Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 11, 2021, 12:31 p.m.	Nov. 11, 2021, 12:37 p.m.

Size	322.6KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`2ba06a391cb30d64f0c3cef363507c94`
SHA256	`f251ae675be4995d585d1b1999e3231240e5d4beb0a7ea33bd16c9d4cb7c9ccd`
CRC32	`8E7B349D`
ssdeep	`6144:IsmgKiaHcHl5vi9jsL71k24UjrfD1snOuOu+HUtjmCBIEq8ogT:Ismg6cHTkUKO9sn1Ou+GjhBIB89`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,DllRegisterServer
2412
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,DllRegisterServer
  2868
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlClearBuffer
2500
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlClearBuffer
  3028
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,About
2308
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,About
  3000
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlDestructorBuffer
2684
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlDestructorBuffer
  2052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlConstructorBuffer
2592
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlConstructorBuffer
  2304
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlGetBuffer
2776
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlGetBuffer
  2560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlReadBuffer
2916
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlReadBuffer
  2544
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlSetBuffer
3056
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlSetBuffer
  2768
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlWriteBuffer
2452
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,RtlWriteBuffer
  2836
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bebys7.dll,
2884

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0
IsDebuggerPresent Nov. 11, 2021, 12:24 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	cdata
section	wdata

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 11, 2021, 12:24 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 1998422456 registers.r15: 36269776 registers.rcx: 1997503120 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1997503120 registers.rsp: 2618872 registers.r11: 5201680 registers.r8: 64 registers.r9: 2619464 registers.rdx: 64 registers.r12: 1998414488 registers.rbp: 2619136 registers.rdi: 0 registers.rax: 0 registers.r13: 1998430392	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e25000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076daa000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e19000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076deb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dac000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d94000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d94000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076db2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076df1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076db1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076df2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e00000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dec000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076deb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 11, 2021, 12:24 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1

bebys7

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All