blackguard | fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 01:07

Target

fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe
Size

1.3MB
MD5

ae4c118fc729e17bffd7b8778e737c16
SHA1

7cae52380984614ba9e39d7da732608273f3d3e9
SHA256

fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e
SHA512

08937b06c973b0fd9346f27fea5ec48b05ea4367f311d0f0b29f9c6378aa8ca9fc148933db40dab5116d89f6ef297106d59be3fcebe37d20b564bac757059d9e
SSDEEP

12288:rmEuIKCCPQWcNeM/Fwx3PC9rDdI3QT9qCacBO71ET3hg2C2CE1wZN9RYVS:CnIjCPQWcN6PkX/LhEt3RYVS

Score

10^/10

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2808 2212 WerFault.exe fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe

pid	pid_target	process	target process
2808	2212	WerFault.exe	fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe

description	pid	process	target process
PID 2212 wrote to memory of 2808	2212	fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe	WerFault.exe
PID 2212 wrote to memory of 2808	2212	fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe	WerFault.exe
PID 2212 wrote to memory of 2808	2212	fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe	WerFault.exe
PID 2212 wrote to memory of 2808	2212	fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe
"C:\Users\Admin\AppData\Local\Temp\fe4707f9d354f7208c00ef1d7ffdf3174c46ffc69d7903b8c2e574c00046933e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 520
2⤵
- Program crash
PID:2808

memory/2212-0-0x00000000002B0000-0x0000000000404000-memory.dmp

Filesize
1.3MB

Download
memory/2212-1-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2212-2-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download