Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 10, 2021, 9:37 a.m.	Nov. 10, 2021, 9:40 a.m.

Size	396.6KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`813e4625e96182b6a99b0c3a8733ff77`
SHA256	`77e2786e4867685294fdccd9905fa08f9f75f81df31497c5a8b4656bcee67eb9`
CRC32	`8CC05B62`
ssdeep	`6144:Ni/6pI17FrzJpguwVOPSBOyPdpXzwdyuPMgGUKXs8IMd6RXiqrcsrc/Qe:NDuxrWIPSBOyPmSs8Inbu/`
Yara	Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check BazarLoader_IN - BazarLoader IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllResumeServer
2956
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllResumeServer
  2280
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllStartServer
3056
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllStartServer
  2384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllRegisterServer
2860
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllRegisterServer
  2488
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllStopServer
788
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllStopServer
  2856
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllSuspendServer
2204
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllSuspendServer
  2728
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllUnregisterServer
2456
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,DllUnregisterServer
  3024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,a0i
2656
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,a0i
  192
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,bn2o
2972
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,bn2o
  2296
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,chql
2160
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,chql
  2468
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,fmr8t6xyemlhdyszy9ny
2616
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,fmr8t6xyemlhdyszy9ny
  2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,fvchb0dsyzm4k5pqs50zvvooyd2
2316
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,fvchb0dsyzm4k5pqs50zvvooyd2
  2060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,gf8
544
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,gf8
  2684
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,gnvfiwfpoekyfqfb00y8dwl7ao0
548
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,gnvfiwfpoekyfqfb00y8dwl7ao0
  1600
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,hpsd2mmdaq09nkotvt31hq3j
3176
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,hpsd2mmdaq09nkotvt31hq3j
  3376
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,ia6qhyu36gk6
3452
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,ia6qhyu36gk6
  3560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,iejm
3660
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,iejm
  3756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,it42f4vda6
3928
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,it42f4vda6
  4044
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,ma8anqvwb5vu2bk2zmy
4080
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,ma8anqvwb5vu2bk2zmy
  3252
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,n6oqp8x4cwd9jb9258a
2308
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,n6oqp8x4cwd9jb9258a
  3336
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,nvr4od50szz9548z43ki8q
2360
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,nvr4od50szz9548z43ki8q
  2744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,p3bf
3628
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,p3bf
  3916
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,p8b13v1cc61zs1pd
3640
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,p8b13v1cc61zs1pd
  3248
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,q0ztrpprlf8
2224
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,q0ztrpprlf8
  3412
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,r2vfhdue8qs1t8r4p6tk4lv7m
3456
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,r2vfhdue8qs1t8r4p6tk4lv7m
  3752
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,s0qa5
4020
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,s0qa5
  276
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,t7ai2
3860
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,t7ai2
  2664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,u5u
1568
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,u5u
  3232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,uneuzmof23nua4d0ba98
3516
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,uneuzmof23nua4d0ba98
  1776
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,v1dmo
4012
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,v1dmo
  3440
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,vjxdko54e8lp66owkcg20zg0o
4048
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,vjxdko54e8lp66owkcg20zg0o
  3848
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,vv1pokfu3gzelhcqro39mddcfrtg
1912
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,vv1pokfu3gzelhcqro39mddcfrtg
  1392
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,x0dzgvozyb5eq90v1zjzibmiiyaaj
3920
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,x0dzgvozyb5eq90v1zjzibmiiyaaj
  3448
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,xgj66mbqyl798991zmj3upb40
2152
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,xgj66mbqyl798991zmj3upb40
  3068
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,yasebtt45cuhjlxza9q5tfo4dp811
3244
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,yasebtt45cuhjlxza9q5tfo4dp811
  2008
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,yigqk0uelvgjxf7ot47jfc3oi
1728
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,yigqk0uelvgjxf7ot47jfc3oi
  3832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq9.dll,
2216

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (35 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:37 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:38 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0
IsDebuggerPresent Nov. 10, 2021, 9:39 a.m.			0	0

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Nov. 10, 2021, 9:37 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 40333008 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 1368984 registers.r11: 2009056 registers.r8: 64 registers.r9: 1369576 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 1369248 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1
__exception__ Nov. 10, 2021, 9:37 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 40857296 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 1238472 registers.r11: 1943520 registers.r8: 64 registers.r9: 1239064 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 1238736 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1
__exception__ Nov. 10, 2021, 9:37 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 41053904 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 2679624 registers.r11: 1091584 registers.r8: 64 registers.r9: 2680216 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 2679888 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1
__exception__ Nov. 10, 2021, 9:37 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 41971408 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 1106888 registers.r11: 2533344 registers.r8: 64 registers.r9: 1107480 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 1107152 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1
__exception__ Nov. 10, 2021, 9:37 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 41971408 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 2745272 registers.r11: 4827056 registers.r8: 64 registers.r9: 2745864 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 2745536 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1
__exception__ Nov. 10, 2021, 9:37 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 40464080 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 2678792 registers.r11: 960512 registers.r8: 64 registers.r9: 2679384 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 2679056 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 856 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 region_size: 94208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000020e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077015000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f89000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077009000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f96000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f82000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f96000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f84000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f84000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f89000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fa2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f97000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fe1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fa1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fe2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ff0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fca000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fca000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f82000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 10, 2021, 9:37 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

rundll32.exe tried to sleep 184 seconds, actually delayed analysis time by 184 seconds

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00013200', u'virtual_address': u'0x0003e000', u'entropy': 7.664629826677694, u'name': u'.rdata', u'virtual_size': u'0x0001311c'}

entropy

7.66462982668

description

A section with a high entropy has been found

zuroq9

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All