Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 3, 2023, 8:20 a.m.	April 3, 2023, 8:26 a.m.

Size	19.0MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`61131c939b98075c07e189830ff2879d`
SHA256	`8b9b5bd8b2621c1c2fd22bd488ec94882c93539b51f14ac29e64951c0b84cee8`
CRC32	`8F34EB96`
ssdeep	`393216:h+1bdhXQJbhhYK8tjYQJf8adkTUwAly0XWmDRvyCJSx:hebbXyVq1J8qjTB5yRx`
Yara	IsDLL - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ntredirect.dll,Entry
2568
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\ntredirect.dll,
2652

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
192.253.237.20	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status
NtProtectVirtualMemory April 3, 2023, 8:20 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd93000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2023, 8:20 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2023, 8:20 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 3, 2023, 8:20 a.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1

section

{u'size_of_data': u'0x012daa00', u'virtual_address': u'0x00a94000', u'entropy': 7.857546206368168, u'name': u'.q*q', u'virtual_size': u'0x012da870'}

entropy

7.85754620637

description

A section with a high entropy has been found

entropy

0.99239250559

description

Overall entropy of this PE file is high

host

192.253.237.20

ntredirect.dll