Register Login

sloganpng

unpacked (1).dll

Status: finished

Submission Time: 2023-03-16 19:51:59 +01:00

Malicious

Trojan

Ursnif

Comments

Tags

Details

Analysis ID:
828171
API (Web) ID:
1195273
Original Filename:
unpacked (1).bin
Analysis Started:

2023-03-16 19:53:06 +01:00
Analysis Finished:

2023-03-16 20:08:37 +01:00
MD5:
895004ddaa3758ac453d73e3d8c1f45f
SHA1:
0fb1a2c06513134ff699f4f286a71f1671918180
SHA256:
74ef237a5145c0d85ee7575c283493a2bd0ae116590c06749cf1ed72f655b997
Technologies:

Engines
IOCs

Full Report	Management Report	IOC Report	Engine	Info	Verdict	Score	Reports

				System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211		68/100
				System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211 Run Condition: Run with higher sleep bypass		68/100
						26/69
						17/39

URLs

Name	Detection
http://upx.sf.net

Dropped files

Name	File Type	Hashes	Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_7bde5861e98b2ac3cc37e329f3101f62f0fff922_82810a17_1492a377\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9984.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Mar 17 02:54:08 2023, 0x1205a4 type	#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C05.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	#
Click to see the 3 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C74.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	#
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	#
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	#