fd8b2fb37d0f146fef98dd7b6079fe40a4e04879e247f4a37ef12443ccf6c2b3

Analysis

max time kernel
129s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 14:00

Target

RevoUninstaller_Portable/RevoUPort.exe
Size

200KB
MD5

2f814a927d097a09911111dbf0fc2e93
SHA1

8e4e953c60653a333182320345209765695d4e17
SHA256

ef70640d701bf406f7008c9ef7dc594019c063e4436415c97033f0a998697edf
SHA512

d57fa5fdd2ce0ed148e43814420103e0e340862d6a9c35714ede6fa059dad0b63963b790824cbc126535b97c23f2fd560eb0891050fc0f3996a30c7ee8e99619
SSDEEP

3072:0kLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8Th:3LAoYZCIn9SzsFwWqh

Score

1^/10

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

RevoUn.exe

pid process

1904 RevoUn.exe
1904 RevoUn.exe
1904 RevoUn.exe
1904 RevoUn.exe
1904 RevoUn.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

RevoUn.exe

pid process

1904 RevoUn.exe
1904 RevoUn.exe
1904 RevoUn.exe
1904 RevoUn.exe
1904 RevoUn.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

RevoUn.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

RevoUPort.exe

description	pid	process	target process
PID 4740 wrote to memory of 1904	4740	RevoUPort.exe	RevoUn.exe
PID 4740 wrote to memory of 1904	4740	RevoUPort.exe	RevoUn.exe

C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\RevoUPort.exe
"C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\RevoUPort.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x64\RevoUn.exe
  C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\x64\RevoUn.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1904

C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini

Filesize
860B

MD5
be0a819279589bdadf841c1dea2553c3

SHA1
2e703cc9aa1a2f0c34c43020b9c21049e3fd02a5

SHA256
f963d0ccbcfab5fb945f73ebbfeab2c28724be1ee9807bf38e852af04b7a8aa5

SHA512
dd49e60930f956221937326a7d0e4143cf23a1dca114bf73c9faaa2145c4b0155c59201d34dfa1cb903a28eaff7e5538d5db7e5e89955671f57ef82b9ecaa729

Download Submit
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini

Filesize
918B

MD5
a4be5012b67b4d7875324e7d2b948f01

SHA1
aae204e78cd5f5964845ba609326d87560b8a3e9

SHA256
29dab589513dc4570b4c1dc0abdefe8d585d0ddc1e0778d3fc6216e1198c40ab

SHA512
1cef457c485cc656c6894e4191f93af2d34c79a75847109737875578760a892112fc941f441049965cd1f7db7e55cedaada4f675a7c9d681964dab65253f714c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RevoUninstaller_Portable\settings.ini

Filesize
998B

MD5
bcc89ffb1f8032d120f329e08d9ed49b

SHA1
399dad1f6b78ba114c1fa91ccf35eceb2465203a

SHA256
2ade7d99e0252db6c1fc8040fec0e301670729d3e074b17ef4d6b02448760bf1

SHA512
f970f97c5f71eeff24bd3241f57d315d977407b4d28e4791640d21a922363d2fc1979ea086791436deaf6422375465be700f34d081b2e7f0cc7eac5bd5206c8c

Download Submit