Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 5, 2021, 10:48 a.m.	April 5, 2021, 10:50 a.m.

Size	381.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`6f3d820ee9c069a6710e743d53a9bb25`
SHA256	`b78b0aee4e5c072ea24d4d9d8e89c8990076fbe96ef353950b7006ea50eabfac`
CRC32	`275E4A42`
ssdeep	`6144:x16vYH/guLTgQb1oFtIaJmGDtDplcJqiD4IU2fQ/TxH9ztrHayYm:j6vYouLTgQ5oFt/hRDfkL1U2Y/Txdztn`
PDB Path	paragraph.pdbVillagesdinghgaragraph#@db
Yara	win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\qs73wd.rar.dll,Columnspot
2220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\qs73wd.rar.dll,Groundhuman
2444
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\qs73wd.rar.dll,Hotelement
2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\qs73wd.rar.dll,Wheredesert
1204
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\qs73wd.rar.dll,
2672

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

paragraph.pdbVillagesdinghgaragraph#@db

One or more processes crashed (50 out of 140 events)

Time & API	Arguments	Status
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308088 registers.edi: 4991704 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 10291152 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 10291168 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 10291184 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 10291200 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 10291216 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 10291232 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 10291248 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 10291264 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 10291280 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 10291296 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10291312 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 10291328 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 10291344 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 10291360 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 10291376 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308064 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 10291392 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: DllRegisterServer+0xcbc7 qs73wd+0x16937 @ 0x73cc6937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1307256 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 1308332 registers.edx: 23 registers.ebx: 1308348 registers.esi: 23 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308316 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 10294632 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 10294656 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 10294680 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 10294704 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 10294728 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 10294752 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 10294776 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 10294800 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 10294824 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 10294848 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 10294872 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 10294896 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 10294920 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 10294944 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 10294968 registers.ecx: 0	1
__exception__ April 5, 2021, 10:49 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1308292 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 10294992 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503280 registers.edi: 4205288 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 9439184 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 9439200 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 9439216 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 9439232 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 9439248 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 9439264 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 9439280 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 9439296 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 9439312 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 9439328 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9439344 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 9439360 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 9439376 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 5, 2021, 10:50 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec qs73wd+0x1105c exception.address: 0x73cc105c registers.esp: 1503256 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 9439392 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 5, 2021, 10:48 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d10000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 2220 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 2220 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 2220 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 5, 2021, 10:48 a.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d10000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2444 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 5, 2021, 10:48 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d10000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:50 a.m.	process_identifier: 2240 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 5, 2021, 10:48 a.m.	process_identifier: 1204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 1204 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d10000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 1204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 1204 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 5, 2021, 10:49 a.m.	process_identifier: 1204 region_size: 532480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003f600', u'virtual_address': u'0x00001000', u'entropy': 6.832597975222296, u'name': u'.text', u'virtual_size': u'0x0003f474'}

entropy

6.83259797522

description

A section with a high entropy has been found

entropy

0.666228646518

description

Overall entropy of this PE file is high

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Trojan.GenericKD.36617878
FireEye	Generic.mg.6f3d820ee9c069a6
ALYac	Trojan.GenericKD.36617878
Sangfor	Trojan.Win32.Wacatac.B
K7GW	Trojan ( 0057a0ae1 )
K7AntiVirus	Trojan ( 0057a0ae1 )
Arcabit	Trojan.Generic.D22EBE96
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HKFQ
Avast	Win32:Trojan-gen
BitDefender	Trojan.GenericKD.36617878
Ad-Aware	Trojan.GenericKD.36617878
Sophos	Mal/Generic-S
Comodo	Malware@#2mx9uo1pq50dx
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	RDN/Dridex
Emsisoft	Trojan.Crypt (A)
APEX	Malicious
Webroot	W32.Malware.Gen
Avira	TR/AD.Dridex.svrqf
MAX	malware (ai score=82)
Gridinsoft	Trojan.Win32.Agent.oa
Microsoft	Trojan:Win32/Wacatac.B!ml
AegisLab	Trojan.Win32.Generic.4!c
GData	Trojan.GenericKD.36617878
Cynet	Malicious (score: 100)
McAfee	RDN/Dridex
Malwarebytes	Trojan.Dridex
Ikarus	Trojan-Banker.Dridex
Rising	Malware.Undefined!8.C (CLOUD)
Yandex	Trojan.AD!x4KXGVpiNjY
Fortinet	W32/Generik.GMXBOUE!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A

qs73wd.rar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All