bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897

Analysis

max time kernel
155s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:19

Target

bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
Size

173KB
MD5

af00299bf00dce2fe6dc4e1905fbfde1
SHA1

660f4f8fbeccda255fd261ee438941ba830da273
SHA256

bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897
SHA512

8a649a9e9e8bac3c88f76ce19e9d69bc563f2574063594eaddcabc4269ba8a89f5592a84d0d24a78821aed55d947eb2bb02d345d89e0637deaa9bbe1e5feccb6
SSDEEP

3072:wXLyy4bRXNujFqRlWRkNpZHPImtS5Es2K9Tbw9yDxh1OwMIP6LlcHD:kHI6qRlsk7BPXS5Es2ATbwifZNPulcHD

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	BC4693~1.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	BC4693~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	BC4693~1.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4160	4052	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe	83
PID 4052 wrote to memory of 4160	4052	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe	83
PID 4052 wrote to memory of 4160	4052	bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe	83

C:\Users\Admin\AppData\Local\Temp\bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
"C:\Users\Admin\AppData\Local\Temp\bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe"
1⤵
- Modifies registry class
PID:3616

C:\Users\Admin\AppData\Local\Temp\bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
C:\Users\Admin\AppData\Local\Temp\bc46936a4ea1c2c8d11553d92bdf4e3c5454cff4b02b7c786ce30a6105452897.exe
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\BC4693~1.EXE
  C:\Users\Admin\AppData\Local\Temp\BC4693~1.EXE
  2⤵
  - Modifies registry class
  PID:4160

memory/3616-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3616-134-0x00000000021D0000-0x0000000002200000-memory.dmp

Filesize
192KB

Download
memory/3616-135-0x00000000023D0000-0x00000000023D4000-memory.dmp

Filesize
16KB

Download
memory/3616-140-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4052-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4052-137-0x00000000005C0000-0x00000000005F0000-memory.dmp

Filesize
192KB

Download
memory/4052-141-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4052-142-0x00000000005C0000-0x00000000005F0000-memory.dmp

Filesize
192KB

Download
memory/4160-138-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4160-139-0x0000000000680000-0x00000000006B0000-memory.dmp

Filesize
192KB

Download