output_64.dll| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | June 12, 2023, 8:56 a.m. | June 12, 2023, 9 a.m. |
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,GetInstallDetailsPayload
2552-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,GetInstallDetailsPayload
2960
-
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,SignalChromeElf
2636-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,SignalChromeElf
3016-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,SignalChromeElf
2436
-
-
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,Version
2728-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,Version
2088
-
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,load
2816-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,load
1484-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,load
2508-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,load
2668-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,load
2760
-
-
-
-
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,run
2912-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,run
152
-
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_64.dll,
744
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 91.208.236.70 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| pdb_path | C:\Users\è°·å \Desktop\2022è¿ç¨ç®¡çgfi\cangku\WinOsClientProject\x64\Release\ä¸çº¿æ¨¡å.pdb |
| description | rundll32.exe tried to sleep 590 seconds, actually delayed analysis time by 590 seconds | |||
| host | 91.208.236.70 | |||
| registry | HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString |
| dead_host | 91.208.236.70:6000 |
| MicroWorld-eScan | Gen:Variant.Ulise.404777 |
| ALYac | Gen:Variant.Ulise.404777 |
| Malwarebytes | Malware.AI.4097583061 |
| VIPRE | Gen:Variant.Ulise.404777 |
| Sangfor | Trojan.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_70% (D) |
| Arcabit | Trojan.Ulise.D62D29 |
| Cyren | W64/Agent.GAP.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of Win64/Spy.Agent.EE |
| Cynet | Malicious (score: 100) |
| ClamAV | Win.Malware.Barys-10002228-0 |
| Kaspersky | HEUR:Trojan-Spy.Win64.AntiAV.gen |
| BitDefender | Gen:Variant.Ulise.404777 |
| Avast | Win64:TrojanX-gen [Trj] |
| Tencent | Malware.Win32.Gencirc.10bdd3bd |
| Emsisoft | Gen:Variant.Ulise.404777 (B) |
| Zillya | Trojan.Agent.Win64.24920 |
| FireEye | Gen:Variant.Ulise.404777 |
| MAX | malware (ai score=83) |
| Antiy-AVL | Trojan[Spy]/Win64.AntiAV |
| Microsoft | Trojan:Script/Phonzy.A!ml |
| ZoneAlarm | HEUR:Trojan-Spy.Win64.AntiAV.gen |
| GData | Gen:Variant.Ulise.404777 |
| Detected | |
| AhnLab-V3 | Trojan/Win.Backdoor.R563961 |
| McAfee | GenericRXAA-AA!91479A5BAD88 |
| Rising | Backdoor.Farfli!1.DE41 (CLASSIC) |
| Yandex | TrojanSpy.Agent!x5bE/mVN39A |
| Ikarus | Trojan.Win64.Spy |
| MaxSecure | Trojan.Malware.186401462.susgen |
| AVG | Win64:TrojanX-gen [Trj] |
| DeepInstinct | MALICIOUS |