Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 13, 2024, 9:22 a.m.	Sept. 13, 2024, 9:32 a.m.

Size	882.5KB
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`5fb15984b6312b2de010679b77c2e3b4`
SHA256	`5cde683048593333b3dee736f8b160675c981f497ed0d680d596e9b34c2a174b`
CRC32	`1B99694F`
ssdeep	`24576:0yt4lxbRvESj873+qNIAh4xhlP0PFTvisj01z6CKCCYzuRdMY:0yt4nbRvESj873h2q4xhF0dTvisj012X`
PDB Path	B:\LoadDll6\LoadDll\result\Release\libcurl.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,CheckLicense
2560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,DllInitialize
2644
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,DllInstall
2736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,Export
2828
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,GetDllVersion
2924
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,Init
3024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,InitDll
2084
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,RegisterDll
196
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,ThreadFunction
2424
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_cleanup
2572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_init
2720
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_perform
2880
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,curl_easy_setopt
2992
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\useraccount.aspx.dll,
800

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (13 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0
IsDebuggerPresent Sept. 13, 2024, 9:22 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

B:\LoadDll6\LoadDll\result\Release\libcurl.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 13, 2024, 9:22 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 13, 2024, 9:22 a.m.	stacktrace: New_kernel32_CreateProcessInternalW@48+0x185 New_kernel32_CreateRemoteThread@28-0x16b @ 0x736e7747 CreateProcessW+0x2c CreateProcessA-0x9 kernel32+0x11069 @ 0x755c1069 GetHookAPIs-0x37ddc aclayers+0x1266d @ 0x741a266d curl_easy_cleanup+0x112f curl_easy_init-0x1781 useraccount+0x6e49f @ 0x7206e49f rundll32+0x137d @ 0xb7137d rundll32+0x1326 @ 0xb71326 rundll32+0x1901 @ 0xb71901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 66 89 08 39 9d 7c fc ff ff 0f 85 ff 3a 01 00 8d exception.symbol: RegisterApplicationRestart+0x25f DeleteFiber-0xd7 kernel32+0x3b79b exception.instruction: mov word ptr [eax], cx exception.module: kernel32.dll exception.exception_code: 0xc0000005 exception.offset: 243611 exception.address: 0x755eb79b registers.esp: 651484 registers.edi: 1913284290 registers.eax: 1913284290 registers.ebp: 653088 registers.edx: 5702004 registers.ebx: 0 registers.esi: 32 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 13, 2024, 9:22 a.m.

stacktrace:

New_kernel32_CreateProcessInternalW@48+0x185 New_kernel32_CreateRemoteThread@28-0x16b @ 0x736e7747
CreateProcessW+0x2c CreateProcessA-0x9 kernel32+0x11069 @ 0x755c1069
GetHookAPIs-0x37ddc aclayers+0x1266d @ 0x741a266d
curl_easy_cleanup+0x112f curl_easy_init-0x1781 useraccount+0x6e49f @ 0x7206e49f
rundll32+0x137d @ 0xb7137d
rundll32+0x1326 @ 0xb71326
rundll32+0x1901 @ 0xb71901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 66 89 08 39 9d 7c fc ff ff 0f 85 ff 3a 01 00 8d
exception.symbol: RegisterApplicationRestart+0x25f DeleteFiber-0xd7 kernel32+0x3b79b
exception.instruction: mov word ptr [eax], cx
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 243611
exception.address: 0x755eb79b
registers.esp: 651484
registers.edi: 1913284290
registers.eax: 1913284290
registers.ebp: 653088
registers.edx: 5702004
registers.ebx: 0
registers.esi: 32
registers.ecx: 0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 101 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2736 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 3024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 2084 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 13, 2024, 9:22 a.m.	process_identifier: 196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720a6000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00010400', u'virtual_address': u'0x00705000', u'entropy': 6.840022277688668, u'name': u'.reloc', u'virtual_size': u'0x00010398'}

entropy

6.84002227769

description

A section with a high entropy has been found

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	Windows.Trojan.Matanbuchus
Cynet	Malicious (score: 100)
VIPRE	Trojan.GenericKD.73821289
Sangfor	Trojan.Win32.Agent.Vxj5
K7AntiVirus	Riskware ( 00584baa1 )
BitDefender	Trojan.GenericKD.73821289
K7GW	Riskware ( 00584baa1 )
Arcabit	Trojan.Generic.D4666C69
Symantec	Trojan.Gen.MBT
Avast	Win32:MalwareX-gen [Trj]
Alibaba	Trojan:Win32/Matanbuchus.a1b60afb
MicroWorld-eScan	Trojan.GenericKD.73821289
Rising	Trojan.ShellCodeLoader!1.F9AF (CLASSIC)
Emsisoft	Trojan.GenericKD.73821289 (B)
TrendMicro	Trojan.Win32.MATANBUCHUS.YXEHKZ
McAfeeD	ti!5CDE68304859
FireEye	Generic.mg.5fb15984b6312b2d
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI - Suspicious PE
Google	Detected
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:Win32/Matanbuchus.DA!MTB
GData	Trojan.GenericKD.73821289
Varist	W32/ABTrojan.GTQY-6215
AhnLab-V3	Malware/Win.Generic.C5657848
BitDefenderTheta	Gen:NN.ZedlaF.36812.3q4@ayb4Vdj
DeepInstinct	MALICIOUS
TrendMicro-HouseCall	Trojan.Win32.MATANBUCHUS.YXEHKZ
MaxSecure	Trojan.Malware.274532176.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

useraccount.aspx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All