Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 23, 2023, 9:16 a.m.	June 23, 2023, 9:19 a.m.

Size	54.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`e53d7ba028f3df8918c7447db0e05df8`
SHA256	`1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877`
CRC32	`3C33D5A8`
ssdeep	`1536:lDm8aNg+j7Ahr26oXZzZZpAsWnBCcdGje5WcA:7aNHmq6oXZzZT+jGjeB`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature ASPack_Zero - ASPack packed file IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_backup_init
2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_backup_step
2152
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_backup_finish
1156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_close
2248
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_column_text
2344
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_errcode
2440
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_exec
2536
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_finalize
2628
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_free
2740
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_open
2848
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_prepare_v2
2940
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,sqlite3_step
3036
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\sqlite3.dll,
2132

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (12 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0
IsDebuggerPresent June 23, 2023, 9:16 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.aspack
section	.adata

The executable uses a known packer (1 event)

packer

ASPack v2.12 -> Alexey Solodovnikov

Allocates read-write-execute memory (usually to unpack itself) (36 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 1156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 1156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 1156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 2940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 23, 2023, 9:16 a.m.	process_identifier: 3036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00005a00', u'virtual_address': u'0x00001000', u'entropy': 7.99112742126531, u'name': u'.text', u'virtual_size': u'0x0000a000'}

entropy

7.99112742127

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000c00', u'virtual_address': u'0x00013000', u'entropy': 7.505404911525846, u'name': u'.reloc', u'virtual_size': u'0x00001000'}

entropy

7.50540491153

description

A section with a high entropy has been found

entropy

0.476635514019

description

Overall entropy of this PE file is high

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Bkav	W32.AIDetectMalware
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_90% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
McAfee-GW-Edition	BehavesLike.Win32.Trojan.qh
FireEye	Generic.mg.e53d7ba028f3df89
Microsoft	Trojan:Win32/Casdet!rfn
McAfee	Artemis!E53D7BA028F3
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Agent
BitDefenderTheta	Gen:NN.ZedlaF.36270.dy4baWmvH4

sqlite3.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All