gcleaner | 49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda

Analysis

max time kernel
141s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
27-04-2024 22:17

Target

49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
Size

334KB
MD5

dc60dd25ff84f282098c150bc0b8ad68
SHA1

2bf36bac3fc164d72825499f7b39d0fd9d769aa3
SHA256

49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda
SHA512

263bce01345915ef299863d8b6387e0b88728b8b7c618757bf30889cf490d54187b45a1d0c0d266abd2b01a70b749ce5413a279292bb200eccd504db2f722038
SSDEEP

3072:ODGGDaj/p1OT/dGG+p8GXHFqzVv6y8sDasSprSOEODOvK+NzzDkjbqywAKdwWF9N:9KT3NUoVv98nsSYOzOi+lCo9d1zMyl

Score

10^/10

gcleaner loader

Family

gcleaner

185.172.128.90

5.42.65.64

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3620	2056	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
4464	2056	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
2848	2056	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
3772	2056	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
2516	2056	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
3012	2056	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
1512	2056	WerFault.exe	49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe

C:\Users\Admin\AppData\Local\Temp\49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe
"C:\Users\Admin\AppData\Local\Temp\49acd9478d09a28bb6673f9725fb6d986a07f624b355617b037a739fce880fda.exe"
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 772
2⤵
- Program crash
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 792
2⤵
- Program crash
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 792
2⤵
- Program crash
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 772
2⤵
- Program crash
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 992
2⤵
- Program crash
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1060
2⤵
- Program crash
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 776
2⤵
- Program crash
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2056 -ip 2056
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2056 -ip 2056
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2056 -ip 2056
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2056 -ip 2056
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2056 -ip 2056
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2056 -ip 2056
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2056 -ip 2056
1⤵
PID:2324

memory/2056-1-0x0000000001CB0000-0x0000000001DB0000-memory.dmp

Filesize
1024KB

Download
memory/2056-2-0x0000000001C80000-0x0000000001CAD000-memory.dmp

Filesize
180KB

Download
memory/2056-3-0x0000000000400000-0x0000000001A1E000-memory.dmp

Filesize
22.1MB

Download
memory/2056-5-0x0000000001CB0000-0x0000000001DB0000-memory.dmp

Filesize
1024KB

Download