Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 1, 2021, 9:18 a.m.	April 1, 2021, 9:23 a.m.

Size	381.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`d832d70f78937799ed08056442f04442`
SHA256	`52545ce7c36e648bc9d8e78cde413a0d2b7e45dc4084b28646191f73fe8a010f`
CRC32	`C94F2521`
ssdeep	`6144:I6vYH/guLTgcb1oFtIaJmGDtDplcJqiD4IU2fQ/TxHNDtrHayYm:I6vYouLTgc5oFt/hRDfkL1U2Y/TxtDtn`
PDB Path	paragraph.pdbVillagesdinghgaragraph#@db
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero win_files_operation - Affect private profile IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\tzrvcu.zip.dll,Columnspot
5620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\tzrvcu.zip.dll,Groundhuman
3588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\tzrvcu.zip.dll,Hotelement
4456
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\tzrvcu.zip.dll,Wheredesert
8780
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\tzrvcu.zip.dll,
4960

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

paragraph.pdbVillagesdinghgaragraph#@db

One or more processes crashed (50 out of 140 events)

Time & API	Arguments	Status
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946072 registers.edi: 5515992 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 34473936 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 34473952 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 34473968 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 34473984 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 34474000 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 34474016 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 34474032 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 34474048 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 34474064 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 34474080 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 34474096 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 34474112 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 34474128 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 34474144 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 34474160 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946048 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 34474176 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: DllRegisterServer+0xcbc7 tzrvcu+0x16937 @ 0x73806937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2945240 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 2946316 registers.edx: 23 registers.ebx: 2946332 registers.esi: 23 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946300 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 34477416 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 34477440 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 34477464 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 34477488 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 34477512 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 34477536 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 34477560 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 34477584 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 34477608 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 34477632 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 34477656 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 34477680 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 34477704 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 34477728 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 34477752 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 2946276 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 34477776 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650832 registers.edi: 3681000 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 8325072 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 8325088 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 8325104 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 8325120 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 8325136 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 8325152 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 8325168 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 8325184 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 8325200 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 8325216 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8325232 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 8325248 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 8325264 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec tzrvcu+0x1105c exception.address: 0x7380105c registers.esp: 650808 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 8325280 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 5620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73850000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 5620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 5620 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73850000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 3588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 3588 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 4456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 4456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73850000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 4456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 4456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 4456 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 8780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 8780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73850000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 8780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 8780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:19 a.m.	process_identifier: 8780 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Bkav	W32.AIDetect.malware2
FireEye	Generic.mg.d832d70f78937799
McAfee	Artemis!D832D70F7893
APEX	Malicious
McAfee-GW-Edition	Artemis!Trojan
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Ikarus	Trojan-Dropper.VBA.Agent

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003f600', u'virtual_address': u'0x00001000', u'entropy': 6.83259884910781, u'name': u'.text', u'virtual_size': u'0x0003f474'}

entropy

6.83259884911

description

A section with a high entropy has been found

entropy

0.666228646518

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

tzrvcu.zip

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All