Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 6, 2025, 11:14 a.m.	March 6, 2025, 11:18 a.m.

Size	3.2MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`9e94126e8a26efd10b2a5b179d64be90`
SHA256	`6bdcd10a2434861f81f6dc75bd2b40f3aa847adb4b358ab6855d1c760a3090a1`
CRC32	`A4C530BB`
ssdeep	`98304:Z3BSbnpWV8SvVCuEjg4qWy5UiiIsYhR/CjzcFAiP:ZRSbp6VCzmV539nC0FAk`
PDB Path	F:\2024\work\Sewiz\Sewiz\Release\DllProxy.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,GetFileVersionInfoByHandle
1784
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,GetFileVersionInfoExA
156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,GetFileVersionInfoA
3064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,GetFileVersionInfoExW
2436
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,GetFileVersionInfoSizeExW
2632
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,GetFileVersionInfoSizeW
2188
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,GetFileVersionInfoW
1228
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,VerFindFileA
1472
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,VerFindFileW
1184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,VerInstallFileA
1300
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,VerLanguageNameW
3236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,VerQueryValueA
3424
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,VerQueryValueW
3656
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\VERSION.DLL,
3792
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\yOEx1Rmyjpvz.bat" "
4012
- chcp.com chcp 65001
  4080
- PING.EXE ping -n 10 localhost
  3148
- rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
  3672
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\948mAbaeeeqA.bat" "
3216
- chcp.com chcp 65001
  3464
- PING.EXE ping -n 10 localhost
  3492
- rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
  1948
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\NONTBRPTKGsk.bat" "
540
- chcp.com chcp 65001
  2756
- PING.EXE ping -n 10 localhost
  2088
- rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
  3856
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\QwNTJ51jFqhC.bat" "
2488
- chcp.com chcp 65001
  2164
- PING.EXE ping -n 10 localhost
  3984
- rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
  3176

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (33 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:14 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:15 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:16 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:16 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:16 a.m.			0	0
IsDebuggerPresent March 6, 2025, 11:16 a.m.			0	0

Command line console output was observed (12 events)

Time & API	Arguments	Status	Return
WriteConsoleW March 6, 2025, 11:16 a.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW March 6, 2025, 11:16 a.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW March 6, 2025, 11:17 a.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1

This executable has a PDB path (1 event)

pdb_path

F:\2024\work\Sewiz\Sewiz\Release\DllProxy.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 6, 2025, 11:14 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

BINARY

Allocates read-write-execute memory (usually to unpack itself) (50 out of 502 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d14000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74362000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74343000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74150000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 3309568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75571000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x753a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75281000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740d1000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x774d0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b32000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ad0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73172000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73aab000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b31000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b32000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fe0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02020000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739c1000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7397a000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73901000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1544192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05520400 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020a9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 1784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory March 6, 2025, 11:14 a.m.	process_identifier: 156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d14000 process_handle: 0xffffffff	1	0

A process attempted to delay the analysis task. (1 event)

description

rundll32.exe tried to sleep 600 seconds, actually delayed analysis time by 600 seconds

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x0032e260

size

0x000003c0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00327800', u'virtual_address': u'0x00007000', u'entropy': 7.999919970798292, u'name': u'.rsrc', u'virtual_size': u'0x003276b8'}

entropy

7.9999199708

description

A section with a high entropy has been found

entropy

0.995070856439

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ping -n 10 localhost
cmdline	chcp 65001

Resumed a suspended thread in a remote process potentially indicative of process injection (8 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 4012 resumed a thread in remote process 3672
Process injection	Process 3216 resumed a thread in remote process 1948
Process injection	Process 540 resumed a thread in remote process 3856
Process injection	Process 2488 resumed a thread in remote process 3176
NtResumeThread March 6, 2025, 11:17 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 3672	1	0	0
NtResumeThread March 6, 2025, 11:17 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 1948	1	0	0
NtResumeThread March 6, 2025, 11:17 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 3856	1	0	0
NtResumeThread March 6, 2025, 11:17 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 3176	1	0	0

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Lionic	Trojan.Win32.Crysan.m!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Ghanarava.172508747864be90
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.73973816
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73973816
Sangfor	Backdoor.Msil.Crysan.Vep9
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKD.73973816
K7GW	Riskware ( 00584baa1 )
K7AntiVirus	Riskware ( 00584baa1 )
Arcabit	Trojan.Generic.D468C038
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
Avast	Win32:BackdoorX-gen [Trj]
Kaspersky	Backdoor.MSIL.Crysan.izc
Alibaba	Backdoor:MSIL/Crysan.7bfdc759
MicroWorld-eScan	Trojan.GenericKD.73973816
Rising	Backdoor.Crysan!8.10ECA (CLOUD)
Emsisoft	Trojan.GenericKD.73973816 (B)
F-Secure	Trojan.TR/AD.Nekark.pbbon
Zillya	Backdoor.Crysan.Win32.7880
McAfeeD	ti!6BDCD10A2434
Trapmine	malicious.high.ml.score
CTX	dll.trojan.crysan
Sophos	Mal/Generic-S
FireEye	Trojan.GenericKD.73973816
Jiangmin	Trojan.MSIL.apefe
Google	Detected
Avira	TR/AD.Nekark.pbbon
Kingsoft	MSIL.Backdoor.Crysan.izc
GData	Trojan.GenericKD.73973816
Varist	W32/ABBackdoor.GGNI-7358
AhnLab-V3	Malware/Win.Generic.C5662709
McAfee	Artemis!9E94126E8A26
DeepInstinct	MALICIOUS
Ikarus	Trojan.Nekark
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0CI124
Tencent	Malware.Win32.Gencirc.14184fbd
MaxSecure	Trojan.Malware.277392148.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:BackdoorX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Backdoor:MSIL/Crysan.iuu

VERSION.DLL

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All