Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 01:26
Behavioral task
behavioral1
Sample
df245b010ed5f91d1f221eebe88ccfe9eab9f8704ec76e12b9a95e6f96e1b857.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
df245b010ed5f91d1f221eebe88ccfe9eab9f8704ec76e12b9a95e6f96e1b857.exe
Resource
win10v2004-20240426-en
General
-
Target
df245b010ed5f91d1f221eebe88ccfe9eab9f8704ec76e12b9a95e6f96e1b857.exe
-
Size
1.3MB
-
MD5
2ad527b97f59ea2d7aa6377d44699265
-
SHA1
92b89319b8ad9db1f918674d01ef8153605099ac
-
SHA256
df245b010ed5f91d1f221eebe88ccfe9eab9f8704ec76e12b9a95e6f96e1b857
-
SHA512
b745d6973e425ac32d8c3ed9416385737962e7fc341cb15c7ce03b48c514925ffda17fab10c591fc6469168ffbe3dfc4755798c6245bcea06cf3f0cc194159b0
-
SSDEEP
12288:9hLrOF2ZLMa0E+RV8gEB1v/dHR7pUYq/+bD7HOhFxo40ibHLS9KJjCVgtZaBYbiT:+AZLMa0EYVl6b7C927H4xR0UsK8LYeT
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1544 4324 WerFault.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\df245b010ed5f91d1f221eebe88ccfe9eab9f8704ec76e12b9a95e6f96e1b857.exe"C:\Users\Admin\AppData\Local\Temp\df245b010ed5f91d1f221eebe88ccfe9eab9f8704ec76e12b9a95e6f96e1b857.exe"1⤵PID:4324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 8042⤵
- Program crash
PID:1544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4324 -ip 43241⤵PID:2152