c2b88b7c0e3a630f69c35d3d476a01c38f83fca3efbba10e55188e0264ff56d6

Analysis

max time kernel
44s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 16:53

Target

CCleaner.Technician.6.12.10490.Portable/Other/_Include/7-Zip/7z.dll
Size

1.1MB
MD5

1d609dde1bf42bd586dc6ffd9baec9ad
SHA1

5fbef0f1da6ddb894e66ec9fb2940b2a6e2528c4
SHA256

8621c36f640b15e24432289fa6576cfc0650b58ec7dc4e9bb368f770a7d1e063
SHA512

d47b3aa894051df6b95dd8b691d8547cd2ab6f483f2d9251e17eb04487c89fbd109f64bf2bfbc37c907436af5a9af71493d70bd5497f155dc0d79123c141ccc6
SSDEEP

24576:k//aDLAVLLZmB2jv1ZQbsx74v1ccjeIMasrPCjn/+WSiL+t:k/ELAzmB2jv1ZQb5vP+Cj+WSW+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
876	884	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 884	1972	rundll32.exe	27
PID 1972 wrote to memory of 884	1972	rundll32.exe	27
PID 1972 wrote to memory of 884	1972	rundll32.exe	27
PID 1972 wrote to memory of 884	1972	rundll32.exe	27
PID 1972 wrote to memory of 884	1972	rundll32.exe	27
PID 1972 wrote to memory of 884	1972	rundll32.exe	27
PID 1972 wrote to memory of 884	1972	rundll32.exe	27
PID 884 wrote to memory of 876	884	rundll32.exe	28
PID 884 wrote to memory of 876	884	rundll32.exe	28
PID 884 wrote to memory of 876	884	rundll32.exe	28
PID 884 wrote to memory of 876	884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CCleaner.Technician.6.12.10490.Portable\Other\_Include\7-Zip\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CCleaner.Technician.6.12.10490.Portable\Other\_Include\7-Zip\7z.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 224
    3⤵
    - Program crash
    PID:876