Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 11, 2024, 1:16 p.m.	July 11, 2024, 1:24 p.m.

Size	93.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`d4ef22f79c607984534fb8a21fce15ac`
SHA256	`4957a62e019c30c0a79e4d2d4dd854f6e8f6e0aadb606e157525d98ee0ac5096`
CRC32	`C37665C0`
ssdeep	`1536:OQeso/1HQ6QAthRk/qi4jCv+yUF/5RdsuAxASqnsANNmsWHcdyPZGOj1qx5VqH:loBUAt8qiY++nF/5RAANryPZVC5VqH`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\krpt.dll,krpt_RegisterWERHandler
1476
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\krpt.dll,?_force_link_krpt@@YGXXZ
1616
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\krpt.dll,krpt_RemoveDllFilterProtectDetour
2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\krpt.dll,krpt_RemoveRuntimeProtectDetour
2156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\krpt.dll,krpt_RuntimeProtect
2252
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\krpt.dll,krpt_UnRegisterWERHandler
2348
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\krpt.dll,
2480

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 11, 2024, 1:16 p.m.			0	0
IsDebuggerPresent July 11, 2024, 1:16 p.m.			0	0
IsDebuggerPresent July 11, 2024, 1:16 p.m.			0	0
IsDebuggerPresent July 11, 2024, 1:16 p.m.			0	0
IsDebuggerPresent July 11, 2024, 1:16 p.m.			0	0
IsDebuggerPresent July 11, 2024, 1:16 p.m.			0	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 11, 2024, 1:16 p.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Bkav	W32.AIDetectMalware
Sangfor	Trojan.Win32.Agent.V6q1
CrowdStrike	win/malicious_confidence_70% (D)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Generik.MHJYVPM
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Alibaba	Trojan:Win32/CobaltStrike.42451a9c
McAfeeD	ti!4957A62E019C
Trapmine	suspicious.low.ml.score
Antiy-AVL	Trojan/Win32.CobaltStrike
Kingsoft	Win32.Trojan.Yephiler.cmd
TrendMicro-HouseCall	TROJ_GEN.R002H01GA24
Ikarus	Trojan.Win32.CobaltStrike
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.ESQQ!tr

krpt.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All