Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 12, 2023, 6:47 p.m.	Aug. 12, 2023, 7:01 p.m.

Size	89.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`4c1e14380f4ba4aa5018e1dc7705b987`
SHA256	`c859fc5f8152939cd66236aebebde905457ca017e02c0e0c7c706d13e94fa7ec`
CRC32	`88E92069`
ssdeep	`1536:buON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUAaI89p:buhVZbtvbpxLHoUsYuNhV25LJUAaI89p`
PDB Path	D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals Win_Amadey_Zero - Amadey bot IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2144
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2332

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 12, 2023, 6:47 p.m.			0	0
IsDebuggerPresent Aug. 12, 2023, 6:47 p.m.			0	0
IsDebuggerPresent Aug. 12, 2023, 6:47 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74470000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744ef000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74470000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 12, 2023, 6:47 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74501000 process_handle: 0xffffffff	1

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All