Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 16:07
General
- Target BleachBit-Portable/pangowin32-1.0-0.dll
- Size 35KB
- Sample261011-tkvhrabs7s
- SHA256 b0afea3f049a0b893f7771424f9c3f9554cb833a8fdb4fd23a51e2f40abe199d
Malware Config
Signatures
- UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\pangowin32-1.0-0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\pangowin32-1.0-0.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 14403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4520 -ip 45201⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4520-5-0x0000000074CF0000-0x0000000074CFB000-memory.dmp
memory/4520-10-0x0000000074990000-0x00000000749C2000-memory.dmp
memory/4520-14-0x0000000074AC0000-0x0000000074ACD000-memory.dmp
memory/4520-13-0x0000000074AD0000-0x0000000074AEA000-memory.dmp
memory/4520-12-0x0000000074C90000-0x0000000074CAE000-memory.dmp
memory/4520-11-0x0000000074F90000-0x00000000750C5000-memory.dmp
memory/4520-9-0x00000000749D0000-0x00000000749E4000-memory.dmp
memory/4520-17-0x0000000074970000-0x0000000074982000-memory.dmp
memory/4520-16-0x0000000074940000-0x0000000074969000-memory.dmp
memory/4520-15-0x0000000074A20000-0x0000000074AB6000-memory.dmp
memory/4520-8-0x00000000749F0000-0x0000000074A12000-memory.dmp
memory/4520-7-0x0000000074AF0000-0x0000000074B7D000-memory.dmp
memory/4520-6-0x0000000074B80000-0x0000000074C8B000-memory.dmp
memory/4520-4-0x0000000074DC0000-0x0000000074E1F000-memory.dmp
memory/4520-3-0x0000000074E20000-0x0000000074F2A000-memory.dmp
memory/4520-2-0x0000000074F30000-0x0000000074F81000-memory.dmp
memory/4520-1-0x00000000750D0000-0x0000000075255000-memory.dmp
memory/4520-0-0x0000000075470000-0x0000000075485000-memory.dmp
memory/4520-50-0x0000000074B80000-0x0000000074C8B000-memory.dmp
memory/4520-37-0x0000000074F30000-0x0000000074F81000-memory.dmp
memory/4520-51-0x0000000074F90000-0x00000000750C5000-memory.dmp
memory/4520-49-0x0000000074990000-0x00000000749C2000-memory.dmp
memory/4520-48-0x00000000749D0000-0x00000000749E4000-memory.dmp
memory/4520-47-0x00000000749F0000-0x0000000074A12000-memory.dmp
memory/4520-46-0x00000000750D0000-0x0000000075255000-memory.dmp
memory/4520-45-0x0000000074DC0000-0x0000000074E1F000-memory.dmp
memory/4520-44-0x0000000074E20000-0x0000000074F2A000-memory.dmp
memory/4520-43-0x0000000074AF0000-0x0000000074B7D000-memory.dmp
memory/4520-42-0x0000000074A20000-0x0000000074AB6000-memory.dmp
memory/4520-41-0x0000000074AC0000-0x0000000074ACD000-memory.dmp
memory/4520-40-0x0000000074CF0000-0x0000000074CFB000-memory.dmp
memory/4520-39-0x0000000074AD0000-0x0000000074AEA000-memory.dmp
memory/4520-38-0x0000000074C90000-0x0000000074CAE000-memory.dmp
memory/4520-36-0x0000000075470000-0x0000000075485000-memory.dmp