c56c00ca3f42026f17affef76b3752f268d1498f862b3143985ca7c1d33feb39

Resubmissions

21-01-2025 13:35

21-01-2025 11:58

21-01-2025 11:44

21-01-2025 11:07

17-07-2024 20:08

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
17-07-2024 20:08

Target

ccleaner.exe
Size

1.9MB
MD5

a7e44b01b9f23031067e9032196cc0ba
SHA1

c8c763e9cc7a1eeb724a1c54f92f29e2f5382ce4
SHA256

ba5067481b31085ae5222f912097d54125dcc97c6551396f11974ae4bec2bd98
SHA512

caa6feb23c2bcdcfd8affafddcf71bd03fbe44a8fa7d197e6643a3609026f1821451f998b3a9c47649c99a0271cbf481e3e47375dd91b562005091ef3706f53f
SSDEEP

24576:RDXpgvsPjx71gWufN62I520/hjlB6iTzKF+iZpWdt5YY7tOvkIOTbNvb7Jhh2:RDevYxSNudSrZpWxd7tOvJOtb7v8

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2984	2396	ccleaner.exe	82
PID 2396 wrote to memory of 2984	2396	ccleaner.exe	82

C:\Users\Admin\AppData\Local\Temp\ccleaner.exe
"C:\Users\Admin\AppData\Local\Temp\ccleaner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\pcaui.exe
  "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {22bfeed6-cb41-4fe3-9e7b-fab443ef9e19} -a "CCleaner" -v "Piriform Ltd" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 2021048 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\ccleaner.exe"
  2⤵
  PID:2984