95a8e22f4586b962c8bbe268f28b9561ecfafc06bee75f3571ced253d66d5531

Analysis

max time kernel
92s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 16:58

Target

CCleaner.exe
Size

1.6MB
MD5

fdfb209c5a04b7784bb0bb4af7f0b31c
SHA1

fe5a7301bcf0593e59265a24e514b756577c30bd
SHA256

c565feb2847bf0d116135db188bafe728e889f8f7319f562d7331a2906fd49c7
SHA512

76253a95753039ac72bee37e09eba3617330f656b45bee97250de0f4c9b6ab8e3b2353b2256bb07b0c1636bf2f3069a1f99d33063057f3c8e43b13619efb831f
SSDEEP

24576:ojfUhykNTubUrgaJu5nuqrnMevWRIRJ1UuFh3zN815tjoiFW:ojfUhxrrJylndvWRIRsazN815tjBFW

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

CCleaner.exe

description	pid	process	target process
PID 2152 wrote to memory of 3332	2152	CCleaner.exe	pcaui.exe
PID 2152 wrote to memory of 3332	2152	CCleaner.exe	pcaui.exe

C:\Users\Admin\AppData\Local\Temp\CCleaner.exe
"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\system32\pcaui.exe
"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {22bfeed6-cb41-4fe3-9e7b-fab443ef9e19} -a "CCleaner" -v "Piriform Ltd" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 2021048 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"
2⤵
PID:3332