blackguard | bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 01:24

Target

bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe
Size

14.7MB
MD5

a6b023ac7848e95890db1e569f875a28
SHA1

463ebb559563032083c0fdf887527947b2ff6c08
SHA256

bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8
SHA512

bec7d38222abf2e7f22c7b870c9c7755323f7b51805610e5a394428277a2eaea260b23327895c23e80836540ba49e235acda4a704b0be8936bc7e389d2d86049
SSDEEP

393216:sJT0SHUCy0WyNUHKoc8tQsvcsM+o4YkSbOTByWR:sJTNRyx9Hpc8astK7OIU

Score

10^/10

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2944 2036 WerFault.exe bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe

pid	pid_target	process	target process
2944	2036	WerFault.exe	bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe

description	pid	process	target process
PID 2036 wrote to memory of 2944	2036	bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe	WerFault.exe
PID 2036 wrote to memory of 2944	2036	bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe	WerFault.exe
PID 2036 wrote to memory of 2944	2036	bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe	WerFault.exe
PID 2036 wrote to memory of 2944	2036	bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe
"C:\Users\Admin\AppData\Local\Temp\bceb8608cabb6b1504b98363d8c02de42b460d8d764b7f1cc5df48065963ddd8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 748
  2⤵
  - Program crash
  PID:2944

memory/2036-0-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-1-0x00000000011E0000-0x000000000209C000-memory.dmp

Filesize
14.7MB

Download
memory/2036-2-0x0000000000C70000-0x0000000000CB0000-memory.dmp

Filesize
256KB

Download
memory/2036-3-0x00000000086A0000-0x000000000897A000-memory.dmp

Filesize
2.9MB

Download
memory/2036-4-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-5-0x0000000000C70000-0x0000000000CB0000-memory.dmp

Filesize
256KB

Download