blackguard | 8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 01:03

Target

8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe
Size

1.3MB
MD5

3832a68c4ea8715ab5493c383a73cc86
SHA1

30d7edfc5ff0437fb9105a15a43e06fb2484fc58
SHA256

8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368
SHA512

df796ba171abfe89d6bcc13913b071705deed5e4a96225562834c5e6859ef22ca5331727cc16c1f0d34dce572b69d40dffa73861f4de98fdb1867ef9c47a3ef4
SSDEEP

12288:imEuIKCCPQWcNeM/Fwx3PC9rDdI3QT9qCanpONQp4ebAa2hKCE1wZNcRYVD:rnIjCPQWcN6PkX/E8VpORYVD

Score

10^/10

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2896 2916 WerFault.exe 8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe

pid	pid_target	process	target process
2896	2916	WerFault.exe	8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe

description	pid	process	target process
PID 2916 wrote to memory of 2896	2916	8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe	WerFault.exe
PID 2916 wrote to memory of 2896	2916	8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe	WerFault.exe
PID 2916 wrote to memory of 2896	2916	8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe	WerFault.exe
PID 2916 wrote to memory of 2896	2916	8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe
"C:\Users\Admin\AppData\Local\Temp\8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 520
2⤵
- Program crash
PID:2896

memory/2916-0-0x0000000001340000-0x0000000001494000-memory.dmp

Filesize
1.3MB

Download
memory/2916-1-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download
memory/2916-2-0x0000000074030000-0x000000007471E000-memory.dmp

Filesize
6.9MB

Download