f9f008971d38daf8c85a8846cf3b64904c9610862a53da6e75b57445c5df4577

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 16:00

Target

Uninstall.exe
Size

49KB
MD5

3652d1440fe944ebd36d5bbaec441554
SHA1

a1bbfd2390b0ffed8e9f8072bb4042c0bf26e4e7
SHA256

69a9640b4d92e7d93d1d532a38576df20cd0b899c4a27fd132cc45d67f04c38d
SHA512

fb90ca313e5e07f4612099c386b82368e7909b1f6065f96d6e8386345484d2a2dba48b563058fd668374ab627720156b684c0cd0c5e6427f0089740060e8c17a
SSDEEP

768:Mw0D3T2XQW0dcyngqR8lWFYCPMfjABHD2tAJb5PAAIYHLLE8J3+eJRn5Am6kRRJt:Mw0DsT0zikYCPMUxDRbw8JuqAELVigB7

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1540	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral6/files/0x000b0000000232ea-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 1540	3232	Uninstall.exe	97
PID 3232 wrote to memory of 1540	3232	Uninstall.exe	97
PID 3232 wrote to memory of 1540	3232	Uninstall.exe	97

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
1⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
49KB

MD5
3652d1440fe944ebd36d5bbaec441554

SHA1
a1bbfd2390b0ffed8e9f8072bb4042c0bf26e4e7

SHA256
69a9640b4d92e7d93d1d532a38576df20cd0b899c4a27fd132cc45d67f04c38d

SHA512
fb90ca313e5e07f4612099c386b82368e7909b1f6065f96d6e8386345484d2a2dba48b563058fd668374ab627720156b684c0cd0c5e6427f0089740060e8c17a

Download Submit