Analysis date (UTC): 6 May 2020, 11:06Analysis environment: Windows 7 Pro, build 7601, x86

win32diskimager-1.0.0-install.exe

MD5:BE92E76BAABC97B3F093FF734DD3F75B
SHA1:0240442CC4592240F14A48500044311B43CA92E3
SHA256:A51C9FC75C9CAA44DF03502838F229A70D484963F54675C241799093A59D8874

Analysis result

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

  • Win32DiskImager.exe (PID: 3492)

Loads dropped or rewritten executable

  • Win32DiskImager.exe (PID: 3492)

SUSPICIOUS

Executable content was dropped or overwritten

  • win32diskimager-1.0.0-install.exe (PID: 3240)
  • win32diskimager-1.0.0-install.exe (PID: 2468)
  • win32diskimager-1.0.0-install.tmp (PID: 2404)

Reads Windows owner or organization settings

  • win32diskimager-1.0.0-install.tmp (PID: 2404)

Reads the Windows organization settings

  • win32diskimager-1.0.0-install.tmp (PID: 2404)

INFO

Application was dropped or rewritten from another process

  • win32diskimager-1.0.0-install.tmp (PID: 2404)
  • win32diskimager-1.0.0-install.tmp (PID: 2156)

Creates a software uninstall entry

  • win32diskimager-1.0.0-install.tmp (PID: 2404)

Creates files in the program directory

  • win32diskimager-1.0.0-install.tmp (PID: 2404)

Threats

No threats detected

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN