← Back to Sessions

BOOTCAMP-RM3-07 / candidate_40071

Session GUID: d04d7e6b759a527584cf920c86734df4

First Seen: 2026-10-18 11:36:13 Last Active: 2026-10-18 12:36:07 Reports: 205

watguard Report #1 2026-10-18 12:36:07 CONFIG VERIFIED (6f2a9c1d4b7e…)

tick 51840 ms

Anti-Debugging Flags

CLEAR IsDebuggerPresent
CLEAR CheckRemoteDebuggerPresent
CLEAR NtQueryInformationProcess (DebugPort)
CLEAR Hardware Breakpoints (Dr0-Dr3)
CLEAR PEB.BeingDebugged
CLEAR Parent Process Lineage

Memory Integrity Inspection

812 page hash(es) reported (watguard baseline)

1 PAGE MISMATCH(ES) DETECTED

DLL Injection Events (1)

Target Path

Caller Address

Authenticode Cert

Thread

Uploaded Binary Analysis

C:\Users\Public\AppData\Local\Temp\overlay_hook.dll

0x00007FFA1B2C4410

unsigned

4521

a13f9c2e4b7d… (24576 bytes) 3 suspicious import(s)

Shellcode & Memory Hook Events (2)

Kind

Base Address

Size

Protect Flags

Mapped File

Trust

Thread

Hex Preview

RWX Region Allocated

0x1f0a20000

4096 B

0x40

unbacked memory

UNTRUSTED

4521

48 65 90 90 90 90 e8 12 …

Inline Hook Detected

0x7ffa1c0056a0

32 B

0x20

C:\Windows\System32\ntdll.dll

UNTRUSTED

4521

e9 5b 43 21 00 90 90 90 …

▼

Running Processes (5 total, 1 flagged )

Path Max Width: 350px

Status

Process Name

Binary Path

Parent Name

Parent Path

Uptime

CLEAN

watguard.exe

C:\Program Files\WriteATest\watguard.exe

wat_bootstrapper.exe

C:\Program Files\WriteATest\wat_bootstrapper.exe

2143.8s

CLEAN

browser.exe

C:\Program Files\WriteATest\browser.exe

watguard.exe

C:\Program Files\WriteATest\watguard.exe

2098.1s

CLEAN

dwm.exe

C:\Windows\System32\dwm.exe

wininit.exe

C:\Windows\System32\wininit.exe

5920.4s

CLEAN

csrss.exe

C:\Windows\System32\csrss.exe

smss.exe

C:\Windows\System32\smss.exe

6011.2s

FLAGGED

overlay_hook_loader.exe

C:\Users\Public\AppData\Local\Temp\overlay_hook_loader.exe

explorer.exe

C:\Windows\explorer.exe

812.4s

External Process Handles (1 total, 1 dangerous )

Evaluated Server-Side (NtQuerySystemInformation)

Verdict

Owner Process

Binary Path

Granted Access Rights

Server Evaluation / Reason

FLAGGED

processhacker.exe (PID 5566)

C:\ProgramData\ProcessHacker\ProcessHacker.exe

PROCESS_VM_READ PROCESS_VM_WRITE PROCESS_SUSPEND_RESUME

Known analysis-tool signature, Full VM read/write access to watguard.exe

Page Tamper & Copy-On-Write Events (1)

Tamper Type

Page Index

Virtual Address

Copy-on-Write Divergence

#128

0x7ff6a2c41000

View Wire Frame Hex Dump & ASCII

0000  57 41 54 31 00 00 01 4a 00 00 00 03 08 96 be 8f  WAT1...J........
0010  9c 5e 12 04 22 30 2e 08 90 a1 e4 06 32 24 43 45  ..".0.......2$CE
0020  52 54 50 52 45 50 2d 57 4b 53 2d 31 31 32 3a 0c  RTPREP-WKS-112:.
0030  6a 2e 61 6c 76 61 72 65 7a 40 01 00 4a 0e 08 01  [email protected]...
0040  10 96 c1 fa 8f 06 18 8c 04 20 00 52 03 08 e8 07  ......... .R....
0050  10 00

Decoded Wire Field Inspector

session_id d04d7e6b759a527584cf920c86734df4

tick_ms 51840

▸ antidebug 2

debugger_present false

mask_consistent true

▸ memory_pages 2

page[0112] e2f19c...matches baseline

page[0128] 9ac314...diverges

▸ shellcode_events 3

event[0].kind RWX_REGION_ALLOCATED

event[0].base_address 0x00000001F0A20000

event[1].kind INLINE_HOOK_DETECTED

Click a field on the left tree to view properties.