gcleaner | 3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 23:40

Target

3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
Size

287KB
MD5

9302856c12e8253ff564944f51380b3e
SHA1

4d8a59d66cdcbbb46ae0686116dafd112bc249d5
SHA256

3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c
SHA512

966e1f3489b078422ef4292b820975cfd7a7286bf48b840eb434e78245c5890b00adfbd0029804ef5c6da07d34447d6dd525b7e5858fc7a647c496e69f8de007
SSDEEP

3072:BzUt6pKTpaHNKl09wZnDul/INY4Ub5uRmAe4SPdJ8iP1+btZXARNzn4njMXr/FLK:ymHNK61N1uAAr088Ywn4nkJHVAF23M

Score

10^/10

gcleaner loader

Family

gcleaner

185.172.128.90

5.42.64.56

185.172.128.69

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3792	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
3084	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
1408	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
4492	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
1140	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
3348	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
532	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
3092	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
1656	2980	WerFault.exe	3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe

C:\Users\Admin\AppData\Local\Temp\3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe
"C:\Users\Admin\AppData\Local\Temp\3909cabaae4061ab3b5ffeaf23fdbbe419de9a3d58ec7dc505c2ae91ddcb1a8c.exe"
1⤵
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 452
  2⤵
  - Program crash
  PID:3792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 488
  2⤵
  - Program crash
  PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 748
  2⤵
  - Program crash
  PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 788
  2⤵
  - Program crash
  PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 828
  2⤵
  - Program crash
  PID:1140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 856
  2⤵
  - Program crash
  PID:3348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 912
  2⤵
  - Program crash
  PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 920
  2⤵
  - Program crash
  PID:3092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 752
  2⤵
  - Program crash
  PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2980 -ip 2980
1⤵
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2980 -ip 2980
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2980 -ip 2980
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2980 -ip 2980
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2980 -ip 2980
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2980 -ip 2980
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2980 -ip 2980
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2980 -ip 2980
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2980 -ip 2980
1⤵
PID:4836

memory/2980-1-0x00000000006E0000-0x00000000007E0000-memory.dmp

Filesize
1024KB

Download
memory/2980-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2980-2-0x00000000005F0000-0x000000000062C000-memory.dmp

Filesize
240KB

Download
memory/2980-4-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2980-6-0x00000000006E0000-0x00000000007E0000-memory.dmp

Filesize
1024KB

Download
memory/2980-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download