Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 1, 2021, 9:18 a.m.	April 1, 2021, 9:25 a.m.

Size	377.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`c56e8818c410cb7a486558a6fad5253d`
SHA256	`a753919c21f44e8c69b4e4da1294fa1b00b839a81771338744ad49853d2524e1`
CRC32	`CF4B9265`
ssdeep	`6144:BCyziHGu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGqN+zT:EYiH06/iHlDx7YG7RTIZQFi5ppuT`
PDB Path	c:\Season\Wife_low\531\Quart\table.pdb
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero win_files_operation - Affect private profile IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g8k346sx.rar.dll,Huntroom
3324
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g8k346sx.rar.dll,Insectgot
3804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g8k346sx.rar.dll,Pushstretch
3872
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g8k346sx.rar.dll,Redsyllable
8956
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g8k346sx.rar.dll,
7236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\Season\Wife_low\531\Quart\table.pdb

One or more processes crashed (50 out of 140 events)

Time & API	Arguments	Status
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028268 registers.edi: 3287896 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 31786960 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 31786976 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 31786992 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 31787008 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 31787024 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 31787040 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 31787056 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 31787072 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 31787088 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 31787104 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 31787120 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 31787136 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 31787152 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 31787168 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 31787184 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028244 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 31787200 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: DllRegisterServer+0xcbc7 g8k346sx+0x16937 @ 0x73806937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2027448 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 2028512 registers.edx: 23 registers.ebx: 2028528 registers.esi: 23 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 31790440 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 31790464 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 31790488 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 31790512 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 31790536 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 31790560 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 31790584 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 31790608 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 31790632 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 31790656 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 31790680 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 31790704 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 31790728 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 31790752 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 31790776 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 2028472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 31790800 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307092 registers.edi: 4008808 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 4982736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 4982752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 4982768 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 4982784 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 4982800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 4982816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 4982832 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 4982848 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 4982864 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 4982880 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4982896 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 4982912 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 4982928 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 1, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g8k346sx+0x1105c exception.address: 0x7380105c registers.esp: 1307068 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 4982944 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73830000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7384f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3324 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73830000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7384f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3804 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73830000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7384f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 3872 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 8956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73830000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 8956 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7384f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 8956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 8956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 1, 2021, 9:18 a.m.	process_identifier: 8956 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003e800', u'virtual_address': u'0x00001000', u'entropy': 6.839137815190632, u'name': u'.text', u'virtual_size': u'0x0003e703'}

entropy

6.83913781519

description

A section with a high entropy has been found

entropy

0.664893617021

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	Artemis!C56E8818C410
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.c56e8818c410cb7a
APEX	Malicious
Webroot	W32.Trojan.Gen
Microsoft	Program:Win32/Wacapew.C!ml
VBA32	BScope.Trojan.Wacatac
Panda	Trj/dridex.A

g8k346sx.rar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All