be7f9c6015c1bfff3173610ee1585d7d30df70c84c951b1ea429d7c004cad243

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 11:45

Target

BleachBit-Portable/cairo._cairo.dll
Size

18KB
MD5

2c0fdc28b1a3c0b11160ec6e2177d47b
SHA1

ec463f1bc0068badad777b014cf26a5ec95d9eb2
SHA256

3f63cc994113096bfa7a8f12f4a5444f6b5057e22a3a4e0b05e5d9784b6e3849
SHA512

f2d2583a3a6ccb39fd050b434d4be7b4250dde17a885a9bbe84a35b8483c0145680377163f720c04290c0d271978e2494db69a293b4f5bdc46f0ed9e23a2ec2b
SSDEEP

384:y+ZQmBqlGVUONTqmWIg3krste3MYJ6OxWOXMgidGNlxr078AZHnAu:llfeONqmykrMTUBYuOXHAu

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral19/memory/2376-2-0x0000000064880000-0x000000006489D000-memory.dmp	upx
behavioral19/memory/2376-1-0x0000000064880000-0x000000006489D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2376	1720	rundll32.exe	28
PID 1720 wrote to memory of 2376	1720	rundll32.exe	28
PID 1720 wrote to memory of 2376	1720	rundll32.exe	28
PID 1720 wrote to memory of 2376	1720	rundll32.exe	28
PID 1720 wrote to memory of 2376	1720	rundll32.exe	28
PID 1720 wrote to memory of 2376	1720	rundll32.exe	28
PID 1720 wrote to memory of 2376	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\cairo._cairo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\cairo._cairo.dll,#1
  2⤵
  PID:2376

memory/2376-0-0x0000000064880000-0x000000006489D000-memory.dmp

Filesize
116KB

Download
memory/2376-2-0x0000000064880000-0x000000006489D000-memory.dmp

Filesize
116KB

Download
memory/2376-1-0x0000000064880000-0x000000006489D000-memory.dmp

Filesize
116KB

Download
memory/2376-4-0x000000006A800000-0x000000006A87E000-memory.dmp

Filesize
504KB

Download
memory/2376-3-0x0000000068DC0000-0x0000000068EBE000-memory.dmp

Filesize
1016KB

Download
memory/2376-5-0x0000000064F80000-0x0000000064FBE000-memory.dmp

Filesize
248KB

Download
memory/2376-7-0x0000000061A00000-0x0000000061A38000-memory.dmp

Filesize
224KB

Download
memory/2376-6-0x0000000068F40000-0x0000000068F67000-memory.dmp

Filesize
156KB

Download
memory/2376-8-0x0000000064880000-0x000000006489D000-memory.dmp

Filesize
116KB

Download
memory/2376-9-0x0000000062E80000-0x0000000062EA2000-memory.dmp

Filesize
136KB

Download