6bb0480244c72e7be8bf8eeebdb2848a2dc2175798dc36fa76ce7d8ec3ceeb9f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 17:10

Target

416f941254a9afd8b24bce671211796b.exe
Size

48KB
MD5

416f941254a9afd8b24bce671211796b
SHA1

e48cb8462f3b859e12dd0dd7d78a020fe8291f10
SHA256

6bb0480244c72e7be8bf8eeebdb2848a2dc2175798dc36fa76ce7d8ec3ceeb9f
SHA512

35504c093d5e166f6ecbde6edaa64dbe33783e65646ef84716acad8927aaff36d4f484baf1d664772c5dc23ac009faa72fd5a8a97d2bb0b669a54fc088066b7f
SSDEEP

768:0CyCqlZmQpDwaaWkK8Sn49KSwquPz0GQ+2hxVjtGFbECqPpD0e+hCrV:UCqlZmQpDwPAqwquPz0GQXhXjtgApD0w

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qqdll.dll	416f941254a9afd8b24bce671211796b.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{471E7641-6365-43FE-8464-37DEF8335FB0}	416f941254a9afd8b24bce671211796b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{471E7641-6365-43FE-8464-37DEF8335FB0}\	416f941254a9afd8b24bce671211796b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{471E7641-6365-43FE-8464-37DEF8335FB0}\InProcServer32	416f941254a9afd8b24bce671211796b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{471E7641-6365-43FE-8464-37DEF8335FB0}\InProcServer32\ = "C:\\Windows\\SysWow64\\qqdll.dll"	416f941254a9afd8b24bce671211796b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{471E7641-6365-43FE-8464-37DEF8335FB0}\InProcServer32\ThreadingModel = "Apartment"	416f941254a9afd8b24bce671211796b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4308	3312	416f941254a9afd8b24bce671211796b.exe	89
PID 3312 wrote to memory of 4308	3312	416f941254a9afd8b24bce671211796b.exe	89
PID 3312 wrote to memory of 4308	3312	416f941254a9afd8b24bce671211796b.exe	89

C:\Users\Admin\AppData\Local\Temp\416f941254a9afd8b24bce671211796b.exe
"C:\Users\Admin\AppData\Local\Temp\416f941254a9afd8b24bce671211796b.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c delself.bat
  2⤵
  PID:4308

C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
50B

MD5
3d0b1fdc0096b940185c54bb4901a260

SHA1
12bad2d211e4dc588d1cad5b882541e4ef379ce4

SHA256
27791204abe6b2dec48509bb4ffe7aca93c2c13ca26bfffc7710d4fe743d236c

SHA512
7278c756efbe2826a9225b29facb5e627d8f556d84e2698e349c6e1240490c090a2c1c161e8c0358bcbfc4bfa1866e10b1ddccea76358cd5d2a6d912926798e7

Download Submit
memory/3312-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download