Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 11, 2024, 10:03 a.m.	Nov. 11, 2024, 10:16 a.m.

Size	80.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`e49624fdefe90d426e67d821094e6b3b`
SHA256	`b1631299df6798f0e80bfe1a5fe38edb345722e042fdf614bddc17cc72128ae5`
CRC32	`25CC5A65`
ssdeep	`1536:ahupteOe1FzWrSN+ie8uI/HE3nMlgOHS8uVsWJkcdSytaWbLnbTP9:NptczUSN+l+HEGbuDSiaWbLbTP`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\tpsvcBase.dll,Z1
2560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\tpsvcBase.dll,
2644

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2024, 10:03 a.m.			0	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 11, 2024, 10:03 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.esp: 34864536 registers.edi: 0 registers.eax: 1968976824 registers.ebp: 34864544 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bfe000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Nov. 11, 2024, 10:03 a.m.	process_identifier: 2560 region_size: 0 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff		3221225714

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MyAppName

reg_value

C:\Windows\SysWOW64\rundll32.exe

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Lionic	Trojan.Win32.Loader.4!c
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.74673089
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74673089
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKD.74673089
K7GW	Trojan ( 005bced11 )
K7AntiVirus	Trojan ( 005bced11 )
Arcabit	Trojan.Generic.D4736BC1
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ShellcodeRunner.KE
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	Trojan.Win32.Loader.mpf
Alibaba	Trojan:Win32/Loader.92623f90
MicroWorld-eScan	Trojan.GenericKD.74673089
Rising	Trojan.ShellcodeRunner!8.6166 (CLOUD)
Emsisoft	Trojan.GenericKD.74673089 (B)
F-Secure	Trojan.TR/Agent.puxxv
DrWeb	Trojan.Loader.2241
McAfeeD	ti!B1631299DF67
CTX	dll.trojan.loader
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Shellcoderunner
FireEye	Generic.mg.e49624fdefe90d42
Google	Detected
Avira	TR/Agent.puxxv
Antiy-AVL	Trojan/Win32.Loader
Kingsoft	Win32.Troj.Unknown.a
Xcitium	Malware@#1y6xttockp9mp
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.74673089
Varist	W32/ABTrojan.CFHX-4299
AhnLab-V3	Trojan/Win.Generic.R675877
McAfee	Artemis!E49624FDEFE9
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.ShellCode
Panda	Trj/Chgt.AD
Tencent	Win32.Trojan.Loader.Zolw
MaxSecure	Trojan.Malware.296767883.susgen
Fortinet	W32/ShellcodeRunner.KE!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

tpsvcBase.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All