22.dll

This executable has a PDB path (1 event)

pdb_path

c:\BelieveMetal\WingBad\FootIn\GladRoot\WhoseCrowd\Chance.pdb

Allocates read-write-execute memory (usually to unpack itself) (7 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 21, 2021, 2:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73838000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory March 21, 2021, 2:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73850000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 21, 2021, 2:46 p.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 21, 2021, 2:46 p.m.	process_identifier: 9068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 21, 2021, 2:46 p.m.	process_identifier: 9068 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory March 21, 2021, 2:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73891000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory March 21, 2021, 2:46 p.m.	process_identifier: 9068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c61000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.36433685
FireEye	Generic.mg.649b5c913739cea1
CAT-QuickHeal	Trojan.Cridex
McAfee	Trojan-FRGC!649B5C913739
Cylance	Unsafe
Sangfor	Trojan.Win32.Cridex.gen
K7AntiVirus	Spyware ( 00552cf91 )
Alibaba	TrojanSpy:Win32/Ursnif.32410193
K7GW	Spyware ( 00552cf91 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D22BEF15
Cyren	W32/Trojan.QCNZ-3867
Symantec	Trojan.Gen.2
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan-Banker.Win32.Cridex.gen
BitDefender	Trojan.GenericKD.36433685
NANO-Antivirus	Trojan.Win32.Cridex.intjhn
Paloalto	generic.ml
ViRobot	Trojan.Win32.Z.Wacatac.389632
Rising	Spyware.Ursnif!8.1DEF (CLOUD)
Ad-Aware	Trojan.GenericKD.36433685
Sophos	Mal/Generic-S
Comodo	Malware@#n9lfuh33p7k8
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.VSNTC221
McAfee-GW-Edition	Trojan-FRGC!649B5C913739
Emsisoft	Trojan.GenericKD.36433685 (B)
Ikarus	Trojan-Banker.UrSnif
Antiy-AVL	Trojan[Banker]/Win32.Cridex
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win32.Banker.oa
Microsoft	Trojan:Win32/Ursnif.SS!MTB
AegisLab	Trojan.Win32.Cridex.7!c
ZoneAlarm	HEUR:Trojan-Banker.Win32.Cridex.gen
GData	Trojan.GenericKD.36433685
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4349328
ALYac	Spyware.Ursnif
MAX	malware (ai score=87)
Malwarebytes	Trojan.Crypt
ESET-NOD32	Win32/Spy.Ursnif.CT
TrendMicro-HouseCall	TROJ_FRS.VSNTC221
Tencent	Win32.Trojan-banker.Cridex.Woqd
eGambit	Unsafe.AI_Score_89%
Fortinet	PossibleThreat.MU
MaxSecure	Trojan.Malware.74474672.susgen
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
Qihoo-360	Win32/Trojan.Dridex.HgkASQIA