Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 27, 2021, 6:03 p.m.	Oct. 27, 2021, 6:05 p.m.

Size	1.3MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`f793cad74aae9dab113ac269b4aab998`
SHA256	`9eb19bed596c23b08f71e513953cddb5c69783ae9cfebc8359d311a53623be9e`
CRC32	`9F49EE79`
ssdeep	`24576:fqgoo0Xddxgc/0bsfKi7cicm5Vkr3AhQPpkTsp1CvfnP:RVmdGsfKiuOVkAWhkTICvfnP`
PDB Path	c:\moon\Those-decimal\compare\133\Front\Skill.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jb5wrmt56.rar.dll,Historybelieve
2232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jb5wrmt56.rar.dll,Lastelement
1772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jb5wrmt56.rar.dll,Mass
2084
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jb5wrmt56.rar.dll,
2532

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\moon\Those-decimal\compare\133\Front\Skill.pdb

One or more processes crashed (50 out of 105 events)

Time & API	Arguments	Status
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158660 registers.edi: 5516152 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 36243408 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 36243424 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 36243440 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 36243456 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 36243472 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 36243488 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 36243504 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 36243520 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 36243536 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 36243552 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 36243568 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 36243584 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 36243600 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 36243616 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 36243632 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158636 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 36243648 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: DllRegisterServer+0xcbc7 jb5wrmt56+0x16937 @ 0x72906937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2157832 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 2158904 registers.edx: 23 registers.ebx: 2158920 registers.esi: 23 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158888 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 36246888 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 36246912 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 36246936 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 36246960 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 36246984 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 36247008 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 36247032 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 36247056 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 36247080 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 36247104 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 36247128 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 36247152 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 36247176 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 36247200 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 36247224 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 2158864 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 36247248 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701164 registers.edi: 4795240 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 35784656 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 35784672 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 35784688 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 35784704 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 35784720 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 35784736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 35784752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 35784768 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 35784784 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 35784800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 35784816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 35784832 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 35784848 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:03 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec jb5wrmt56+0x1105c exception.address: 0x7290105c registers.esp: 1701140 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 35784864 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a3c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2232 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 1772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 1772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a3c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 1772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 1772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 1772 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a3c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2084 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:03 p.m.	process_identifier: 2084 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

jb5wrmt56.rar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All