Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 3, 2021, 4:45 p.m.	Aug. 3, 2021, 4:47 p.m.

Size	1.9MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`ec44a1e0f5af1c4bd3f308ff1b3fc879`
SHA256	`b87c090e422e96f332bcfac4ef3dc52840e399f8026ad79a99239eecc4fe1703`
CRC32	`1834CFD4`
ssdeep	`24576:S9P1vJ9p4RaUzWcrw18SIyYHTjA40DWNX9MkJT2pKt/Rw0aGGZktZr:S9P1vJ9p4mcrw18ShYzMc7Rw0aWtZr`
Yara	Microsoft_Office_File_Zero - Microsoft Office File PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,?terminate@@YAXXZ
1524
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,
316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_XcptFilter
1640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,dllonexit
736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,
908
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,getmainargs
2220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,
532
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,set_app_type
2900
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,
768
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,setusermatherr
624
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_acmdln
1968
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_amsg_exit
1340
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_cexit
2904
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_commode
1884
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_configthreadlocale
1808
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_controlfp_s
2016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_crt_debugger_hook
2992
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_except_handler4_common
1628
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_exit
1512
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_fmode
2052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_initterm
888
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_initterm_e
2064
- explorer.exe explorer.exe "The Latest Updated Report Document.doc"
  3164
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_invoke_watson
2308
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_ismbblead
764
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_lock
3084
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_onexit
3200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,_unlock
3304
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,exit
3404
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,wcsncat_s
3496
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\MSVCR100.dll,
3592

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 3, 2021, 4:45 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (22 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 4:45 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 3, 2021, 4:45 p.m.		1	1	0

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Aug. 3, 2021, 4:45 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743077b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57 rundll32+0x393f @ 0xcd393f rundll32+0x24a7 @ 0xcd24a7 rundll32+0x12e8 @ 0xcd12e8 rundll32+0x1901 @ 0xcd1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73ec3f46 registers.esp: 1307160 registers.edi: 0 registers.eax: 1944862534 registers.ebp: 1307200 registers.edx: 0 registers.ebx: 0 registers.esi: 1944862534 registers.ecx: 7736680	1
__exception__ Aug. 3, 2021, 4:45 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743077b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57 rundll32+0x393f @ 0xcd393f rundll32+0x24a7 @ 0xcd24a7 rundll32+0x12e8 @ 0xcd12e8 rundll32+0x1901 @ 0xcd1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73ec3f46 registers.esp: 1307160 registers.edi: 0 registers.eax: 1944862534 registers.ebp: 1307200 registers.edx: 0 registers.ebx: 0 registers.esi: 1944862534 registers.ecx: 7736680	1
__exception__ Aug. 3, 2021, 4:45 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7692d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7692964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76914d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76916f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7691e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76916002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76915fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x769149e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76915a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77969a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77988f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77988e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76e37a25 rundll32+0x135c @ 0xcd135c rundll32+0x1901 @ 0xcd1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x76943ef4 registers.esp: 1309248 registers.edi: 0 registers.eax: 10952968 registers.ebp: 1309276 registers.edx: 1 registers.ebx: 0 registers.esi: 5394376 registers.ecx: 1944728956	1
__exception__ Aug. 3, 2021, 4:45 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743077b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57 rundll32+0x393f @ 0xcd393f rundll32+0x24a7 @ 0xcd24a7 rundll32+0x12e8 @ 0xcd12e8 rundll32+0x1901 @ 0xcd1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73ec3f46 registers.esp: 1569768 registers.edi: 0 registers.eax: 1944862534 registers.ebp: 1569808 registers.edx: 0 registers.ebx: 0 registers.esi: 1944862534 registers.ecx: 6819176	1
__exception__ Aug. 3, 2021, 4:45 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x769e6d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x769e6de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x769e6e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x7794011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x76a0cf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x76a3f73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x76a3fa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x76a3fb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x743077b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x76a3fd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x76a3fd57 rundll32+0x393f @ 0xcd393f rundll32+0x24a7 @ 0xcd24a7 rundll32+0x12e8 @ 0xcd12e8 rundll32+0x1901 @ 0xcd1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73ec3f46 registers.esp: 1569768 registers.edi: 0 registers.eax: 1944862534 registers.ebp: 1569808 registers.edx: 0 registers.ebx: 0 registers.esi: 1944862534 registers.ecx: 6819176	1
__exception__ Aug. 3, 2021, 4:45 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7692d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7692964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76914d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76916f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7691e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76916002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76915fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x769149e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76915a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77969a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77988f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77988e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76e37a25 rundll32+0x135c @ 0xcd135c rundll32+0x1901 @ 0xcd1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x76943ef4 registers.esp: 1571856 registers.edi: 0 registers.eax: 11018504 registers.ebp: 1571884 registers.edx: 1 registers.ebx: 0 registers.esi: 4477024 registers.ecx: 1944728956	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 69 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2900 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 1512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 4:45 p.m.	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74270000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\The Latest Updated Report Document.doc

Creates executable files on the filesystem (3 events)

file	C:\ProgramData\MicrosoftMessenge\skvdqhhg\MSVCR100.dll
file	C:\ProgramData\MicrosoftMessenge\kzwvfhhq\MSVCR100.dll
file	C:\ProgramData\MicrosoftMessenge\tscjuzlz\MSVCR100.dll

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
SetFileAttributesW Aug. 3, 2021, 4:45 p.m.	file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: C:\Users\test22\AppData\Local\Temp\MSVCR100.dll filepath: C:\Users\test22\AppData\Local\Temp\MSVCR100.dll	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00025a00', u'virtual_address': u'0x00001000', u'entropy': 7.012267316127248, u'name': u'.text', u'virtual_size': u'0x0002583e'}

entropy

7.01226731613

description

A section with a high entropy has been found

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.37321609
FireEye	Generic.mg.ec44a1e0f5af1c4b
McAfee	Artemis!EC44A1E0F5AF
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005802f31 )
Alibaba	Trojan:Win32/Agentb.c64a71af
K7GW	Trojan ( 005802f31 )
CrowdStrike	win/malicious_confidence_60% (D)
BitDefenderTheta	Gen:NN.ZedlaF.34050.6r4@aumPXlh
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/Agent.ADIN
APEX	Malicious
Kaspersky	Trojan.Win32.Agentb.kmks
BitDefender	Trojan.GenericKD.37321609
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Agentb.Alii
Ad-Aware	Trojan.GenericKD.37321609
Sophos	Mal/Generic-S
Comodo	Malware@#3ggfsiuu6vd62
TrendMicro	TROJ_FRS.VSNTGT21
McAfee-GW-Edition	BehavesLike.Win32.Injector.tm
Emsisoft	Trojan.GenericKD.37321609 (B)
Avira	TR/Agent.twqym
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
ViRobot	Trojan.Win32.S.Agent.2003456
GData	Trojan.GenericKD.37321609
Cynet	Malicious (score: 100)
ALYac	Trojan.Agent.OceanLotus
Malwarebytes	Malware.AI.4251822667
TrendMicro-HouseCall	TROJ_FRS.VSNTGT21
SentinelOne	Static AI - Malicious PE
Fortinet	W32/PossibleThreat
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
Qihoo-360	Win32/Heur.Generic.HygBueAA

MSVCR100.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All