Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 27, 2021, 6:09 p.m.	Oct. 27, 2021, 6:12 p.m.

Size	747.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`179547d6f870b7ecf096bc3fd7481c59`
SHA256	`809a94edad3d9e989f1041f04bb9dc8142eddf1fa5a7a5b95d8b292dd861fbef`
CRC32	`748EFA69`
ssdeep	`12288:rMwXNVGBEqneq/kFPwRHFrup/ODy+bucjeX/3sf58A6eGX57xo:rVFPwFFy/Om+pH6eY5F`
PDB Path	c:\Tree\Serve\603\Your\dance \Post.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\v2worottu.zip.dll,Mine
2388
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\v2worottu.zip.dll,Storeexperience
2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\v2worottu.zip.dll,Wineat
804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\v2worottu.zip.dll,
2112

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\Tree\Serve\603\Your\dance \Post.pdb

One or more processes crashed (50 out of 105 events)

Time & API	Arguments	Status
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946268 registers.edi: 3484632 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 33359824 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 33359840 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 33359856 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 33359872 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 33359888 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 33359904 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 33359920 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 33359936 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 33359952 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 33359968 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 33359984 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 33360000 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 33360016 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 33360032 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 33360048 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946244 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 33360064 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: DllRegisterServer+0xcbc7 v2worottu+0x16937 @ 0x73726937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2945448 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 2946512 registers.edx: 23 registers.ebx: 2946528 registers.esi: 23 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946496 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 33363304 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 33363328 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 33363352 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 33363376 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 33363400 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 33363424 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 33363448 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 33363472 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 33363496 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 33363520 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 33363544 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 33363568 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 33363592 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 33363616 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 33363640 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 2946472 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 33363664 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307928 registers.edi: 3222392 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 8325072 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 8325088 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 8325104 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 8325120 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 8325136 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 8325152 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 8325168 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 8325184 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 8325200 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 8325216 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8325232 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 8325248 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 8325264 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 27, 2021, 6:10 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec v2worottu+0x1105c exception.address: 0x7372105c registers.esp: 1307904 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 8325280 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 27, 2021, 6:09 p.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7378e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737cb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2388 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:09 p.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7378e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737cb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 2240 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:09 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7378e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737cb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 6:10 p.m.	process_identifier: 804 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.179547d6f870b7ec
Sangfor	Suspicious.Win32.Save.a
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
SentinelOne	Static AI - Malicious PE

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0007c400', u'virtual_address': u'0x00001000', u'entropy': 6.855667837513979, u'name': u'.text', u'virtual_size': u'0x0007c203'}

entropy

6.85566783751

description

A section with a high entropy has been found

entropy

0.666219839142

description

Overall entropy of this PE file is high

v2worottu.zip

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All