0cd53b38aff244f57afc12e7393b543d82e7eed2eecfc2fcdb034fcd1f3bd2ee

Analysis

max time kernel
22s
max time network
22s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 17:38

Target

PC_Cleaner_setup.exe
Size

7.5MB
MD5

f004da3d2f9f3ff3437089759bae8cfd
SHA1

f0106d7e51cca3cfe35c4c6d6d53e9bdaddc7ad7
SHA256

0cd53b38aff244f57afc12e7393b543d82e7eed2eecfc2fcdb034fcd1f3bd2ee
SHA512

b09d5cbca0252acb6b3414ad60956686731bd3b5e57c20bd993593f06a7611daab8c68c35218881fffb25d0f5546a3b3326ce1f532c85bf6965ad6c4b86bb7f8
SSDEEP

196608:WW3n0Nma5Jn2JxKSxpYseYy7/fFs49fyJmJuSpp:p30h32JxKSxpYagq4kmJuSpp

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2724	PC_Cleaner_setup.tmp

Loads dropped DLL 1 IoCs

pid	Process
2484	PC_Cleaner_setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2724	2484	PC_Cleaner_setup.exe	28
PID 2484 wrote to memory of 2724	2484	PC_Cleaner_setup.exe	28
PID 2484 wrote to memory of 2724	2484	PC_Cleaner_setup.exe	28
PID 2484 wrote to memory of 2724	2484	PC_Cleaner_setup.exe	28
PID 2484 wrote to memory of 2724	2484	PC_Cleaner_setup.exe	28
PID 2484 wrote to memory of 2724	2484	PC_Cleaner_setup.exe	28
PID 2484 wrote to memory of 2724	2484	PC_Cleaner_setup.exe	28

C:\Users\Admin\AppData\Local\Temp\PC_Cleaner_setup.exe
"C:\Users\Admin\AppData\Local\Temp\PC_Cleaner_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\is-UHA40.tmp\PC_Cleaner_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UHA40.tmp\PC_Cleaner_setup.tmp" /SL5="$30152,6942773,831488,C:\Users\Admin\AppData\Local\Temp\PC_Cleaner_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:2724

\Users\Admin\AppData\Local\Temp\is-UHA40.tmp\PC_Cleaner_setup.tmp

Filesize
3.1MB

MD5
e1efffeabf739101e96d3a2cfece74c0

SHA1
e541f100b3bf528e8624c0ba1ef4c57a312bab57

SHA256
14096802b6957f548379c56ff9a48b39b988c03355132353230295b68c38e163

SHA512
43586ac27db6e202025a5caeb7dbb67ce0695def75a57ecc262fca1bf25647d5916cac3e42aa8104d2eb981520ab74beb94ec199f74e5b3f203e66691c506ae0

Download Submit
memory/2484-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2484-11-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2484-18-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2724-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2724-12-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2724-16-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download