Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 11, 2021, 12:31 p.m.	Nov. 11, 2021, 12:33 p.m.

Size	322.6KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`3f20bab397fdae94a874dc9b15a2fcc4`
SHA256	`c90d97b23a126e8e6ebc2ae6daf35bc2236d8002289ab43a006c0d8c053a018e`
CRC32	`FF541395`
ssdeep	`6144:IsmgKiaHcHl5vi9jsL71k24UjrfD1snOuOu+HUtjmCBIEq8ogd:Ismg6cHTkUKO9sn1Ou+GjhBIB8v`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,DllRegisterServer
2428
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,DllRegisterServer
  2916
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlClearBuffer
2516
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlClearBuffer
  3056
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlConstructorBuffer
2604
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlConstructorBuffer
  2896
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlDestructorBuffer
2692
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlDestructorBuffer
  3020
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,About
2336
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,About
  2224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlGetBuffer
2792
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlGetBuffer
  2376
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlReadBuffer
2888
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlReadBuffer
  2508
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlSetBuffer
2204
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlSetBuffer
  2980
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlWriteBuffer
2672
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,RtlWriteBuffer
  2948
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\zuroq6.dll,
2840

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	cdata
section	wdata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 11, 2021, 12:24 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 1998422456 registers.r15: 36531920 registers.rcx: 1997503120 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1997503120 registers.rsp: 2355304 registers.r11: 3301136 registers.r8: 64 registers.r9: 2355896 registers.rdx: 64 registers.r12: 1998414488 registers.rbp: 2355568 registers.rdi: 0 registers.rax: 0 registers.r13: 1998430392	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e25000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076daa000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e19000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076deb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dac000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d94000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d94000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076db2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076df1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076db1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076df2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e00000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dec000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076deb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1

zuroq6

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All