e86ddd63bce81ceda1e30756ea9cea3cd87fb7fb9f6870992fdae4240346fe20

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 17:23

Target

Uninstall.exe
Size

66KB
MD5

8c9c858c5ef65e51dbb0a6015ccec5d6
SHA1

24d393aa5b7a73f1489299c2742077b9ea2ef926
SHA256

8e204d03863548bb96c3c96d6193eba8c2d3e6696326e83a6712c8b8cbc0d716
SHA512

56fa8a68b4208469b913a602a305f9560007f30b39410aa6f39b562a39f0b88be68445361e5ee3a6c5c2871a32a9b00e20c0cbf66d2391aea26071e255ac41d3
SSDEEP

1536:ue0DnjRrJav2FnUIRr2vMYBJvqAELVigvHhn1bi+v/5Qmdm:yD11a8YBJSAI0Q1bmOm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2212	A~NSISu_.exe

Loads dropped DLL 5 IoCs

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral13/files/0x000d000000012320-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2212	A~NSISu_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2212	2204	Uninstall.exe	28
PID 2204 wrote to memory of 2212	2204	Uninstall.exe	28
PID 2204 wrote to memory of 2212	2204	Uninstall.exe	28
PID 2204 wrote to memory of 2212	2204	Uninstall.exe	28
PID 2204 wrote to memory of 2212	2204	Uninstall.exe	28
PID 2204 wrote to memory of 2212	2204	Uninstall.exe	28
PID 2204 wrote to memory of 2212	2204	Uninstall.exe	28

C:\Users\Admin\AppData\Local\Temp\nstF3E.tmp\ioSpecial.ini

Filesize
609B

MD5
9ff1f09f0eb05ba31da38fdaa8b8f47b

SHA1
7b977ff07f5ec85c45e5b2b498670878f4d79718

SHA256
871b4425e10af688abfbbdedbf9dcd2399314f33a4b255ac9332f21618d0cd7f

SHA512
c1d3c983db757dc53bf73e93dfc9f35adf28304d2d47a4eaefbc2d0a7f5f8ca331d9d9173e3a9cb643323360cb56f824b928eac4b2ecf640dc26d74b1968f111

Download Submit
\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
66KB

MD5
8c9c858c5ef65e51dbb0a6015ccec5d6

SHA1
24d393aa5b7a73f1489299c2742077b9ea2ef926

SHA256
8e204d03863548bb96c3c96d6193eba8c2d3e6696326e83a6712c8b8cbc0d716

SHA512
56fa8a68b4208469b913a602a305f9560007f30b39410aa6f39b562a39f0b88be68445361e5ee3a6c5c2871a32a9b00e20c0cbf66d2391aea26071e255ac41d3

Download Submit
\Users\Admin\AppData\Local\Temp\nstF3E.tmp\InstallOptions.dll

Filesize
12KB

MD5
4c7d97d0786ff08b20d0e8315b5fc3cb

SHA1
bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

SHA256
75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

SHA512
f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

Download Submit