Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 11, 2021, 12:31 p.m.	Nov. 11, 2021, 12:46 p.m.

Size	322.6KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`5d678357397707f665915cc589c0abfe`
SHA256	`fb8d16e48cf97220257e3b04b28b6c1e3bb73d612b6dc1e968e01f43233b598b`
CRC32	`B0546634`
ssdeep	`6144:IsmgKiaHcHl5vi9jsL71k24UjrfD1snOuOu+HUtjmCBIEq8ogF:Ismg6cHTkUKO9sn1Ou+GjhBIB8X`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,About
2768
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,About
  2268
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,DllRegisterServer
2852
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,DllRegisterServer
  2336
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlClearBuffer
2944
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlClearBuffer
  2484
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlConstructorBuffer
3032
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlConstructorBuffer
  2728
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlDestructorBuffer
2124
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlDestructorBuffer
  2940
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlGetBuffer
2188
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlGetBuffer
  3024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlReadBuffer
2344
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlReadBuffer
  2060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlSetBuffer
2688
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlSetBuffer
  2280
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlWriteBuffer
2888
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,RtlWriteBuffer
  152
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys1.dll,
2024

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	cdata
section	wdata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 11, 2021, 12:24 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 2002158008 registers.r15: 39415504 registers.rcx: 2001238672 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 2001238672 registers.rsp: 1701752 registers.r11: 2923952 registers.r8: 64 registers.r9: 1702344 registers.rdx: 64 registers.r12: 2002150040 registers.rbp: 1702016 registers.rdi: 0 registers.rax: 0 registers.r13: 2002165944	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 140 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077015000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f89000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077009000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f96000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f82000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f96000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f9c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f84000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f84000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f89000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fa2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f97000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fe1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fa1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fe2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ff0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fca000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fca000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f82000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f8a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fdb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fcb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076f99000 process_handle: 0xffffffffffffffff	1

bebys1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All