Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
20-05-2023 16:53
General
-
Target
CCleaner.Technician.6.12.10490.Portable/Other/_Include/7-Zip/7z.dll
-
Size
1.1MB
-
MD5
1d609dde1bf42bd586dc6ffd9baec9ad
-
SHA1
5fbef0f1da6ddb894e66ec9fb2940b2a6e2528c4
-
SHA256
8621c36f640b15e24432289fa6576cfc0650b58ec7dc4e9bb368f770a7d1e063
-
SHA512
d47b3aa894051df6b95dd8b691d8547cd2ab6f483f2d9251e17eb04487c89fbd109f64bf2bfbc37c907436af5a9af71493d70bd5497f155dc0d79123c141ccc6
-
SSDEEP
24576:k//aDLAVLLZmB2jv1ZQbsx74v1ccjeIMasrPCjn/+WSiL+t:k/ELAzmB2jv1ZQb5vP+Cj+WSW+
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CCleaner.Technician.6.12.10490.Portable\Other\_Include\7-Zip\7z.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CCleaner.Technician.6.12.10490.Portable\Other\_Include\7-Zip\7z.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 6003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1228 -ip 12281⤵