f686f33c05d63eb019164da669495fbb53c181d4d39603d03018afd883a923e9

Analysis

max time kernel
41s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 22:34

Target

uninstall.exe
Size

39KB
MD5

32016c508d1250ba7f8c11b11a9fef68
SHA1

aec3ef43e9f69043e5d90beffe418473185fbbb2
SHA256

bec346b8267012f8235b093f2917a347833e44833fdfea241c640d77dd323414
SHA512

61e126c32c4817395776dd8bfbe29fbf5c30943cb73b8fe9690a8aa99c229e3c201f38940b6a91fa88eb876c13f844b0f452b1f7722fab692a7b75b6c216a225
SSDEEP

768:6G0D3L09yOJRZHR8Wm8REzAwtbTBu4VVhG5b5PIAIYHLLE8JlsTFqk9WBm:6G0Db1wJdBREzA01xVubM8Jlbk92m

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3652	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral20/files/0x000600000002326f-3.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3652	1848	uninstall.exe	81
PID 1848 wrote to memory of 3652	1848	uninstall.exe	81
PID 1848 wrote to memory of 3652	1848	uninstall.exe	81

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:3652

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
39KB

MD5
32016c508d1250ba7f8c11b11a9fef68

SHA1
aec3ef43e9f69043e5d90beffe418473185fbbb2

SHA256
bec346b8267012f8235b093f2917a347833e44833fdfea241c640d77dd323414

SHA512
61e126c32c4817395776dd8bfbe29fbf5c30943cb73b8fe9690a8aa99c229e3c201f38940b6a91fa88eb876c13f844b0f452b1f7722fab692a7b75b6c216a225

Download Submit