blackguard | 8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 01:21

Target

8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe
Size

1.3MB
MD5

82162ebb53033079dd0fc5d2dfd7ba9d
SHA1

88b8426fe8bdaeda2614c066d67f4c44d6fe78c8
SHA256

8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4
SHA512

7c8b97b54f979b45b2e1e7575acd5cb28fde3be93eb1688eb44b3ee2d0b8aa8fb44ffdcaff7c8a47828c9409a9e497c0c24fed445621a3f869061ae93ef436f3
SSDEEP

24576:a0QukIVdOGqwnyM/XCOU6YT0ijDY/j4eO:aAgTaXCn6y+ja

Score

10^/10

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2324 3000 WerFault.exe 8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe

pid	pid_target	process	target process
2324	3000	WerFault.exe	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe

description	pid	process	target process
PID 3000 wrote to memory of 2324	3000	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	WerFault.exe
PID 3000 wrote to memory of 2324	3000	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	WerFault.exe
PID 3000 wrote to memory of 2324	3000	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	WerFault.exe
PID 3000 wrote to memory of 2324	3000	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe
"C:\Users\Admin\AppData\Local\Temp\8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 524
  2⤵
  - Program crash
  PID:2324

memory/3000-0-0x000000007424E000-0x000000007424F000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000001010000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/3000-2-0x000000007424E000-0x000000007424F000-memory.dmp

Filesize
4KB

Download