999509b401f64cacee1723cdb375e221566285daeeac8e83ed8720b763c16431

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 20:45

Target

Uninstall Wheel of Fortune.exe
Size

59KB
MD5

7af6402044280736d1d47b6939159b47
SHA1

9ddb8c2f5349d37a2e1bfe8398aee60f7341a1db
SHA256

c20681e888f3489b87b4602050f236125900114b50aadfe34d5c84c44ba38289
SHA512

da13e301f6a046f938e5b3c706e7769be3964ad47640b368b0b538d4be60fc4325901f5ec3d193bfacd53c54f71000ebb3e12679708fdfe6f50ff0515a6419c1
SSDEEP

1536:0G0Db1wJdBREzA01xVubM8JMLeAyBdgsgmimq7:oDb1wHBe6bM8JgeA4CsI7

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
512	A~NSISu_.exe

Loads dropped DLL 3 IoCs

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral18/files/0x000a00000002351a-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 512	2568	Uninstall Wheel of Fortune.exe	88
PID 2568 wrote to memory of 512	2568	Uninstall Wheel of Fortune.exe	88
PID 2568 wrote to memory of 512	2568	Uninstall Wheel of Fortune.exe	88

C:\Users\Admin\AppData\Local\Temp\Uninstall Wheel of Fortune.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall Wheel of Fortune.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
1⤵
PID:3884

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
59KB

MD5
7af6402044280736d1d47b6939159b47

SHA1
9ddb8c2f5349d37a2e1bfe8398aee60f7341a1db

SHA256
c20681e888f3489b87b4602050f236125900114b50aadfe34d5c84c44ba38289

SHA512
da13e301f6a046f938e5b3c706e7769be3964ad47640b368b0b538d4be60fc4325901f5ec3d193bfacd53c54f71000ebb3e12679708fdfe6f50ff0515a6419c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxFDCA.tmp\UserInfo.dll

Filesize
4KB

MD5
419d642fe3436fda8bb22eea9c37a6ca

SHA1
c1644131b880c6e03f14de3c79efd27093a77908

SHA256
25c4f65b02eca4ad897d7a623b3ca1290bac836e98ab5ee5f6c527dfb6a41dd7

SHA512
29df088e3b5189efd6fbeebc2f23c5850303d40fe5331cd336bb852d986f9ab66f7bcd963ebf8c4e4eea7d49a6590027490d651a3e4781024c7983a2c456a337

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxFDCA.tmp\spd.dll

Filesize
4KB

MD5
8bb77ed61759966728b7cb065e0081ee

SHA1
b2f1407daf21b301abea7a20cdb7fd181e3ff042

SHA256
ab5496eef3b68e865ef79bca1a88813876589d7d63bc76808d6df38a88eaeb80

SHA512
419541ad425373dab928f00e60bf83b19d53268e6d151d467a13dfabdb7a6a179b93c3f51c7fce394b062d619fdfcac587e3c7110ce1582c9d5e7ef85ec4cdf3

Download Submit