blackguard | 8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 01:21

Target

8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe
Size

1.3MB
MD5

82162ebb53033079dd0fc5d2dfd7ba9d
SHA1

88b8426fe8bdaeda2614c066d67f4c44d6fe78c8
SHA256

8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4
SHA512

7c8b97b54f979b45b2e1e7575acd5cb28fde3be93eb1688eb44b3ee2d0b8aa8fb44ffdcaff7c8a47828c9409a9e497c0c24fed445621a3f869061ae93ef436f3
SSDEEP

24576:a0QukIVdOGqwnyM/XCOU6YT0ijDY/j4eO:aAgTaXCn6y+ja

Score

10^/10

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

528 3200 WerFault.exe 8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe

pid	pid_target	process	target process
528	3200	WerFault.exe	8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe

C:\Users\Admin\AppData\Local\Temp\8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe
"C:\Users\Admin\AppData\Local\Temp\8c2ccccbf994ea7004caa925417cbc488a5db171f6bc220e4edcda8117b202c4.exe"
1⤵
PID:3200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 804
  2⤵
  - Program crash
  PID:528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3200 -ip 3200
1⤵
PID:1440

memory/3200-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Filesize
4KB

Download
memory/3200-1-0x0000000000660000-0x00000000007BA000-memory.dmp

Filesize
1.4MB

Download