Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 20, 2024, 9:13 a.m.	Nov. 20, 2024, 9:16 a.m.

Size	6.8KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`81056636619f2ddfd774916485d472f0`
SHA256	`bff9c2c2b429719d1a9b7663627d9db798165e1d9d53ace1f557ab776c508244`
CRC32	`C3F7D46C`
ssdeep	`96:hy859x0P8MalGdBZgmNq08KR7cVCpgbFZka48Uhf0qQi:F5oLuGHZgmw0PR7cVC8PO8Udr`
Yara	IsDLL - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\dll008.dll,rundll32
2560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\dll008.dll,
2644

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 20, 2024, 9:13 a.m.			0	0

The executable uses a known packer (1 event)

packer

Armadillo v1.xx - v2.xx

Allocates read-write-execute memory (usually to unpack itself) (11 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c12000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 20, 2024, 9:13 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1

File has been identified by 67 AntiVirus engines on VirusTotal as malicious (50 out of 67 events)

Bkav	W32.FamVT.DebrisA.Worm
Lionic	Worm.Win32.Debris.tsC7
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Agent.WL
Skyhigh	BehavesLike.Win32.Worm.xt
ALYac	Gen:Variant.Barys.63208
Cylance	Unsafe
VIPRE	Gen:Variant.Barys.63208
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Barys.63208
K7GW	EmailWorm ( 0040f5281 )
K7AntiVirus	EmailWorm ( 0040f5281 )
Arcabit	Trojan.Barys.DF6E8
Baidu	Win32.Worm.Bundpil.y
VirIT	Worm.Win32.Generic.GRN
Symantec	Downloader.Dromedan
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Bundpil.AO
APEX	Malicious
Avast	Win32:Sg-I [Trj]
ClamAV	Win.Adware.Downware-251
Kaspersky	Worm.Win32.Debris.b
Alibaba	Malware:Win32/km_2a460.None
NANO-Antivirus	Trojan.Win32.Debris.cqkxyu
SUPERAntiSpyware	Trojan.Agent/Gen-Crypt
MicroWorld-eScan	Gen:Variant.Barys.63208
Rising	Worm.Gamarue!1.9CB3 (CLASSIC)
Emsisoft	Gen:Variant.Barys.63208 (B)
F-Secure	Worm.WORM/Gamarue.511265
DrWeb	Trojan.MulDrop4.25343
Zillya	Worm.DebrisGen.Win32.11
TrendMicro	WORM_GAMARUE.SML
McAfeeD	ti!BFF9C2C2B429
CTX	dll.worm.bundpil
Sophos	W32/Gamarue-BL
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.81056636619f2ddf
Jiangmin	Trojan/Generic.axdgt
Webroot	W32.Worm.Gen
Google	Detected
Avira	WORM/Gamarue.511265
Antiy-AVL	Worm/Win32.Debris
Kingsoft	malware.kb.a.997
Gridinsoft	Worm.Win32.Autorun.sa
Xcitium	Worm.Win32.Bundpil.AH@4yjufs
Microsoft	TrojanDownloader:Win32/Andromeda!pz
ZoneAlarm	Worm.Win32.Debris.b
GData	Win32.Worm.Bundpil.B

dll008.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All