Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 12, 2023, 8:56 a.m.	June 12, 2023, 8:58 a.m.

Size	254.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`66e7b3b20b4d259f0056624ed55e917f`
SHA256	`da6b0d8b57393f33a09ce707ca76027710f0c6a6a32a09b7a32ed2b17c61cc37`
CRC32	`7CCD76EB`
ssdeep	`6144:6B/MHi3tcfAA4hqtjRR5iZxyMK9PTBYdqCU4rN:6BUC36TVmZxyMK9PTq`
PDB Path	C:\Users\è°·å \Desktop\2022è¿ç¨ç®¡çgfi\cangku\WinOsClientProject\Release\ä¸çº¿æ¨¡å.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library anti_vm_detect - Possibly employs anti-virtualization techniques Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Antivirus - Contains references to security software IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,SignalChromeElf
2672
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,GetInstallDetailsPayload
2588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,Version
2764
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,load
2852
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,run
2948
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,
3044

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
91.208.236.70	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 12, 2023, 8:56 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:56 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:56 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:56 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:56 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\è°·å \Desktop\2022è¿ç¨ç®¡çgfi\cangku\WinOsClientProject\Release\ä¸çº¿æ¨¡å.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 12, 2023, 8:57 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 100 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7394b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73661000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735f0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73471000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73434000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73502000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73301000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7394b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73661000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735f0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73471000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73434000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73502000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73301000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7394b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:56 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

rundll32.exe tried to sleep 429 seconds, actually delayed analysis time by 429 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW June 12, 2023, 8:57 a.m.	total_number_of_free_bytes: 13324333056 free_bytes_available: 13324333056 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW June 12, 2023, 8:57 a.m.	total_number_of_free_bytes: 13324333056 free_bytes_available: 13324333056 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW June 12, 2023, 8:57 a.m.	total_number_of_free_bytes: 13324333056 free_bytes_available: 13324333056 root_path: C:\ total_number_of_bytes: 34252779520	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 events)

Time & API	Arguments	Status	Return
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2588	1	1
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2672	1	1
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2852	1	1
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948	1	1

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 108 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000334 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x00000354 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0
Process32NextW June 12, 2023, 8:57 a.m.	snapshot_handle: 0x000002f8 process_name: rundll32.exe process_identifier: 2948		0	0

Communicates with host for which no DNS query was performed (1 event)

host

91.208.236.70

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

91.208.236.70:6000

output_32.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All