Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 16:07
General
- Target BleachBit-Portable/pangocairo-1.0-0.dll
- Size 35KB
- Sample261011-tkvhrabs7s
- SHA256 0bc4ef96f3865389f2b22bf302fe74605ab5987f611169a85a935c1cd5593d0e
Malware Config
Signatures
- UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\pangocairo-1.0-0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\pangocairo-1.0-0.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 24523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1732 -ip 17321⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1732-0-0x0000000074AB0000-0x0000000074AC5000-memory.dmp
memory/1732-1-0x00000000749D0000-0x0000000074AA7000-memory.dmp
memory/1732-2-0x0000000074740000-0x0000000074875000-memory.dmp
memory/1732-3-0x00000000746E0000-0x0000000074731000-memory.dmp
memory/1732-9-0x0000000000EC0000-0x0000000000F56000-memory.dmp
memory/1732-8-0x0000000074430000-0x00000000744C6000-memory.dmp
memory/1732-22-0x0000000073C30000-0x0000000073C59000-memory.dmp
memory/1732-25-0x0000000073EE0000-0x0000000073EF4000-memory.dmp
memory/1732-24-0x00000000745B0000-0x00000000745CB000-memory.dmp
memory/1732-23-0x0000000074880000-0x00000000749C7000-memory.dmp
memory/1732-21-0x0000000073E70000-0x0000000073E7B000-memory.dmp
memory/1732-20-0x0000000073E80000-0x0000000073E92000-memory.dmp
memory/1732-19-0x0000000073FA0000-0x000000007402D000-memory.dmp
memory/1732-18-0x00000000023E0000-0x0000000002565000-memory.dmp
memory/1732-17-0x0000000074030000-0x00000000741B5000-memory.dmp
memory/1732-16-0x00000000741C0000-0x00000000741DE000-memory.dmp
memory/1732-15-0x00000000741E0000-0x0000000074202000-memory.dmp
memory/1732-14-0x0000000074210000-0x000000007431B000-memory.dmp
memory/1732-13-0x0000000074340000-0x000000007434D000-memory.dmp
memory/1732-12-0x0000000074320000-0x000000007433A000-memory.dmp
memory/1732-11-0x0000000074350000-0x00000000743EC000-memory.dmp
memory/1732-10-0x00000000743F0000-0x0000000074422000-memory.dmp
memory/1732-7-0x00000000744D0000-0x00000000744FA000-memory.dmp
memory/1732-6-0x0000000074510000-0x0000000074525000-memory.dmp
memory/1732-5-0x0000000074550000-0x00000000745AF000-memory.dmp
memory/1732-4-0x00000000745D0000-0x00000000746DA000-memory.dmp
memory/1732-27-0x00000000749D0000-0x0000000074AA7000-memory.dmp
memory/1732-53-0x0000000074030000-0x00000000741B5000-memory.dmp
memory/1732-52-0x0000000074510000-0x0000000074525000-memory.dmp
memory/1732-51-0x0000000074550000-0x00000000745AF000-memory.dmp
memory/1732-50-0x00000000746E0000-0x0000000074731000-memory.dmp
memory/1732-26-0x0000000074AB0000-0x0000000074AC5000-memory.dmp
memory/1732-31-0x00000000745D0000-0x00000000746DA000-memory.dmp
memory/1732-29-0x0000000074740000-0x0000000074875000-memory.dmp