be7f9c6015c1bfff3173610ee1585d7d30df70c84c951b1ea429d7c004cad243

Analysis

max time kernel
141s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 11:45

Target

BleachBit-Portable/intl.dll
Size

51KB
MD5

d2052e93b5c0334c9e1acdb2517be1aa
SHA1

ca2249751edddfe0161884eaf0de60c23a9fb127
SHA256

ad13f3bcd45db704b40f7127829dda238920bf1097fafed89a902e36d420ed29
SHA512

74de1bc1f862836d7da646cc6d272e433f0c7a78503eeb0656b50fe6d37ac545467d90387b8a4165e197139e38973b65a1dd8ddb562d90ed0c548c478b653cbf
SSDEEP

768:yVUkB/uu/jF8kVkOYFmmuLAjQaUbllafj7q5xK9nv6EerYztREbCNxWAUG9f:yOG/jj2SkGmuESblaU4hCbMxF9f

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral32/memory/3712-0-0x000000006A300000-0x000000006A327000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3712	4984	rundll32.exe	86
PID 4984 wrote to memory of 3712	4984	rundll32.exe	86
PID 4984 wrote to memory of 3712	4984	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\intl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\intl.dll,#1
  2⤵
  PID:3712

memory/3712-0-0x000000006A300000-0x000000006A327000-memory.dmp

Filesize
156KB

Download