d1af210da33a983119b6097fa9de93da84ecb99843d454d740da81a8c5b059e4

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 14:48

Target

TotalUninstall.exe
Size

24.3MB
MD5

137e1a9af35d19b9423b7ced2f2932eb
SHA1

1cd52492f4be0a05e8b732daca4fe963b881d137
SHA256

d1af210da33a983119b6097fa9de93da84ecb99843d454d740da81a8c5b059e4
SHA512

80b988588525ad196b6b73a961eb43dd5953c5d8c901b6f1608551751310c626270b4775435b1ca64563d0c7a4688fa627b21298bb2a7b44a6fbb24b042ffec2
SSDEEP

393216:gMBXpfk2VHAMepuu8BzGmwZoF67oR+vC4YNboo8YcU9CRZsZPGi4A:gMB5HVgMhu8NwZA6xvqoCyS+dA

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
2012	TotalUninstall.tmp

Loads dropped DLL 1 IoCs

pid	Process
1952	TotalUninstall.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	TotalUninstall.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2012	1952	TotalUninstall.exe	28
PID 1952 wrote to memory of 2012	1952	TotalUninstall.exe	28
PID 1952 wrote to memory of 2012	1952	TotalUninstall.exe	28
PID 1952 wrote to memory of 2012	1952	TotalUninstall.exe	28
PID 1952 wrote to memory of 2012	1952	TotalUninstall.exe	28
PID 1952 wrote to memory of 2012	1952	TotalUninstall.exe	28
PID 1952 wrote to memory of 2012	1952	TotalUninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\is-D2B9N.tmp\TotalUninstall.tmp

Filesize
3.1MB

MD5
ee94992b828c1a747d8b89a22b011ee8

SHA1
91591eb199ab99e17d34a287c5344a6584f9d952

SHA256
63ea0a64b2b5a61a696f74ecb6faf7547a5c8bec399810ab1bc3a6055471650d

SHA512
b3139cb9577203b4767da3c3d081125974a45704a841ce5bbc5ecf678ed0e3629d61d7239bafa3847b4d7adfc2f545db4aa5dea53d33596e20737e20dc0c9310

Download Submit
\Users\Admin\AppData\Local\Temp\is-D2B9N.tmp\TotalUninstall.tmp

Filesize
3.1MB

MD5
ee94992b828c1a747d8b89a22b011ee8

SHA1
91591eb199ab99e17d34a287c5344a6584f9d952

SHA256
63ea0a64b2b5a61a696f74ecb6faf7547a5c8bec399810ab1bc3a6055471650d

SHA512
b3139cb9577203b4767da3c3d081125974a45704a841ce5bbc5ecf678ed0e3629d61d7239bafa3847b4d7adfc2f545db4aa5dea53d33596e20737e20dc0c9310

Download Submit
memory/1952-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1952-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2012-61-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2012-64-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/2012-65-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download