3c72f2851f20fee1e57a73226a2d4a54d88f55fbcaa817bac22eaf01cb79c8de

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 08:55

Target
uninst.exe
Size 64KB
Sample240713-kvncravarm
SHA256 f97e623846f8f276f469772ca58d0c03a536e69b25f19207d6d06b556aaed506
MD5 d9ede82a6ff2ebd2fe6681dfe6a9d3d9
SHA1 3213e91ea6ffc5fcc2a404639aa5ed5120d1f68e
SHA512 b67c9af19cbdf1f65c6db8e9fe294e8a11ce1a606c4e5eff91375b1fb4d898ce0b5e064edf5c817e75b33a8aadbb9ac34f7553d99c437bb8ccf113464d2f441e
SSDEEP 1536:OWbXhuGWZzJkAKqQxenkJnuQcREYRNtuUBXn:OkxuGW5Jk33xenkJnrq3Rn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3620	Au_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral32/files/0x000700000002348b-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 3620	1400	uninst.exe	84
PID 1400 wrote to memory of 3620	1400	uninst.exe	84
PID 1400 wrote to memory of 3620	1400	uninst.exe	84

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:3620

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 64KB
SHA256 f97e623846f8f276f469772ca58d0c03a536e69b25f19207d6d06b556aaed506
MD5 d9ede82a6ff2ebd2fe6681dfe6a9d3d9
SHA1 3213e91ea6ffc5fcc2a404639aa5ed5120d1f68e
SHA512 b67c9af19cbdf1f65c6db8e9fe294e8a11ce1a606c4e5eff91375b1fb4d898ce0b5e064edf5c817e75b33a8aadbb9ac34f7553d99c437bb8ccf113464d2f441e
SSDEEP 1536:OWbXhuGWZzJkAKqQxenkJnuQcREYRNtuUBXn:OkxuGW5Jk33xenkJnrq3Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download