WWCService.sys
MD5: 33010c99b1d0e1e6468f57f6386991dd
SHA1: 513d881b099ab8fc1c7313731aa85c2b9c16e5f5
SHA256: f17c98810758ed387591d909cd011b95fa5dd155952f2fc94932d49a5eaee58c
Imphash: f44af6fb2c7020cce2f6d28fc244cc03
Vhash: 094076651d151666551iz64xz
Authentihash: 3e32f830b1cd6574d18de3fd5637e0ccaab8d2a0cd09d151f73b85e69f05916f
Rich PE header hash: 5d5c2d68d7f7133f2030a43055cef0b0
SSDEEP: 768:mbvhMA97SofRkzbaX3SgjdABc8VA8x4GOKs99wVRBN8R9ML2fscSAxnKZJTwTHkn:4bIAJd+qTrKW9wxspSxf/zn0
TLSH: T150937C52A7585AD4D9659932B2E54637EFF0B5022722C3FF0A44C5180FA6FF16CBC38A
Signer: 方正科技集团股份有限公司
Signing date: 2021-10-05 12:01
SpcSpOpusInfo: N/A
VT detections: 19/73
Compilation time: 2021-10-05
PDB path: E:\src\cpp\github.com\Blackbone\src\BlackBoneDrv\bin\x64\Win7Release\BlackBoneDrv7.pdb
Country submitter: United States
Flag: Malicious

Description

BlackBone is a Windows memory-hacking library with an optional kernel driver that provides stealthy DLL injection, manual PE/driver mapping, remote code execution and hooking, and kernel-level memory read/write, process-protection tampering, and memory hiding (https://github.com/darthton/blackbone)