be7f9c6015c1bfff3173610ee1585d7d30df70c84c951b1ea429d7c004cad243

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 11:45

Target

BleachBit-Portable/atk.dll
Size

29KB
MD5

c953341cd4cf8b3867919a8760b58c62
SHA1

9fa26229edc04a2679efe5a74d5889ab59381d51
SHA256

72729b4d1ae6c324b9a39398cab0d72cd1176c0cebc92cc91a886264e28b7949
SHA512

29d51473ffbcfb8fd2e757c71698cd06a3b9039adcd9e6da77aad9b138f9b3fbcb3c275ae70b0e2c90c8ffd5101ec97c4d7484942db4e210d86983dfcfbc7afc
SSDEEP

768:ov48+Q+85gMgKh1siLSmLefFZKaJaPWC7:U48X+qJ1nLSn/Kh

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral11/memory/2280-0-0x0000000068180000-0x00000000681C0000-memory.dmp	upx
behavioral11/memory/2280-1-0x0000000062940000-0x0000000062966000-memory.dmp	upx
behavioral11/memory/2280-2-0x000000006A300000-0x000000006A327000-memory.dmp	upx
behavioral11/memory/2280-3-0x00000000685C0000-0x00000000686D8000-memory.dmp	upx
behavioral11/memory/2280-4-0x0000000063A40000-0x0000000063A92000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\atk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\atk.dll,#1
  2⤵
  PID:2280

memory/2280-0-0x0000000068180000-0x00000000681C0000-memory.dmp

Filesize
256KB

Download
memory/2280-1-0x0000000062940000-0x0000000062966000-memory.dmp

Filesize
152KB

Download
memory/2280-2-0x000000006A300000-0x000000006A327000-memory.dmp

Filesize
156KB

Download
memory/2280-3-0x00000000685C0000-0x00000000686D8000-memory.dmp

Filesize
1.1MB

Download
memory/2280-4-0x0000000063A40000-0x0000000063A92000-memory.dmp

Filesize
328KB

Download
memory/2280-5-0x0000000065C40000-0x0000000065C51000-memory.dmp

Filesize
68KB

Download