gcleaner | 49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:17

Target

49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
Size

334KB
MD5

dc60dd25ff84f282098c150bc0b8ad68
SHA1

2bf36bac3fc164d72825499f7b39d0fd9d769aa3
SHA256

49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda
SHA512

263bce01345915ef299863d8b6387e0b88728b8b7c618757bf30889cf490d54187b45a1d0c0d266abd2b01a70b749ce5413a279292bb200eccd504db2f722038
SSDEEP

3072:ODGGDaj/p1OT/dGG+p8GXHFqzVv6y8sDasSprSOEODOvK+NzzDkjbqywAKdwWF9N:9KT3NUoVv98nsSYOzOi+lCo9d1zMyl

Score

10^/10

gcleaner loader

Family

gcleaner

185.172.128.90

5.42.65.64

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3064	3448	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
1128	3448	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
3056	3448	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
1892	3448	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
3796	3448	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
2732	3448	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
1712	3448	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe

C:\Users\Admin\AppData\Local\Temp\49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
"C:\Users\Admin\AppData\Local\Temp\49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe"
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 740
2⤵
- Program crash
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 748
2⤵
- Program crash
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 792
2⤵
- Program crash
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 812
2⤵
- Program crash
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 904
2⤵
- Program crash
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 980
2⤵
- Program crash
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 764
2⤵
- Program crash
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 3448
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3448 -ip 3448
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3448 -ip 3448
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3448 -ip 3448
1⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3448 -ip 3448
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3448 -ip 3448
1⤵
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3448 -ip 3448
1⤵
PID:1280

memory/3448-2-0x0000000001AB0000-0x0000000001ADD000-memory.dmp

Filesize
180KB

Download
memory/3448-1-0x0000000001AF0000-0x0000000001BF0000-memory.dmp

Filesize
1024KB

Download
memory/3448-3-0x0000000000400000-0x0000000001A1E000-memory.dmp

Filesize
22.1MB

Download
memory/3448-5-0x0000000001AB0000-0x0000000001ADD000-memory.dmp

Filesize
180KB

Download
memory/3448-7-0x0000000001AF0000-0x0000000001BF0000-memory.dmp

Filesize
1024KB

Download