a3e51f3f31af3d422450240974800b2701f54befdc20ecbd172de9b98cb75992

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 09:16

Target

Uninstall.exe
Size

66KB
MD5

8529342769763f4dc43930459127696e
SHA1

ffef92cd2c083642a52e94eaed09edf2b46d7653
SHA256

ce3d137c9c5613976fec4cdc8d151cddeb2902c2ce27672528ec8923ad5950f7
SHA512

b1694a7d5673bec89fc36f072bb5f9e9bba0828ff1eb25bfb6411f93857d0168685b11a54dda10ae91b9e0435696c989a5f95d375f5784e0e2ac9bba8b8f3095
SSDEEP

1536:9te0DnjRrJav2FnUIRr2vMYBJvqAELVigvdvOjVUc+v/5Qmdm:9PD11a8YBJSAI0kvOxOm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3576	A~NSISu_.exe

Loads dropped DLL 1 IoCs

pid	Process
3576	A~NSISu_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral14/files/0x000a000000023490-3.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3576	1508	Uninstall.exe	85
PID 1508 wrote to memory of 3576	1508	Uninstall.exe	85
PID 1508 wrote to memory of 3576	1508	Uninstall.exe	85

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
  "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3576

C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

Filesize
66KB

MD5
8529342769763f4dc43930459127696e

SHA1
ffef92cd2c083642a52e94eaed09edf2b46d7653

SHA256
ce3d137c9c5613976fec4cdc8d151cddeb2902c2ce27672528ec8923ad5950f7

SHA512
b1694a7d5673bec89fc36f072bb5f9e9bba0828ff1eb25bfb6411f93857d0168685b11a54dda10ae91b9e0435696c989a5f95d375f5784e0e2ac9bba8b8f3095

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvE020.tmp\InstallOptions.dll

Filesize
12KB

MD5
4c7d97d0786ff08b20d0e8315b5fc3cb

SHA1
bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

SHA256
75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

SHA512
f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvE020.tmp\ioSpecial.ini

Filesize
592B

MD5
014a2f86717b2b3ae10cdf16cdd52012

SHA1
a8aad6f1cdd1af03405d99da101da6dd7f6254da

SHA256
a0b512548ff78e8a3c5e0ef08f116d07b7ace9e24a35813ba1df84d79dab353b

SHA512
95a7781e42dd8efe6e8fde1f64ce3064f5af82f69c54e317a87923c98fba9712ed93f40e0f167ba79de9c79d46df63d8e42dc6171d62e59bc7d9a26efd42060d

Download Submit