be7f9c6015c1bfff3173610ee1585d7d30df70c84c951b1ea429d7c004cad243

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 11:45

Target

BleachBit-Portable/glib._glib.dll
Size

19KB
MD5

6c2c8ec24fd7a31f2eeec4b7ac86e173
SHA1

bb1fec2a0a82d168a8858c771fdf628a4eb33194
SHA256

a54d4445ff6c8eba6304bfeba7927ff6097e29edf6b7f6802b042a72176a310c
SHA512

f1ec6e8c4f648507d13e3f931377f69892d6650f7eb96a861aa76f83fb9cc4fcb8195828a2107f12fafd3a05c71d6482ecbb82f95794981be9cb223d6493b5e8
SSDEEP

384:oEQsh7lyQVTtE7irPauFKOpoRlMRXUrEj1BNAsD6TllMFZGN:BdQQVTkQaSKOGROSro8s2wZM

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral25/memory/2216-0-0x000000006A900000-0x000000006A91A000-memory.dmp	upx
behavioral25/memory/2216-1-0x00000000685C0000-0x00000000686D8000-memory.dmp	upx
behavioral25/memory/2216-2-0x000000006A300000-0x000000006A327000-memory.dmp	upx
behavioral25/memory/2216-3-0x0000000065C40000-0x0000000065C51000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2216	2204	rundll32.exe	28
PID 2204 wrote to memory of 2216	2204	rundll32.exe	28
PID 2204 wrote to memory of 2216	2204	rundll32.exe	28
PID 2204 wrote to memory of 2216	2204	rundll32.exe	28
PID 2204 wrote to memory of 2216	2204	rundll32.exe	28
PID 2204 wrote to memory of 2216	2204	rundll32.exe	28
PID 2204 wrote to memory of 2216	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\glib._glib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\glib._glib.dll,#1
  2⤵
  PID:2216

memory/2216-0-0x000000006A900000-0x000000006A91A000-memory.dmp

Filesize
104KB

Download
memory/2216-1-0x00000000685C0000-0x00000000686D8000-memory.dmp

Filesize
1.1MB

Download
memory/2216-2-0x000000006A300000-0x000000006A327000-memory.dmp

Filesize
156KB

Download
memory/2216-3-0x0000000065C40000-0x0000000065C51000-memory.dmp

Filesize
68KB

Download