gcleaner | a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34

Analysis

max time kernel
291s
max time network
303s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-06-2024 23:50

Target

a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
Size

367KB
MD5

251bd8f786bc0900239a2fde5772630c
SHA1

3cc709a76020385a0a1d3d556bc0349d4e43f0ba
SHA256

a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34
SHA512

0dca09b2c5352a1a3480d5399b1268efccbb55c0ace59a9242ec7aaccf5276072bbaac49050b1b53696e0443e6864e65a60a4da0dbadbf421c338086a441a70d
SSDEEP

6144:icfZLH7hJvTAee1ZzXIg18kFybk/u5Q/b:imZL7hFceqzXIa8kFy+J

Score

10^/10

gcleaner loader

Family

gcleaner

185.172.128.90

185.172.128.69

Attributes

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4044	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
4840	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
220	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
2876	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
4296	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
2356	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
1840	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
5108	3780	WerFault.exe	a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe

C:\Users\Admin\AppData\Local\Temp\a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe
"C:\Users\Admin\AppData\Local\Temp\a3c9657e5006ed209c24e83c64cd083a8c45393e86d308856432840de5fc8a34.exe"
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 760
2⤵
- Program crash
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 772
2⤵
- Program crash
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 840
2⤵
- Program crash
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 884
2⤵
- Program crash
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 988
2⤵
- Program crash
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1092
2⤵
- Program crash
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1124
2⤵
- Program crash
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1168
2⤵
- Program crash
PID:5108

memory/3780-1-0x00007FF8AEEC0000-0x00007FF8AF09B000-memory.dmp

Filesize
1.9MB

Download
memory/3780-3-0x0000000000400000-0x0000000002378000-memory.dmp

Filesize
31.5MB

Download