6fa7e3114f77e419aae1c309d5970ec1a69a92d1858078d7d3a20a17921c7bf7

Analysis

max time kernel
91s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 03:44

Target

BedrockLauncher.Uninstaller.exe
Size

104KB
MD5

42770861ae1dde91a71f9d5df9368aee
SHA1

e127e977ebe622020ae483f9f543c2c72d889837
SHA256

6fa7e3114f77e419aae1c309d5970ec1a69a92d1858078d7d3a20a17921c7bf7
SHA512

4c1e8006e709d893628558d68258ac8e9b6f65199b492675dfd34ca0a13417991d71d91c330ce65c9f7068fa4470b91b8b5a9ed4be91a263856f8ddc5d4f8859
SSDEEP

384:0qQslJ2jMhjMhjMhjM0/////////////IN8bLHWtv/fvvvvvvvvvvsWBeCCCzVG:0qQsEjijijiju8/H1CCC5G8fs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	1876	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1876	BedrockLauncher.Uninstaller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	BedrockLauncher.Uninstaller.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 944	1876	BedrockLauncher.Uninstaller.exe	28
PID 1876 wrote to memory of 944	1876	BedrockLauncher.Uninstaller.exe	28
PID 1876 wrote to memory of 944	1876	BedrockLauncher.Uninstaller.exe	28

C:\Users\Admin\AppData\Local\Temp\BedrockLauncher.Uninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\BedrockLauncher.Uninstaller.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1876 -s 532
  2⤵
  - Program crash
  PID:944

memory/1876-54-0x000000013F460000-0x000000013F47E000-memory.dmp

Filesize
120KB

Download