Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 28, 2023, 5:36 p.m.	July 28, 2023, 5:43 p.m.

Size	2.4MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`4406fceeb2803aebc2345867a9ae292c`
SHA256	`f04715827e5453b33ba6fae8475b8c45150b27cc1361441648c46d13025283d2`
CRC32	`F3DD4AFC`
ssdeep	`49152:zc9IJxGbYcDnhX6hwQDUwHDdBS1xaQPswrawjF0NYSzvR5xHGy:zyI45PswrawjF0NYSzvR5xHt`
PDB Path	C:\Users\cmsystem\ahpwc\mc\mc_codec_sdk_dbginfo_win64_x64_release\mc_dec_avc.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\iiis12211221.iso.dll,h264in_Video_GetAPIExt
1188
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\iiis12211221.iso.dll,h264in_Video_GetAPIExt
  2300
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\iiis12211221.iso.dll,open_h264in_Video_stream
2056
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\iiis12211221.iso.dll,open_h264in_Video_stream
  2348
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\iiis12211221.iso.dll,open_h264in_Video_stream_ex
2156
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\iiis12211221.iso.dll,open_h264in_Video_stream_ex
  2384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\iiis12211221.iso.dll,
2248

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 28, 2023, 5:29 p.m.			0	0
IsDebuggerPresent July 28, 2023, 5:29 p.m.			0	0
IsDebuggerPresent July 28, 2023, 5:29 p.m.			0	0

pdb_path

C:\Users\cmsystem\ahpwc\mc\mc_codec_sdk_dbginfo_win64_x64_release\mc_dec_avc.pdb

section	text
section	data

Time & API	Arguments	Status	Return	Repeated
__exception__ July 28, 2023, 5:29 p.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 10 registers.rsi: 0 registers.r10: 10 registers.rbx: 196648 registers.rsp: 2227392 registers.r11: 2227040 registers.r8: 3064268 registers.r9: 10 registers.rdx: 4286709760 registers.r12: 10 registers.rbp: 3064112 registers.rdi: -1 registers.rax: 0 registers.r13: 0	1	0	0
__exception__ July 28, 2023, 5:29 p.m.	stacktrace: open_h264in_Video_stream+0x3 h264in_Video_GetAPIExt-0x14d iiis12211221+0x8393 @ 0x7fef3a78393 rundll32+0x2f42 @ 0xff822f42 rundll32+0x3b7a @ 0xff823b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: c1 0c 48 ff c9 48 ff c9 48 ff c9 f3 aa 48 8d 0c exception.instruction: ror dword ptr [rax + rcx*2], -1 exception.exception_code: 0xc0000005 exception.symbol: open_h264in_Video_stream+0x3 h264in_Video_GetAPIExt-0x14d iiis12211221+0x8393 exception.address: 0x7fef3a78393 registers.r14: 0 registers.r15: 0 registers.rcx: 65890 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1768352 registers.r11: 1767440 registers.r8: 2277872 registers.r9: 10 registers.rdx: 4286709760 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 65890 registers.r13: 0	1	0	0

iiis12211221.iso