705ca223d40d6317757d6a636527d7fe987ac3cbf17497e57d2c0eb3ed21dc11

Analysis

max time kernel
193s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:01

Target

6cd643ddbc8ca3a74b20b3352cfdaedc.exe
Size

869KB
MD5

6cd643ddbc8ca3a74b20b3352cfdaedc
SHA1

d4c25a362d926f18143f545d27493498044aae04
SHA256

705ca223d40d6317757d6a636527d7fe987ac3cbf17497e57d2c0eb3ed21dc11
SHA512

38e122df83765b5416618165085adfb75ee53c80dbdc54c92372ddb4781eee729507a10709777ec9c5cf5b235c63def07ffd24516f46d2750b0e88d1a54a7896
SSDEEP

12288:dk+vceJ2HfgG+26geCaZmS1Q++eur3dZfvHJ5cQlxHLRpFFoc2TRC9YdTZM2aktx:hvzeg7RWagsP+e4nwKrRp3M090TOWL

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wc98pp.dll	6cd643ddbc8ca3a74b20b3352cfdaedc.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp	6cd643ddbc8ca3a74b20b3352cfdaedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp\CLSID = "{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}"	6cd643ddbc8ca3a74b20b3352cfdaedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}	6cd643ddbc8ca3a74b20b3352cfdaedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32	6cd643ddbc8ca3a74b20b3352cfdaedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ = "C:\\Windows\\wc98pp.dll"	6cd643ddbc8ca3a74b20b3352cfdaedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ThreadingModel = "Apartment"	6cd643ddbc8ca3a74b20b3352cfdaedc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	6cd643ddbc8ca3a74b20b3352cfdaedc.exe
2212	6cd643ddbc8ca3a74b20b3352cfdaedc.exe

memory/2212-0-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2212-1-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2212-3-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/2212-4-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2212-5-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download