6c4c636ca68edd549a5363e304952b1f280fc5a8db585eb9cd508d8123732f30

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:19

Target

ipchanger/UNinstaller.exe
Size

36KB
MD5

dc463e371abdeffa42cf739fccd7591b
SHA1

c480ba1a718d098cb0dadb4b2246046f9214bb65
SHA256

60ed463eee94e14774b010dbe38aaeee3c301be8b9473f740b1693324667e10b
SHA512

71d085d2782f6b7d3b62f67b8e11d9bf805c0043534fb7e3987cba800dfea80d8ddaf5e107e606c5299e89fd1ab863b7183bf9b473df9fcea7c355122aac5a31
SSDEEP

384:FsUi0Z4F7OlXVCnhwv/jYnC9oWb3eOaq9/21UWU2B22CDw423ogFqi0Z:Fti7tnUEo21UvykB5xi

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1724	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	UNinstaller.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1724	1736	UNinstaller.exe	28
PID 1736 wrote to memory of 1724	1736	UNinstaller.exe	28
PID 1736 wrote to memory of 1724	1736	UNinstaller.exe	28
PID 1736 wrote to memory of 1724	1736	UNinstaller.exe	28
PID 1736 wrote to memory of 1724	1736	UNinstaller.exe	28
PID 1736 wrote to memory of 1724	1736	UNinstaller.exe	28
PID 1736 wrote to memory of 1724	1736	UNinstaller.exe	28

C:\Users\Admin\AppData\Local\Temp\ipchanger\UNinstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ipchanger\UNinstaller.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ipchanger\..\unin.bat
  2⤵
  - Deletes itself
  PID:1724

C:\Users\Admin\AppData\Local\Temp\ipchanger\update.dat

Filesize
8B

MD5
3b87ec39aa547ba628a97a292be0e265

SHA1
05974c76ecf814db0e933059a586eb55c8c72b04

SHA256
1d9aa0bb597213228d3e0fb0ec25f043f266efb214ef1d8d9776f220e82ed610

SHA512
1dc97db24b2358fd4309697e012b96cde0bc0d92b7784d72da4ee711d93b727548ca05b8876f34f79bae080830ac9e667dd10c17509504ba6fe04ac49087780f

Download Submit
C:\Users\Admin\AppData\Local\Temp\unin.bat

Filesize
306B

MD5
aba390a3d572fb36dc8750aa3cca774a

SHA1
b3c818f7a7498a6b0971b1e8fdbd6d4b97c41e77

SHA256
a0dbebdf081c33fe3a71871500c0cdeac3c175d65ecb10469110bd93d76b42b0

SHA512
1b45dcff535918600b0421cc1a5e8830c7f8baef07d90fa286ae4e131db195016f23f292e580288b96f325c3816e56c3eb90b91877270b4f1496dce997075377

Download Submit