Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 26, 2023, 3:06 p.m.	June 26, 2023, 3:09 p.m.

Size	254.4KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`fb83690fe7e7e0d3a8f40b110de316d0`
SHA256	`9397f73f7ce35bf66739792b179ee61414b274655a636296f6ce5b437b08827f`
CRC32	`F43E8EDA`
ssdeep	`3072:OFBbQF3jRCiJc4PUFVVs6B+R0XCV6pWmqs2/z4fLewiQa+myefA9YV4FumBFx7:OFBbQF3NCKc4P2jB+3ce/Baz9YkBb7`
PDB Path	D:\searchclick_module\nop\micro\microengine\Release\microengine.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\microengine.dll,DllCanUnloadNow
524
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\microengine.dll,DllInstall
2144
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\microengine.dll,DllGetClassObject
2052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\microengine.dll,DllRegisterServer
2232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\microengine.dll,DllUnregisterServer
2332
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\microengine.dll,
2436

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 26, 2023, 3:06 p.m.			0	0
IsDebuggerPresent June 26, 2023, 3:06 p.m.			0	0
IsDebuggerPresent June 26, 2023, 3:06 p.m.			0	0
IsDebuggerPresent June 26, 2023, 3:06 p.m.			0	0
IsDebuggerPresent June 26, 2023, 3:06 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\searchclick_module\nop\micro\microengine\Release\microengine.pdb

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	REGISTRY
resource name	TYPELIB

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744aa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744aa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744aa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744aa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74390000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744aa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 26, 2023, 3:06 p.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e1000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (5 events)

name

REGISTRY

language

LANG_KOREAN

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_KOREAN

offset

0x0003e4a8

size

0x0000044c

name

REGISTRY

language

LANG_KOREAN

filetype

ASCII text, with CRLF line terminators

sublanguage

SUBLANG_KOREAN

offset

0x0003e4a8

size

0x0000044c

name

TYPELIB

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x0003e8f8

size

0x00000648

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x0003ef40

size

0x00000036

name

RT_VERSION

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x0003e1d0

size

0x000002c8

Installs a Browser Helper Object to thwart the users browsing experience (2 events)

bho_regkey	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{358D8A21-5EFC-46CB-AAA6-B1552639222D}\NoExplorer
bho_regkey	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{358D8A21-5EFC-46CB-AAA6-B1552639222D}\(Default)

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Lionic	Adware.Win32.Convagent.2!c
Elastic	malicious (high confidence)
McAfee	Artemis!FB83690FE7E7
Cylance	Unsafe
Sangfor	Adware.Win32.Convagent.gen
ESET-NOD32	a variant of Win32/Adware.Searchclick.A
Paloalto	generic.ml
Kaspersky	not-a-virus:VHO:AdWare.Win32.Convagent.gen
SUPERAntiSpyware	Adware.SearchClick/Variant
Avast	FileRepMalware
Tencent	Win32.Risk.Adware.Efkl
Sophos	Generic PUA LH (PUA)
Comodo	ApplicUnwnt@#3agiupi8hkq4j
TrendMicro	Adware.Win32.SearchClick.A
McAfee-GW-Edition	Artemis!PUP
Emsisoft	Application.AdSearch (A)
Jiangmin	Adware.Agent.alrt
Gridinsoft	Adware.Gen.dd!c
Microsoft	PUA:Win32/Creprote
ViRobot	Adware.Searchclick.260464
ZoneAlarm	not-a-virus:VHO:AdWare.Win32.Convagent.gen
GData	Win32.Adware.SearchClick.E
AhnLab-V3	PUP/Win32.Helper.C681592
VBA32	AdWare.Agent
Malwarebytes	Malware.AI.4271648589
TrendMicro-HouseCall	Adware.Win32.SearchClick.A
Rising	PUF.Bitrepeyp!8.10836 (CLOUD)
SentinelOne	Static AI - Suspicious PE
Fortinet	W32/Generic_PUA_LH.A
AVG	FileRepMalware

microengine.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All