Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 28, 2021, 6:13 p.m.	Oct. 28, 2021, 6:15 p.m.

Size	1.3MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`617b1fd1bfdab72e5562c0c2f7600bcb`
SHA256	`9b9c38d267cedfb2c423fbad71a50f76d0743a3ecc8f6027029fa13ea36e00e4`
CRC32	`7BC99AA2`
ssdeep	`24576:inxqsL+DvNdnhMr5Lo6dOGcuQNrSH9d6N9eYWtZgDxxxSPnsqz7puATt5csRbu74:icfk82uAJTI7KPswKwuS`
PDB Path	c:\Gun\208-town\521\exa\botto\party.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.980776.19803.14094.dll,Bluewing
540
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.980776.19803.14094.dll,Earth
2992
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.980776.19803.14094.dll,Masterjust
1576
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.980776.19803.14094.dll,
2776

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\Gun\208-town\521\exa\botto\party.pdb

One or more processes crashed (50 out of 105 events)

Time & API	Arguments	Status
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568816 registers.edi: 2959304 registers.eax: 2001920038 registers.ebp: 2001994313 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1960509440 registers.ecx: 66040	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 16 registers.eax: 2001920038 registers.ebp: 7276496 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 15 registers.eax: 2001920038 registers.ebp: 7276512 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 14 registers.eax: 2001920038 registers.ebp: 7276528 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 13 registers.eax: 2001920038 registers.ebp: 7276544 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 12 registers.eax: 2001920038 registers.ebp: 7276560 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 11 registers.eax: 2001920038 registers.ebp: 7276576 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 10 registers.eax: 2001920038 registers.ebp: 7276592 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 9 registers.eax: 2001920038 registers.ebp: 7276608 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 8 registers.eax: 2001920038 registers.ebp: 7276624 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 7 registers.eax: 2001920038 registers.ebp: 7276640 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 7276656 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 5 registers.eax: 2001920038 registers.ebp: 7276672 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 4 registers.eax: 2001920038 registers.ebp: 7276688 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 3 registers.eax: 2001920038 registers.ebp: 7276704 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 2 registers.eax: 2001920038 registers.ebp: 7276720 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1568792 registers.edi: 1 registers.eax: 2001920038 registers.ebp: 7276736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: DllRegisterServer+0xcbc7 securiteinfo+0x16937 @ 0x73d66937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1567992 registers.edi: 12 registers.eax: 2001920038 registers.ebp: 1569060 registers.edx: 23 registers.ebx: 1569076 registers.esi: 23 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569044 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 7279976 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 7280000 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 7280024 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 7280048 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 7280072 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 7280096 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 7280120 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 7280144 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 7280168 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 7280192 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 7280216 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 7280240 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 7280264 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 7280288 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 7280312 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1569020 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 7280336 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502792 registers.edi: 5253056 registers.eax: 2001920038 registers.ebp: 2001994313 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1960509440 registers.ecx: 66040	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 16 registers.eax: 2001920038 registers.ebp: 31590352 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 15 registers.eax: 2001920038 registers.ebp: 31590368 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 14 registers.eax: 2001920038 registers.ebp: 31590384 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 13 registers.eax: 2001920038 registers.ebp: 31590400 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 12 registers.eax: 2001920038 registers.ebp: 31590416 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 11 registers.eax: 2001920038 registers.ebp: 31590432 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 10 registers.eax: 2001920038 registers.ebp: 31590448 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 9 registers.eax: 2001920038 registers.ebp: 31590464 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 8 registers.eax: 2001920038 registers.ebp: 31590480 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 7 registers.eax: 2001920038 registers.ebp: 31590496 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 6 registers.eax: 2001920038 registers.ebp: 31590512 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 5 registers.eax: 2001920038 registers.ebp: 31590528 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 4 registers.eax: 2001920038 registers.ebp: 31590544 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 28, 2021, 6:13 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec securiteinfo+0x1105c exception.address: 0x73d6105c registers.esp: 1502768 registers.edi: 3 registers.eax: 2001920038 registers.ebp: 31590560 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e17000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e9b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 540 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e17000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 2992 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e9b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 2992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 2992 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 2992 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 1576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e17000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 1576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e9b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 1576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 1576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 28, 2021, 6:13 p.m.	process_identifier: 1576 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Lionic	Trojan.Win32.Cridex.7!c
MicroWorld-eScan	Gen:Variant.Razy.980776
McAfee	Artemis!617B1FD1BFDA
Cylance	Unsafe
Sangfor	Infostealer.Win32.Cridex.gen
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Dridex.DD
Kaspersky	HEUR:Trojan-Banker.Win32.Cridex.gen
BitDefender	Gen:Variant.Razy.980776
Avast	Win32:Trojan-gen
Ad-Aware	Gen:Variant.Razy.980776
Sophos	Mal/Generic-R + Mal/EncPk-AQC
DrWeb	Trojan.Dridex.735
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Razy.980776
Emsisoft	Gen:Variant.Razy.980776 (B)
Ikarus	Win32.Outbreak
GData	Gen:Variant.Razy.980776
Kingsoft	Win32.Troj.Banker.(kcloud)
ZoneAlarm	HEUR:Trojan-Banker.Win32.Cridex.gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
MAX	malware (ai score=83)
Fortinet	W32/Dridex.DD!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A

SecuriteInfo.com.Variant.Razy.980776.19803.14094.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All