blackguard | 594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f

Analysis

Target

594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe
Size

522KB
MD5

1fd7eb65dad25aea119bd87f8d2318e6
SHA1

22678f48b00df28676210a6c6df88329e5378673
SHA256

594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f
SHA512

015a422d05682750e05047231e4049002265733cebf8120624ba16f591541dd07b6d6d5e192c357ab807d990389c31dbb5eee619cd4c73b3850cc2fbb86ab791

Score

10^/10

Family

blackguard

https://api.telegram.org/bot1181007727:AAFOGOUZ_8YdXsZX1oMgQcNk6d5Kf87AP60/sendMessage?chat_id=553060588

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	1336	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1336	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe
1336	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 560	1336	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe	28
PID 1336 wrote to memory of 560	1336	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe	28
PID 1336 wrote to memory of 560	1336	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe	28

C:\Users\Admin\AppData\Local\Temp\594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe
"C:\Users\Admin\AppData\Local\Temp\594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1336 -s 536
  2⤵
  - Program crash
  PID:560

memory/1336-54-0x0000000000DD0000-0x0000000000E58000-memory.dmp

Filesize
544KB

Download