blackguard | 8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 01:03

Target

8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe
Size

1.3MB
MD5

3832a68c4ea8715ab5493c383a73cc86
SHA1

30d7edfc5ff0437fb9105a15a43e06fb2484fc58
SHA256

8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368
SHA512

df796ba171abfe89d6bcc13913b071705deed5e4a96225562834c5e6859ef22ca5331727cc16c1f0d34dce572b69d40dffa73861f4de98fdb1867ef9c47a3ef4
SSDEEP

12288:imEuIKCCPQWcNeM/Fwx3PC9rDdI3QT9qCanpONQp4ebAa2hKCE1wZNcRYVD:rnIjCPQWcN6PkX/E8VpORYVD

Score

10^/10

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 4412 WerFault.exe 8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe

pid	pid_target	process	target process
1368	4412	WerFault.exe	8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe

C:\Users\Admin\AppData\Local\Temp\8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe
"C:\Users\Admin\AppData\Local\Temp\8fbacf10c69137f7526f8d712fd7e0be05ca8636e55ecfd21e7a6901e1496368.exe"
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 804
2⤵
- Program crash
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4412 -ip 4412
1⤵
PID:2996

memory/4412-0-0x0000000000070000-0x00000000001C4000-memory.dmp

Filesize
1.3MB

Download
memory/4412-1-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/4412-2-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download