Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 11, 2021, 12:31 p.m.	Nov. 11, 2021, 12:50 p.m.

Size	322.6KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`a6887a679ce1f2bc1831bcc3559dd70c`
SHA256	`c5794f1137d40f76b20c4dbbba4573bd2aa29d2d8c2e0bed3d3f6f0f7a5af715`
CRC32	`D90617E4`
ssdeep	`6144:IsmgKiaHcHl5vi9jsL71k24UjrfD1snOuOu+HUtjmCBIEq8ogu:Ismg6cHTkUKO9sn1Ou+GjhBIB8c`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,About
2752
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,About
  2116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,DllRegisterServer
2860
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,DllRegisterServer
  2160
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlClearBuffer
2952
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlClearBuffer
  264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlConstructorBuffer
3048
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlConstructorBuffer
  2572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlDestructorBuffer
2132
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlDestructorBuffer
  2848
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlGetBuffer
2340
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlGetBuffer
  2932
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlReadBuffer
2476
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlReadBuffer
  3064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlSetBuffer
2772
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlSetBuffer
  2136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlWriteBuffer
3044
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,RtlWriteBuffer
  2420
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys8.dll,
2484

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	cdata
section	wdata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 11, 2021, 12:24 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 39546576 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 1504520 registers.r11: 3513776 registers.r8: 64 registers.r9: 1505112 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 1504784 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 140 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077015000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f89000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077009000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f96000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f82000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f96000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f84000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f84000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f89000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fa2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f97000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fe1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fa1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fe2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ff0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fca000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fca000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f82000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1

bebys8

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All