be7f9c6015c1bfff3173610ee1585d7d30df70c84c951b1ea429d7c004cad243

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 11:45

Target

BleachBit-Portable/gtk._gtk.dll
Size

277KB
MD5

b1f14e514fc302d85097b45ea056db5d
SHA1

a8b59bd59c91d35f5b3ade33c5de30a50233cefe
SHA256

d6f233dc447d7ec4169ff8819aa4857c440407fa890077aa50147b8cab74d5ff
SHA512

991fba850010cbeeb6d7f8575991b40dde37adeb9203175244233ac01fc74f2402b8e28afb05fe070990808371ca3bbccb9d18d32375ac4188a948d516e0bffd
SSDEEP

6144:Y9xmZI4BD6q8M3SbTUub0rFdzRMMvlbGIrdmj3n1Cu+UfdDJS2PtO9:DZI4BXccuArFdzKMvlbnrqnEk1FxP

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral30/memory/3248-0-0x0000000064740000-0x0000000064940000-memory.dmp	upx
behavioral30/memory/3248-3-0x000000006D580000-0x000000006D661000-memory.dmp	upx
behavioral30/memory/3248-2-0x0000000065340000-0x000000006537C000-memory.dmp	upx
behavioral30/memory/3248-1-0x000000006C340000-0x000000006C405000-memory.dmp	upx
behavioral30/memory/3248-4-0x00000000685C0000-0x00000000686D8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 3248	1896	rundll32.exe	86
PID 1896 wrote to memory of 3248	1896	rundll32.exe	86
PID 1896 wrote to memory of 3248	1896	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\gtk._gtk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\gtk._gtk.dll,#1
  2⤵
  PID:3248

memory/3248-0-0x0000000064740000-0x0000000064940000-memory.dmp

Filesize
2.0MB

Download
memory/3248-3-0x000000006D580000-0x000000006D661000-memory.dmp

Filesize
900KB

Download
memory/3248-2-0x0000000065340000-0x000000006537C000-memory.dmp

Filesize
240KB

Download
memory/3248-1-0x000000006C340000-0x000000006C405000-memory.dmp

Filesize
788KB

Download
memory/3248-4-0x00000000685C0000-0x00000000686D8000-memory.dmp

Filesize
1.1MB

Download
memory/3248-5-0x0000000063A40000-0x0000000063A92000-memory.dmp

Filesize
328KB

Download
memory/3248-6-0x0000000061780000-0x0000000061B76000-memory.dmp

Filesize
4.0MB

Download
memory/3248-7-0x000000001E000000-0x000000001E24F000-memory.dmp

Filesize
2.3MB

Download
memory/3248-8-0x0000000068DC0000-0x0000000068EBE000-memory.dmp

Filesize
1016KB

Download
memory/3248-9-0x0000000065580000-0x00000000655C9000-memory.dmp

Filesize
292KB

Download
memory/3248-10-0x000000006A300000-0x000000006A327000-memory.dmp

Filesize
156KB

Download