Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 8, 2023, 1:59 p.m.	March 8, 2023, 2 p.m.

Size	616.5KB
Type	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
MD5	`fe1097b9754d8e3c54c7f54c68c4dabd`
SHA256	`0442c122d6e81814ff1393a1cf430a4173acdf1b9df8228fe7bd3fc32455a9cc`
CRC32	`BD198DEC`
ssdeep	`12288:nbHoJMjhwwvAQ4c3wSlnJTrmONFV7iDpSpyNlTgibIUdzhnQawN/JsjHz:nbHoJMjx4c3wcFZSSpyNlcixzNQa0/m`
Yara	Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AJnzwdBqMvQICBAjnC
2560
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AJnzwdBqMvQICBAjnC
  3064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,APQGYdJtrkXhXkwzKFBCTvI
2644
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,APQGYdJtrkXhXkwzKFBCTvI
  3056
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AQuPFhYruxzxA
2736
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AQuPFhYruxzxA
  2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AbBwdZitlWefdERaOavJlIen
2824
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AbBwdZitlWefdERaOavJlIen
  2264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AbPYWiwTVDHFpfYBJn
2920
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AbPYWiwTVDHFpfYBJn
  2556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AfvxTJEA
3008
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AfvxTJEA
  2616
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AvxJWNrnX
1264
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,AvxJWNrnX
  2716
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,BUERlq
2428
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,BUERlq
  3004
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,Bqptqdk
2728
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,Bqptqdk
  3044
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,BslfqQGNXqTuUepvauCkQ
2952
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,BslfqQGNXqTuUepvauCkQ
  2444
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CNsPbULXjYvkd
2508
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CNsPbULXjYvkd
  2436
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CXSfiCTm
2864
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CXSfiCTm
  2820
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CfdextKrifuW
1484
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CfdextKrifuW
  2792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CfsWcZWQVlifNwBDgGRZIqif
2564
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CfsWcZWQVlifNwBDgGRZIqif
  2740
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,ClqIyzBkLjDFLJ
320
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,ClqIyzBkLjDFLJ
  2228
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CgdlGBNRFRzTzmfguqz
2524
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,CgdlGBNRFRzTzmfguqz
  2320
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DCLGmuYl
2532
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DCLGmuYl
  2980
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DEaqEFNRtMCaaVnaAUQtMbKum
2828
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DEaqEFNRtMCaaVnaAUQtMbKum
  2220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DCQZVUAVgMiARD
2124
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DCQZVUAVgMiARD
  2592
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DIXpgfZZxsBhi
2180
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DIXpgfZZxsBhi
  3224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DJFaUyIipeGIfwlkpX
3076
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DJFaUyIipeGIfwlkpX
  3260
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DVPdiFeTcDmXs
3176
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DVPdiFeTcDmXs
  3336
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DhYIKjxmGGYY
3404
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DhYIKjxmGGYY
  3492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DiwnEUvduBkM
3552
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DiwnEUvduBkM
  3932
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DllRegisterServer
3648
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DllRegisterServer
  4048
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JXHRMZvSx\tbvybWhUshyYeHmM.dll"
    5028
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DrgYCMNiVbrUGwRTpRdvxI
3736
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,DrgYCMNiVbrUGwRTpRdvxI
  3136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EEjaFHKntpLIhbdTrDK
3828
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EEjaFHKntpLIhbdTrDK
  3104
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EdTDhMMiYAFBShyYKs
3924
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EdTDhMMiYAFBShyYKs
  3356
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EkMGlO
4080
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EkMGlO
  2104
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EnsJjCOccyCjAVZkRnVMDMVZ
2960
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EnsJjCOccyCjAVZkRnVMDMVZ
  3544
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EpwzPNUZHdojuinzfIpfYQ
3516
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EpwzPNUZHdojuinzfIpfYQ
  3748
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EyuImeQbPHMFKzOFVqc
3716
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,EyuImeQbPHMFKzOFVqc
  3364
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FJAVswpuwGKsMXPsiiQRYv
3952
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FJAVswpuwGKsMXPsiiQRYv
  3380
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FOWbUDfELrAQAEKqJf
4076
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FOWbUDfELrAQAEKqJf
  3572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FQLPnQNLD
3284
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FQLPnQNLD
  3668
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FWSKyRQMOuWSm
3816
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FWSKyRQMOuWSm
  3192
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FQbFKHXX
3112
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FQbFKHXX
  3836
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FWVdsLrtEVBzLaCmZNEpx
3096
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FWVdsLrtEVBzLaCmZNEpx
  3340
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FeGqog
3084
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FeGqog
  3464
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FkcAXdH
3892
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FkcAXdH
  3628
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FqDNSXzugPznspUD
3388
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,FqDNSXzugPznspUD
  3972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GQAlasmiaEy
3592
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GQAlasmiaEy
  3436
explorer.exe C:\Windows\Explorer.EXE
1452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GQjtxdyXvtsqdfVrQBqm
3720
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GQjtxdyXvtsqdfVrQBqm
  3884
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GdiMTODVmsR
3920
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GdiMTODVmsR
  3400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GxxJJdRIqTBJAMnBIcxq
3908
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,GxxJJdRIqTBJAMnBIcxq
  4208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,HOnlfLBWkQCooC
4156
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,HOnlfLBWkQCooC
  4400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,HWTqOVHRABB
4288
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,HWTqOVHRABB
  4428
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,IOMcKFaJXihdqDAogVN
4392
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,IOMcKFaJXihdqDAogVN
  4620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,IpoojIRy
4564
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,IpoojIRy
  4776
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,IvvQFcaABzyyLhduvbY
4700
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,IvvQFcaABzyyLhduvbY
  4812
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,JFrkuFzJMrWvkaYOQlJ
4852
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,JUBJYfmZGotuEKSafNPlGEAMy
4972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,JheZxhw
5108
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,JkoaHQBWgZLoeIqdRFVkMlq
4284
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,JlscSxwnKrxRmaJ
4440
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,JpqPCRXJWOy
4552
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,JvcfiztFAuNa
4740
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KStKTzwWJbprlqO
4292
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KWLauUGkNHofayeYLCFSpOfuXl
5012
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KYEVLHhbRMHw
3508
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KZwwxlBTSHOg
4200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KnTTKeu
4212
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KrldazbljxeAJoh
4680
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KvQcPVBCIwQMISVMmy
4560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KwTVqLAsKCaCz
4148
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KyLhcvzfifBtOE
828
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,KzpAtJXTRJRN
4684
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,LDldVNlhAieNMMtCa
4876
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,LXxoKBfNdArZYQncLEi
1304
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,LbGmmSnPyxEOeYshUChQLjrUg
4380
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\pzOEfyaZPW1OyO690Z19HEU7.dll,LjYfYsPmJSQelB
4612

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (48 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0
IsDebuggerPresent March 8, 2023, 1:52 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 8, 2023, 1:52 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.rodata

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

KKSXQOO

Allocates read-write-execute memory (usually to unpack itself) (50 out of 156 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3056 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3064 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2064 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2616 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2556 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000002d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2716 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000004d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2264 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000004e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3004 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3044 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000004d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3044 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000004e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2444 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2444 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2436 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2820 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2792 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2740 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002070000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2320 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002050000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2228 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2980 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 8, 2023, 1:52 p.m.	process_identifier: 2980 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JXHRMZvSx\tbvybWhUshyYeHmM.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (9 events)

Time & API	Arguments	Status	Return
Process32NextW March 8, 2023, 1:52 p.m.	snapshot_handle: 0x0000000000000124 process_name: pw.exe process_identifier: 2324	1	1
Process32NextW March 8, 2023, 1:52 p.m.	snapshot_handle: 0x0000000000000124 process_name: taskhost.exe process_identifier: 2376	1	1
Process32NextW March 8, 2023, 1:53 p.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 4564	1	1
Process32NextW March 8, 2023, 1:53 p.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 4700	1	1
Process32NextW March 8, 2023, 1:53 p.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 4776	1	1
Process32NextW March 8, 2023, 1:53 p.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 4812	1	1
Process32NextW March 8, 2023, 1:53 p.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 4852	1	1
Process32NextW March 8, 2023, 1:53 p.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 4972	1	1
Process32NextW March 8, 2023, 1:53 p.m.	snapshot_handle: 0x0000000000000148 process_name: regsvr32.exe process_identifier: 5028	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002be00', u'virtual_address': u'0x00086000', u'entropy': 7.834631838647657, u'name': u'.rsrc', u'virtual_size': u'0x0002be00'}

entropy

7.83463183865

description

A section with a high entropy has been found

entropy

0.285598047193

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (2 events)

process	regsvr32.exe
process	rundll32.exe

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\JXHRMZvSx\tbvybWhUshyYeHmM.dll:Zone.Identifier

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Elastic	malicious (moderate confidence)
Cynet	Malicious (score: 100)
Sangfor	Spyware.Win64.Emotet.V0ir
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win64/Emotet.AH
Kaspersky	UDS:Trojan-Banker.Win64.Emotet.cmsv
BitDefender	Trojan.GenericKD.65828879
MicroWorld-eScan	Trojan.GenericKD.65828879
Rising	Trojan.Emotet!8.B95 (CLOUD)
TrendMicro	TrojanSpy.Win64.EMOTET.YXDCGZ
McAfee-GW-Edition	BehavesLike.Win64.Infected.jh
FireEye	Trojan.GenericKD.65828879
GData	Win32.Trojan-Spy.Emotet.KKA17T
Webroot	W32.Trojan.Emotet
MAX	malware (ai score=85)
Gridinsoft	Malware.Win64.Emotet.bot
Microsoft	Trojan:Win64/Emotet.AL!MTB
McAfee	Artemis!FE1097B9754D
TrendMicro-HouseCall	TrojanSpy.Win64.EMOTET.YXDCGZ
Ikarus	Trojan-Spy.Emotet
MaxSecure	Trojan.Malware.300983.susgen

pzOEfyaZPW1OyO690Z19HEU7.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All