Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 9, 2022, 1:40 p.m.	July 9, 2022, 1:51 p.m.

Size	269.0KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`ea0d73a3215825620901196d086e8887`
SHA256	`dd42e18b12a3bf58d968e137152051e90a09024162816dfe2dd535ad54e2e875`
CRC32	`D2096C5E`
ssdeep	`6144:HhuDhkX/MAXwTCFQi+2JW/PAiikmKx770v/5kjjB589:HhuDCvM0rQi1W/PAiikPNm+jD`
Yara	IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,AjkRVrFNnyQmqXQdrComyaiwV
2316
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,AjkRVrFNnyQmqXQdrComyaiwV
  2920
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,BMIWqtk
2512
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,BMIWqtk
  1580
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,AkMhEGvNFpnSswjeCw
2420
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,AkMhEGvNFpnSswjeCw
  3008
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,BxBybURSqJfOwVmXj
2692
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,BxBybURSqJfOwVmXj
  2348
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CCSLGUsdVtcCbfF
2784
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CCSLGUsdVtcCbfF
  2308
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CWBdqFubMR
2880
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CWBdqFubMR
  2432
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,BpsBUyIiAmXYU
2604
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,BpsBUyIiAmXYU
  2416
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CbEceKaoQvfuhhIK
3040
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CbEceKaoQvfuhhIK
  2676
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CcBDyidVYuvtjWfG
2536
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CcBDyidVYuvtjWfG
  2960
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CeOVtVdkUnRPoUvswsvkEf
2868
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CeOVtVdkUnRPoUvswsvkEf
  2324
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CvxIGiXAzAG
2224
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,CvxIGiXAzAG
  2632
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,DllRegisterServer
2992
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,DllRegisterServer
  2884
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RPhdXxV\hyoafnKWtJAy.dll"
    3612
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,DPsWXvFrrwOLZwoq
2136
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,DPsWXvFrrwOLZwoq
  2080
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ENtihcf
2584
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ENtihcf
  2588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,EVYoaysfyVmedMKzqOkd
2936
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,EVYoaysfyVmedMKzqOkd
  2052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FSgLIbzCJsGhKrdTRUhBnjq
2492
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FSgLIbzCJsGhKrdTRUhBnjq
  3032
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FXswjNvwqEmJHSzKXfB
2384
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FXswjNvwqEmJHSzKXfB
  3052
explorer.exe C:\Windows\Explorer.EXE
1236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FmRrLoGPniSXxeHYAaRXrsSIt
2680
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FmRrLoGPniSXxeHYAaRXrsSIt
  3056
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FzYYWlRKDQMfKaJAUq
2304
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,FzYYWlRKDQMfKaJAUq
  2872
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GEQqgSeWrJkaNSdjOw
2728
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GLvPFjzv
3124
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GTfYoyhXUmiOrfM
3216
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GVTerofsGHUASHLhWfIFX
3324
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GlLOHKioWJZCQPS
3456
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GpqOdmj
3596
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GtaEQGQNcgERZqWo
3752
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,GzdHPyIXWoMGb
3848
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,HKgdkPfboZzjQODFfSu
3980
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,HmXZBMEhrWvTg
2476
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,HvFWvy
3208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ICrKqnEJHHrxYaH
3352
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,IDENrF
3520
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ISuniIBoqjzfv
3720
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,IcEiBSQQHwaxZGs
2436
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,JCFScdjDVMLKVa
3916
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,JGwGKVHFHwfxsyCIp
3100
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,JnkFkZthy
3044
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,LSRvMYckceDUkCMxwUAq
3588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,LhZoEaJRggyJr
2772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,MknuTlXosJJdvczIkg
3996
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,MrhDZxAutnSSobTVt
3388
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,NRfTvw
3656
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,NZDMYgNWoHhCVPBFWyuTBSesQ
3684
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,NmBmwe
3296
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,NzYPpUvQ
3688
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,OThzaIZTEfYKTCCRQlcnW
2496
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,OWMilsbkgGVyJL
4028
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,OguxguFiYSHz
3332
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PHzWjRI
3784
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PNJeVrAcZDAW
3264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PSDYwIgmLiVzYESIaUYrbKg
4164
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PiJSThSmMmzNNC
4268
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PneIJqdSVVerltCm
4380
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PpsLezsCiHiCVkHmZP
4480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PuoUVwFKYxjCqT
4600
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,PwNlKX
4744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,QRkaVvgiLqTCjGKy
4848
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RJAcdfSthTv
4944
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RYkwsDq
5052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RZtKxjO
4100
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RcnQoaySRBXJxsiZQIHxe
4348
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RdnXeofUSzEDgzxXeW
4472
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RfsPQSmuvBYXfIScfOT
4640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RkfakVk
4804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,RmhqixPgftgQ
4972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,SInCoGYrouPZGmYYJGKIR
5116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,SRXSueHCT
4328
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,SVlQsYSAXEyhEvVkdWdX
4500
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,SnLgFTA
4756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,SxfQZPkEOIcG
5048
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,TJZCJgp
4208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,TSNqZL
4504
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,TfpEQJjWUDp
4876
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,TvUVDsEcInyvKdGRA
4112
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,TvtXyQtNShHDYCMvH
4772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,UGXSNpc
5040
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ULOMXGiV
4996
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,UVzHIeChKCEwTMG
4228
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,UagSsmENTltTUKpktiEuRJfE
4568
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,UbjFSQJG
5124
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,UjDfVglhgynLAuMpwrtpXkH
5248
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,UrxprELRNWbXXBuOJlJ
5348
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,VXDuMBzruSCyfbAMzIrvV
5464
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,VcrtEzpxSRmZr
5584
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,VkRjra
5688
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,WMxfpgNLwoiQTZjkM
5804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,WjtCBeYwDkRZvKLfJD
5924
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,XoMiJXhdBRBldnkLkgMM
6048
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,XsBeDFcmOsaqRihqMytJ
4708
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,YGPQhuvjFbQXSoJfVilOnVw
5220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,YvzKAJK
5444
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ZAppiYnp
5600
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ZXZEfUeKC
5744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ZoyjBLvuBnIxXaWxFC
5880
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,aZwlVZLRtCIfDmaYbAXR
6016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,bdnAzUNoMZJXxzHG
4184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,btmsIKQVm
5408
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,cFminOM
5648
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,cKjOEfqQYYQ
5572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,czIvuAZ
6036
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,dMEJcsHSUiODu
5416
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,dPYgmMRi
5720
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,dStUmppUwHfwVxtCgCewXt
6064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,deMXieymThIxfyWzHCMb
5344
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,dgCMMkwNpUNZ
5668
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,eDtAbxMTINFwGjIRymBKxBFTe
6072
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ePfrWQkHuKqOV
5168
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,eQnPJdIEwUrOjHyYKajVY
6060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,eWqtOcNgKbDEwKynrCTAaqRd
4204
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,eiRJXgFAjkyObQxtC
6160
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,fLsjxmtTmthGKPw
6276
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,fqsAeZLb
6376
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,frkkGhhTKCPBzCLoveBHn
6500
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,fxmvSQNzSiXj
6600
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,gATjvjWkzNfdmAJbeFMKFtUmoI
6716
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,gCFmNdxvaAq
6840
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,gfeRIwKkCZUnQQ
6988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,gjZENXkR
7080
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,gzzlrzxMlshrI
5884
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,hClTxV
6328
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,hDdSABujeGhBdM
6424
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,hJbRrovBnfzadHBLOAaX
6560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,hLNWWET
6644
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,iIJmtODVuCFQPMFae
6884
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,iItzzFKWzIZojfOFqJG
7004
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ibqesePIQXoUwnfgkLvfcuMFHK
7136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ieuLWaTjVeuBYegSaGXuly
204
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,igFffrhNCQcHQStroQFS
6512
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,irtTnxRuuXAWDuDRGCivHz
6740
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,jVNpFjHcSQ
900
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,jotleypmamgIHEUfZPLSmMtq
6836
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,jrkFXlWfdhOn
6204
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,kOcvjMhVkKI
6628
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,kPsHiOxOlxeVBpHYooACxIXHB
6792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,kUHyuFSDHjRQgcFnZIHgvahta
6268
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,kXMermOELWqc
6224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,kkWRnVCjitIbHTy
6264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,kpoFTDgQJFpD
6912
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,kvCgXPvHuWWWdAHGy
6888
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,lFcjChjFWgKWuOuaAxn
6200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,lKFTvqNg
7032
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,lcbnVGCdYXcKZTYevsVX
7184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,lefIOOsVMhliLLj
7280
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,mKrNVAlauoRSIht
7400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,nRVfeUAoalGiEviupjuyTviKt
7500
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,nWkMZMN
7620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,naKLRCkO
7744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,njUWLbQgRBGSd
7860
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,nlBfCJTJQhnnPxbkQkUAwWpmaA
7968
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,nmBYnmjGCq
8108
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,oIAdOUfQaetEfqMDSL
6592
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,osSAAvHx
7320
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ovwgmHjsMpOQyjNpuqeLd
7512
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ozpFyAlRWIHNYPuJbOLpoZosmO
7636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,pAbWNQjHuawouRBUprBVrXw
7820
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,pCYRinZyYkFOxayPFyJDEDxKzO
7976
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,pQvYHQSqPMdqFOFub
8096
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,pbzbgZeZipMwitVYJJbYTdyYQ
8144
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,pnbxRJnSdfpDADRIEWZXepR
7560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,qAirVWefWGdomxGs
7572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,qbgUwwXPUNM
7916
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,rJVMJaiBojiOWxURyzmLWnxH
8180
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,rOlGGoosrOYjYnwqSX
7528
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,rSHUNkevMkknNwSlqR
8000
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,rmrMOmqIIM
7384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,sBcaPzIWckINwkFTBxmdkiKID
7732
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,sJXDLm
7492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,sNQjkxnpfL
8084
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,sPKnvGEKVGRHsXgbRRJFS
8008
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,snoSMpnSAlGCDUoadZDE
7428
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,tGDiqYCDbgMaBXHmxqrJv
8076
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,tGdwKquShaUWskzgERPqeG
8264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,tXncljehbaR
8384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,taNCAYWnFedga
8492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,uFBMgXMRHfYmHKtd
8616
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,uQadijPTgYiRGTkxDpqTOeI
8732
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,vlEZdJoJilVuJxGaLFCzX
8832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,vlPATCQWfWfv
8944
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,vnMwerzIvV
9076
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,wDtWqzCTVUWdqo
9192
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,weKcSTEtgvLwNKGEWr
8312
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,wyslQDXAh
8480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,xRklmHvgNdkXc
8628
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,xbTTVacjLMTUBskAADEzpolBV
8792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,xbcfQIhiMJswKveISUtGpEWTr
8988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ytgHNsgBKfkMoZjHI
9136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,zLypEkbxfdampkTf
8288
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,ziTLFIzOnbzURBefGdA
8524
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\NxYwE8FyaIw3Kgile.dll,
8600

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
104.168.155.143	Active	Moloch
144.202.108.116	Active	Moloch
149.56.131.28	Active	Moloch
164.124.101.2	Active	Moloch
164.90.222.65	Active	Moloch
172.105.226.75	Active	Moloch
196.218.30.83	Active	Moloch
207.148.79.14	Active	Moloch
213.239.212.5	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49384 -> 104.168.155.143:8080	2404301	ET CNC Feodo Tracker Reported CnC Server group 2	A Network Trojan was detected
TCP 192.168.56.103:49381 -> 164.90.222.65:443	2404307	ET CNC Feodo Tracker Reported CnC Server group 8	A Network Trojan was detected
TCP 192.168.56.103:49385 -> 213.239.212.5:443	2404314	ET CNC Feodo Tracker Reported CnC Server group 15	A Network Trojan was detected
TCP 192.168.56.103:49385 -> 213.239.212.5:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 213.239.212.5:443 -> 192.168.56.103:49387	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49390 -> 172.105.226.75:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.103:49394 -> 149.56.131.28:8080	2404306	ET CNC Feodo Tracker Reported CnC Server group 7	A Network Trojan was detected
TCP 192.168.56.103:49394 -> 149.56.131.28:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.103:49389 -> 172.105.226.75:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.103:49393 -> 149.56.131.28:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 149.56.131.28:8080 -> 192.168.56.103:49395	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49383 -> 144.202.108.116:8080	2404304	ET CNC Feodo Tracker Reported CnC Server group 5	A Network Trojan was detected
TCP 172.105.226.75:8080 -> 192.168.56.103:49391	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49386 -> 213.239.212.5:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 9, 2022, 1:33 p.m.	computer_name: TEST22-PC	1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 9, 2022, 1:40 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75596d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75596de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75596e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x772c011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x755bcf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x755ef73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x755efa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x755efb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x73f477b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x755efd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x755efd57 rundll32+0x393f @ 0x63393f rundll32+0x247a @ 0x63247a rundll32+0x1baf @ 0x631baf rundll32+0x12e8 @ 0x6312e8 rundll32+0x1901 @ 0x631901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73d23f46 registers.esp: 1305164 registers.edi: 0 registers.eax: 1943158598 registers.ebp: 1305204 registers.edx: 0 registers.ebx: 0 registers.esi: 1943158598 registers.ecx: 8129896	1
__exception__ July 9, 2022, 1:40 p.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75596d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75596de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75596e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x772c011a DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x755bcf5c SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x755ef73c SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x755efa18 MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x755efb1f New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x73f477b7 MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x755efd15 MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x755efd57 rundll32+0x393f @ 0x63393f rundll32+0x247a @ 0x63247a rundll32+0x1baf @ 0x631baf rundll32+0x12e8 @ 0x6312e8 rundll32+0x1901 @ 0x631901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x73d23f46 registers.esp: 1305164 registers.edi: 0 registers.eax: 1943158598 registers.ebp: 1305204 registers.edx: 0 registers.ebx: 0 registers.esi: 1943158598 registers.ecx: 8129896	1
__exception__ July 9, 2022, 1:40 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x754ad08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x754a964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x75494d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x75496f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7549e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x75496002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x75495fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x754949e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x75495a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x772e9a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77308f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77308e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76877a25 rundll32+0x135c @ 0x63135c rundll32+0x1901 @ 0x631901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x754c3ef4 registers.esp: 1307808 registers.edi: 0 registers.eax: 32907616 registers.ebp: 1307836 registers.edx: 1 registers.ebx: 0 registers.esi: 2956952 registers.ecx: 1943025020	1

Time & API

Arguments

Status

Return

Repeated

__exception__

July 9, 2022, 1:40 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75596d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75596de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75596e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x772c011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x755bcf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x755ef73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x755efa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x755efb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x73f477b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x755efd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x755efd57
rundll32+0x393f @ 0x63393f
rundll32+0x247a @ 0x63247a
rundll32+0x1baf @ 0x631baf
rundll32+0x12e8 @ 0x6312e8
rundll32+0x1901 @ 0x631901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x73d23f46
registers.esp: 1305164
registers.edi: 0
registers.eax: 1943158598
registers.ebp: 1305204
registers.edx: 0
registers.ebx: 0
registers.esi: 1943158598
registers.ecx: 8129896

__exception__

July 9, 2022, 1:40 p.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75596d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75596de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75596e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x772c011a
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x755bcf5c
SoftModalMessageBox+0x757 MessageBoxTimeoutW-0x391 user32+0x6f73c @ 0x755ef73c
SoftModalMessageBox+0xa33 MessageBoxTimeoutW-0xb5 user32+0x6fa18 @ 0x755efa18
MessageBoxTimeoutW+0x52 MessageBoxTimeoutA-0x9 user32+0x6fb1f @ 0x755efb1f
New_user32_MessageBoxTimeoutW@24+0x137 New_user32_RegisterHotKey@16-0x80 @ 0x73f477b7
MessageBoxExW+0x1b MessageBoxA-0x9 user32+0x6fd15 @ 0x755efd15
MessageBoxW+0x18 SetSysColors-0x9 user32+0x6fd57 @ 0x755efd57
rundll32+0x393f @ 0x63393f
rundll32+0x247a @ 0x63247a
rundll32+0x1baf @ 0x631baf
rundll32+0x12e8 @ 0x6312e8
rundll32+0x1901 @ 0x631901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

__exception__

July 9, 2022, 1:40 p.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x754ad08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x754a964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x75494d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x75496f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7549e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x75496002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x75495fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x754949e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x75495a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x772e9a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77308f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77308e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x76877a25
rundll32+0x135c @ 0x63135c
rundll32+0x1901 @ 0x631901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x754c3ef4
registers.esp: 1307808
registers.edi: 0
registers.eax: 32907616
registers.ebp: 1307836
registers.edx: 1
registers.ebx: 0
registers.esi: 2956952
registers.ecx: 1943025020

Allocates read-write-execute memory (usually to unpack itself) (50 out of 141 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2920 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000004f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2920 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 3008 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001da0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 3008 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001db0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 1580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 1580 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2416 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2416 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2348 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2432 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001da0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2432 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001db0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ca0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2676 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:32 p.m.	process_identifier: 2308 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ea0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2960 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2324 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000004f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2632 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ca0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2884 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001e80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2080 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001e90000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2588 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 2052 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3032 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3052 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3056 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:40 p.m.	process_identifier: 3216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:40 p.m.	process_identifier: 3324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:40 p.m.	process_identifier: 3456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000010012000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefee30000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff10d000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001de0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefcf27000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd6af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd5d9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076cf0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076eee000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 9, 2022, 1:33 p.m.	process_identifier: 3612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bc0000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (1 event)

description

explorer.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 9, 2022, 1:34 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 10219286528 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RPhdXxV\hyoafnKWtJAy.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (38 events)

Time & API	Arguments	Status	Return
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: smss.exe process_identifier: 232	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: lsass.exe process_identifier: 456	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: lsm.exe process_identifier: 464	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 576	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 652	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 720	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 844	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 992	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 348	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: spoolsv.exe process_identifier: 1064	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: dwm.exe process_identifier: 1208	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 1332	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: svchost.exe process_identifier: 1728	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: pw.exe process_identifier: 1860	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: SearchIndexer.exe process_identifier: 1904	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: SearchProtocolHost.exe process_identifier: 744	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: SearchFilterHost.exe process_identifier: 1984	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: SearchProtocolHost.exe process_identifier: 1876	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: mobsync.exe process_identifier: 1588	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: pw.exe process_identifier: 2084	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: taskhost.exe process_identifier: 2116	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: sdclt.exe process_identifier: 2140	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: cmd.exe process_identifier: 2248	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: conhost.exe process_identifier: 2256	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: pw.exe process_identifier: 2332	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: rundll32.exe process_identifier: 2136	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: rundll32.exe process_identifier: 2992	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000138 process_name: rundll32.exe process_identifier: 2884	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 2304	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 2728	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 2872	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3124	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3216	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3324	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3596	1	1
Process32NextW July 9, 2022, 1:33 p.m.	snapshot_handle: 0x0000000000000154 process_name: regsvr32.exe process_identifier: 3612	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002be00', u'virtual_address': u'0x0001b000', u'entropy': 7.848244115365133, u'name': u'.rsrc', u'virtual_size': u'0x0002bc80'}

entropy

7.84824411537

description

A section with a high entropy has been found

entropy

0.654850746269

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (2 events)

process	regsvr32.exe
process	rundll32.exe

Communicates with host for which no DNS query was performed (8 events)

host	104.168.155.143
host	144.202.108.116
host	149.56.131.28
host	164.90.222.65
host	172.105.226.75
host	196.218.30.83
host	207.148.79.14
host	213.239.212.5

Installs itself for autorun at Windows startup (1 event)

service_name

hyoafnKWtJAy.dll

service_path

C:\Windows\System32\regsvr32.exe "C:\Windows\system32\RPhdXxV\hyoafnKWtJAy.dll"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW July 9, 2022, 1:33 p.m.	service_start_name: start_type: 2 password: display_name: hyoafnKWtJAy.dll filepath: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\RPhdXxV\hyoafnKWtJAy.dll" service_name: hyoafnKWtJAy.dll filepath_r: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RPhdXxV\hyoafnKWtJAy.dll" desired_access: 2 service_handle: 0x00000000003951c0 error_control: 0 service_type: 16 service_manager_handle: 0x000000000036ed20	1	3756480	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Elastic	malicious (moderate confidence)
DrWeb	Trojan.Emotet.1203
FireEye	Generic.mg.ea0d73a321582562
McAfee	Emotet-FTY!EA0D73A32158
Cyren	W64/Emotet.ELT.gen!Eldorado
ESET-NOD32	a variant of Win64/Kryptik.DHR
Kaspersky	Trojan.Win64.Strab.n
Avast	BotX-gen [Trj]
TrendMicro	TrojanSpy.Win64.EMOTET.SMYXCFC
McAfee-GW-Edition	Emotet-FTY!EA0D73A32158
ZoneAlarm	Trojan.Win64.Strab.n
Microsoft	Trojan:Win64/Emotet.BY!MTB
AhnLab-V3	Malware/Win.FTY.R503424
Rising	Trojan.Kryptik!8.8 (C64:YzY0OqasBLIYLZhS)
Fortinet	W64/Emotet.F1DB!tr
AVG	BotX-gen [Trj]

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\RPhdXxV\hyoafnKWtJAy.dll:Zone.Identifier

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	144.202.108.116:8080
dead_host	207.148.79.14:8080
dead_host	164.90.222.65:443
dead_host	196.218.30.83:443
dead_host	104.168.155.143:8080

NxYwE8FyaIw3Kgile

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All