3c72f2851f20fee1e57a73226a2d4a54d88f55fbcaa817bac22eaf01cb79c8de | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 08:55

Sharing

Report Analysis Logs

General

Target

uninst.exe
Size

64KB
MD5

d9ede82a6ff2ebd2fe6681dfe6a9d3d9
SHA1

3213e91ea6ffc5fcc2a404639aa5ed5120d1f68e
SHA256

f97e623846f8f276f469772ca58d0c03a536e69b25f19207d6d06b556aaed506
SHA512

b67c9af19cbdf1f65c6db8e9fe294e8a11ce1a606c4e5eff91375b1fb4d898ce0b5e064edf5c817e75b33a8aadbb9ac34f7553d99c437bb8ccf113464d2f441e
SSDEEP

1536:OWbXhuGWZzJkAKqQxenkJnuQcREYRNtuUBXn:OkxuGW5Jk33xenkJnrq3Rn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3620	Au_.exe

NSIS installer 1 IoCs

resource	yara_rule
behavioral32/files/0x000700000002348b-4.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 3620	1400	uninst.exe	84
PID 1400 wrote to memory of 3620	1400	uninst.exe	84
PID 1400 wrote to memory of 3620	1400	uninst.exe	84

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
64KB

MD5
d9ede82a6ff2ebd2fe6681dfe6a9d3d9

SHA1
3213e91ea6ffc5fcc2a404639aa5ed5120d1f68e

SHA256
f97e623846f8f276f469772ca58d0c03a536e69b25f19207d6d06b556aaed506

SHA512
b67c9af19cbdf1f65c6db8e9fe294e8a11ce1a606c4e5eff91375b1fb4d898ce0b5e064edf5c817e75b33a8aadbb9ac34f7553d99c437bb8ccf113464d2f441e

Download Submit