Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 18, 2021, 9:11 a.m.	May 18, 2021, 9:14 a.m.

Size	764.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`283398a30cd7505b780c113d1838fc40`
SHA256	`626817a2a306843c0c0e970d4c02c69d0eb62f304daf552b622158930a50709c`
CRC32	`F9636865`
ssdeep	`12288:vWM5dKYoaXExbYau0l4BaauBv+te08MX7nPH+lGr2jPYN9/M+:vWaK5xdJl4QnJ+teumlOegbM+`
PDB Path	c:\and\Spring\soil\throw_For\arm.pdb
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\lhtr7x1pv.zip.dll,Me
6240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\lhtr7x1pv.zip.dll,Specialgun
6988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\lhtr7x1pv.zip.dll,Spendbroke
7636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\lhtr7x1pv.zip.dll,
3388

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\and\Spring\soil\throw_For\arm.pdb

One or more processes crashed (50 out of 105 events)

Time & API	Arguments	Status
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913276 registers.edi: 4208592 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 35260368 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 35260384 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 35260400 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 35260416 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 35260432 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 35260448 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 35260464 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 35260480 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 35260496 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 35260512 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 35260528 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 35260544 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 35260560 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 35260576 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 35260592 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913252 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 35260608 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: DllRegisterServer+0xcbc7 lhtr7x1pv+0x16937 @ 0x64ab6937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 912456 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 913520 registers.edx: 23 registers.ebx: 913536 registers.esi: 23 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913504 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 35263848 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 35263872 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 35263896 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 35263920 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 35263944 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 35263968 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 35263992 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 35264016 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 35264040 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 35264064 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 35264088 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 35264112 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 35264136 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 35264160 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 35264184 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 913480 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 35264208 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880500 registers.edi: 6240232 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 33228752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 33228768 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 33228784 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 33228800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 33228816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 33228832 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 33228848 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 33228864 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 33228880 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 33228896 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 33228912 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 33228928 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 33228944 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ May 18, 2021, 9:12 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec lhtr7x1pv+0x1105c exception.address: 0x64ab105c registers.esp: 2880476 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 33228960 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 87 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65b6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72211000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66a91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e4c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74131000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x673a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:12 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x64b5e000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 18, 2021, 9:12 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 18, 2021, 9:12 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 18, 2021, 9:12 a.m.	process_identifier: 6240 region_size: 565248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65b6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72961000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72211000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66a91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e4c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74131000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 18, 2021, 9:11 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c1000 process_handle: 0xffffffff	1

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Elastic	malicious (high confidence)
Sangfor	Trojan.Win32.Save.a
APEX	Malicious
FireEye	Generic.mg.283398a30cd7505b
Sophos	ML/PE-A
Microsoft	Trojan:Win32/Sabsik.FT.A!ml
Cynet	Malicious (score: 100)
Rising	Malware.Heuristic!ET#76% (RDMK:cmRtazp7kV03960RQF68nPsz7WzF)

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

lhtr7x1pv.zip

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All