27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:47

Target

$R2/WOL/unins000.exe
Size

74KB
MD5

a73b4c19a233181cd4cf0b9b8b3f7fbf
SHA1

3fc1038bb5c538d5167234817c868d6f7a7785e0
SHA256

b2c14524f74de7831b3246313485e4debecbd235647791a025653720bef850b6
SHA512

29d54ca315bf4fe91c4522a6244c0cd6a98046c74c8af1a3d8f5675f188cd58f5ce030d1ac3bfae4b3726c546d39ad164b28bb9e8bcd4dce7a696625b0ec64ef
SSDEEP

1536:HCfqNGLKnp5U+V7Chv3/2GQRGVtzdLQs68/G/OdMeK2R9:HGL2z5Chv/8GVtW8/G/OdM3U

Score

7^/10

Deletes itself 1 IoCs

pid	Process
716	_iu14D2N.tmp

Executes dropped EXE 1 IoCs

pid	Process
716	_iu14D2N.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 716	1788	unins000.exe	84
PID 1788 wrote to memory of 716	1788	unins000.exe	84
PID 1788 wrote to memory of 716	1788	unins000.exe	84

C:\Users\Admin\AppData\Local\Temp\$R2\WOL\unins000.exe
"C:\Users\Admin\AppData\Local\Temp\$R2\WOL\unins000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
  C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp /EUFT32A C:\Users\Admin\AppData\Local\Temp\$R2\WOL\unins000.exe $60066
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:716

C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp

Filesize
74KB

MD5
a73b4c19a233181cd4cf0b9b8b3f7fbf

SHA1
3fc1038bb5c538d5167234817c868d6f7a7785e0

SHA256
b2c14524f74de7831b3246313485e4debecbd235647791a025653720bef850b6

SHA512
29d54ca315bf4fe91c4522a6244c0cd6a98046c74c8af1a3d8f5675f188cd58f5ce030d1ac3bfae4b3726c546d39ad164b28bb9e8bcd4dce7a696625b0ec64ef

Download Submit
memory/716-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/716-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1788-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download