d2dbebaf7d20189a83c281bbab6cce71b8eb7859c09b8b09b3ebb23740dca1bb

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 03:24

Target

unins000.exe
Size

657KB
MD5

723d1973489c4dcaedbde75b11267eff
SHA1

d77c11187796678d0d84a122bced8b6841eebf3b
SHA256

797149c2198a8f9807ecbae1c5a1fa092b519c5cc00428d4b19b09d8d6d41d20
SHA512

649f5b5d0b851e453c3a0933a2236f28e2bb8b368b158903a38d5425cde4b555b19f814a81f540f62760a269817a1d45439021dbaac5f2bc64b537ebb0b5d285
SSDEEP

12288:YkxzR0UkTrP/37YzHXA6hLDnQJMgNLKgDRB6K3Uhp7r0x94:3FR0UkTrP/37YzHXA6tbQ+8Tgp30x94

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1776	_iu14D2N.tmp

Executes dropped EXE 1 IoCs

pid	Process
1776	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1776	5076	unins000.exe	85
PID 5076 wrote to memory of 1776	5076	unins000.exe	85
PID 5076 wrote to memory of 1776	5076	unins000.exe	85

C:\Users\Admin\AppData\Local\Temp\unins000.exe
"C:\Users\Admin\AppData\Local\Temp\unins000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
  "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\unins000.exe" /FIRSTPHASEWND=$601BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1776

C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
657KB

MD5
723d1973489c4dcaedbde75b11267eff

SHA1
d77c11187796678d0d84a122bced8b6841eebf3b

SHA256
797149c2198a8f9807ecbae1c5a1fa092b519c5cc00428d4b19b09d8d6d41d20

SHA512
649f5b5d0b851e453c3a0933a2236f28e2bb8b368b158903a38d5425cde4b555b19f814a81f540f62760a269817a1d45439021dbaac5f2bc64b537ebb0b5d285

Download Submit
memory/1776-8-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1776-10-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1776-13-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5076-0-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/5076-9-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download