f9f008971d38daf8c85a8846cf3b64904c9610862a53da6e75b57445c5df4577

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 16:00

Target

Uninstall.exe
Size

49KB
MD5

3652d1440fe944ebd36d5bbaec441554
SHA1

a1bbfd2390b0ffed8e9f8072bb4042c0bf26e4e7
SHA256

69a9640b4d92e7d93d1d532a38576df20cd0b899c4a27fd132cc45d67f04c38d
SHA512

fb90ca313e5e07f4612099c386b82368e7909b1f6065f96d6e8386345484d2a2dba48b563058fd668374ab627720156b684c0cd0c5e6427f0089740060e8c17a
SSDEEP

768:Mw0D3T2XQW0dcyngqR8lWFYCPMfjABHD2tAJb5PAAIYHLLE8J3+eJRn5Am6kRRJt:Mw0DsT0zikYCPMUxDRbw8JuqAELVigB7

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3028	A~NSISu_.exe

Loads dropped DLL 4 IoCs

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral5/files/0x000700000001208c-2.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	A~NSISu_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3028	1056	Uninstall.exe	28
PID 1056 wrote to memory of 3028	1056	Uninstall.exe	28
PID 1056 wrote to memory of 3028	1056	Uninstall.exe	28
PID 1056 wrote to memory of 3028	1056	Uninstall.exe	28
PID 1056 wrote to memory of 3028	1056	Uninstall.exe	28
PID 1056 wrote to memory of 3028	1056	Uninstall.exe	28
PID 1056 wrote to memory of 3028	1056	Uninstall.exe	28

\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
49KB

MD5
3652d1440fe944ebd36d5bbaec441554

SHA1
a1bbfd2390b0ffed8e9f8072bb4042c0bf26e4e7

SHA256
69a9640b4d92e7d93d1d532a38576df20cd0b899c4a27fd132cc45d67f04c38d

SHA512
fb90ca313e5e07f4612099c386b82368e7909b1f6065f96d6e8386345484d2a2dba48b563058fd668374ab627720156b684c0cd0c5e6427f0089740060e8c17a

Download Submit