Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 28, 2021, 5:51 p.m.	Oct. 28, 2021, 5:53 p.m.

Size	1.0MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`fd1abfa50105b2e8552cd8d0071abea7`
SHA256	`b2c28c3a9ec15f34d55b40f150544c337d4a22c8e452354452e423f8acb5a6ff`
CRC32	`DEDE967D`
ssdeep	`24576:22c6WRTUUt+HxHGRivPX04OhWqVD6wKhGm31m:fW5tQHlvv0f5B6Vhv31`
PDB Path	c:\12-Early\went\Whether\View\Stop.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sdp4emp.jpg.dll,Ledblock
1016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sdp4emp.jpg.dll,Thousandwire
2852
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sdp4emp.jpg.dll,Weight
596
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sdp4emp.jpg.dll,
2932

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\12-Early\went\Whether\View\Stop.pdb

One or more processes crashed (50 out of 105 events)

Time & API	Arguments	Status
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782420 registers.edi: 2829272 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 11470800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 11470816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 11470832 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 11470848 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 11470864 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 11470880 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 11470896 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 11470912 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 11470928 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 11470944 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11470960 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 11470976 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 11470992 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 11471008 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 11471024 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782396 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 11471040 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: DllRegisterServer+0xcbc7 sdp4emp+0x16937 @ 0x72ac6937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 781592 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 782664 registers.edx: 23 registers.ebx: 782680 registers.esi: 23 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782648 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 11474280 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 11474304 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 11474328 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 11474352 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 11474376 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 11474400 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 11474424 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 11474448 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 11474472 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 11474496 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 11474520 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 11474544 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 11474568 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 11474592 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 11474616 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 782624 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 11474640 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585296 registers.edi: 4008808 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 8587216 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 8587232 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 8587248 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 8587264 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 8587280 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 8587296 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 8587312 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 8587328 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 8587344 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 8587360 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8587376 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 8587392 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 8587408 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 5:51 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec sdp4emp+0x1105c exception.address: 0x72ac105c registers.esp: 585272 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 8587424 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b3c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bb1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 1016 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b3c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bb1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 2852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 2852 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b3c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72bb1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 5:51 p.m.	process_identifier: 596 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Fragtor.35825
FireEye	Gen:Variant.Fragtor.35825
Sangfor	Suspicious.Win32.Save.a
BitDefenderTheta	AI:Packer.A0F57D5621
Cyren	W32/Dridex.FT.gen!Eldorado
ESET-NOD32	a variant of Win32/GenKryptik.FMSA
BitDefender	Gen:Variant.Fragtor.35825
McAfee-GW-Edition	Artemis!Trojan
MAX	malware (ai score=83)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
McAfee	Artemis!FD1ABFA50105

sdp4emp.jpg

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All