004c59e17178ebbc86da08ea93eb39064a86f5d1be7c18d330c15f80dde8504b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 08:50

Target

Downloads/ccleaner.exe
Size

1.9MB
MD5

a7e44b01b9f23031067e9032196cc0ba
SHA1

c8c763e9cc7a1eeb724a1c54f92f29e2f5382ce4
SHA256

ba5067481b31085ae5222f912097d54125dcc97c6551396f11974ae4bec2bd98
SHA512

caa6feb23c2bcdcfd8affafddcf71bd03fbe44a8fa7d197e6643a3609026f1821451f998b3a9c47649c99a0271cbf481e3e47375dd91b562005091ef3706f53f
SSDEEP

24576:RDXpgvsPjx71gWufN62I520/hjlB6iTzKF+iZpWdt5YY7tOvkIOTbNvb7Jhh2:RDevYxSNudSrZpWxd7tOvJOtb7v8

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2416	1516	ccleaner.exe	84
PID 1516 wrote to memory of 2416	1516	ccleaner.exe	84

C:\Users\Admin\AppData\Local\Temp\Downloads\ccleaner.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads\ccleaner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {22bfeed6-cb41-4fe3-9e7b-fab443ef9e19} -a "CCleaner" -v "Piriform Ltd" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 2021048 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\Downloads\ccleaner.exe"
  2⤵
  PID:2416