procMemory | ZeroBOX

Process memory dump for test10.exe (PID 2244, dump 1)

Extracted/injected images (may contain unpacked executables)
Download #1

Yara signatures matches on process memory

Match: Network_TCP_Socket

V1MyXzMyLmRsbA== (WS2_32.dll)
V1NBU3RhcnR1cA== (WSAStartup)
Y29ubmVjdA== (connect)
c29ja2V0 (socket)
c2VuZA== (send)

Match: Network_DGA

Q1JZUFQzMi5kbGw= (CRYPT32.dll)
Q3J5cHRBY3F1aXJlQ29udGV4dA== (CryptAcquireContext)
Q3J5cHRDcmVhdGVIYXNo (CryptCreateHash)
Q3J5cHRIYXNoRGF0YQ== (CryptHashData)
QURWQVBJMzIuRExM (ADVAPI32.DLL)
QURWQVBJMzIuZGxs (ADVAPI32.dll)
R2V0U3lzdGVtVGltZQ== (GetSystemTime)
R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU= (GetSystemTimeAsFileTime)
SW50ZXJuZXRPcGVu (InternetOpen)
SW50ZXJuZXRPcGVuVXJs (InternetOpenUrl)
V0lOSU5FVC5kbGw= (WININET.dll)
Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)

Match: Str_Win32_Http_API

SHR0cFF1ZXJ5SW5mbw== (HttpQueryInfo)

Match: Generic_PWS_Memory_Zero

UGFzc3dvcmQ= (Password)
cGFzc3dvcmQ= (password)

Match: Network_DNS

RE5TQVBJLmRsbA== (DNSAPI.dll)
RG5zUXVlcnk= (DnsQuery)
V1MyXzMyLmRsbA== (WS2_32.dll)
Z2V0aG9zdGJ5bmFtZQ== (gethostbyname)

Match: ScreenShot

Qml0Qmx0 (BitBlt)
R0RJMzIuZGxs (GDI32.dll)
VVNFUjMyLkRMTA== (USER32.DLL)
VVNFUjMyLmRsbA== (USER32.dll)

Match: Str_Win32_Internet_API

SW50ZXJuZXRDbG9zZUhhbmRsZQ== (InternetCloseHandle)
SW50ZXJuZXRPcGVu (InternetOpen)
SW50ZXJuZXRSZWFkRmlsZQ== (InternetReadFile)

Match: DebuggerCheck__GlobalFlags

TnRHbG9iYWxGbGFncw== (NtGlobalFlags)

Match: DebuggerCheck__QueryInfo

UXVlcnlJbmZvcm1hdGlvblByb2Nlc3M= (QueryInformationProcess)

Match: DebuggerHiding__Thread

U2V0SW5mb3JtYXRpb25UaHJlYWQ= (SetInformationThread)

Match: DebuggerHiding__Active

RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)

Match: DebuggerException__SetConsoleCtrl

U2V0Q29uc29sZUN0cmxIYW5kbGVy (SetConsoleCtrlHandler)

Match: ThreadControl__Context

U2V0VGhyZWFkQ29udGV4dA== (SetThreadContext)

Match: SEH__vectored

QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (AddVectoredExceptionHandler)
UmVtb3ZlVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy (RemoveVectoredExceptionHandler)

Match: anti_dbg

RGVidWdBY3RpdmVQcm9jZXNz (DebugActiveProcess)
S0VSTkVMMzIuRExM (KERNEL32.DLL)
S0VSTkVMMzIuZGxs (KERNEL32.dll)
SXNEZWJ1Z2dlclByZXNlbnQ= (IsDebuggerPresent)
T3V0cHV0RGVidWdTdHJpbmc= (OutputDebugString)

Match: disable_dep

TnRTZXRJbmZvcm1hdGlvblByb2Nlc3M= (NtSetInformationProcess)
WndQcm90ZWN0VmlydHVhbE1lbW9yeQ== (ZwProtectVirtualMemory)

URLs found in process memory

    http://www.openssl.org/support/faq.html

Process memory dump for None (PID 2360, dump 1)