e86ddd63bce81ceda1e30756ea9cea3cd87fb7fb9f6870992fdae4240346fe20

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 17:23

Target

Uninstall.exe
Size

66KB
MD5

8c9c858c5ef65e51dbb0a6015ccec5d6
SHA1

24d393aa5b7a73f1489299c2742077b9ea2ef926
SHA256

8e204d03863548bb96c3c96d6193eba8c2d3e6696326e83a6712c8b8cbc0d716
SHA512

56fa8a68b4208469b913a602a305f9560007f30b39410aa6f39b562a39f0b88be68445361e5ee3a6c5c2871a32a9b00e20c0cbf66d2391aea26071e255ac41d3
SSDEEP

1536:ue0DnjRrJav2FnUIRr2vMYBJvqAELVigvHhn1bi+v/5Qmdm:yD11a8YBJSAI0Q1bmOm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3900	A~NSISu_.exe

Loads dropped DLL 1 IoCs

pid	Process
3900	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral14/files/0x000400000001e9a0-3.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 3900	3304	Uninstall.exe	89
PID 3304 wrote to memory of 3900	3304	Uninstall.exe	89
PID 3304 wrote to memory of 3900	3304	Uninstall.exe	89

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3900

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
66KB

MD5
8c9c858c5ef65e51dbb0a6015ccec5d6

SHA1
24d393aa5b7a73f1489299c2742077b9ea2ef926

SHA256
8e204d03863548bb96c3c96d6193eba8c2d3e6696326e83a6712c8b8cbc0d716

SHA512
56fa8a68b4208469b913a602a305f9560007f30b39410aa6f39b562a39f0b88be68445361e5ee3a6c5c2871a32a9b00e20c0cbf66d2391aea26071e255ac41d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3598.tmp\InstallOptions.dll

Filesize
12KB

MD5
4c7d97d0786ff08b20d0e8315b5fc3cb

SHA1
bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

SHA256
75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

SHA512
f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst3598.tmp\ioSpecial.ini

Filesize
610B

MD5
3d13e03f69ec7893c721653338215555

SHA1
4084ffe5b5e71b60055c2b94347ffa041e4acb22

SHA256
c38d84afe1703b709d51c799e1cdf59bc6db6bc747ef1ed880cb75f519f072af

SHA512
0f4cf61b6d0cde2e54ea0abe947fe5398f9422c2a4b0f1b0ce1a1a7990d3033a812e73a4c3b01a28670d5c79985ab73e55f2f5a510f579f35f8dfe9623342fe7

Download Submit