Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

FVN001-230824.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.944749106969845
Filename:	FVN001-230824.exe
Filesize:	714248
MD5:	f9a102868bcd7a4c6779c73d678b50e4
SHA1:	5116f1b9a635c7c884ce558177ebe34fa5d992b0
SHA256:	959d491cbde6323dc2bf7c377a9c1e0940b988f51a3efcc0f1bd526cc0d210b4
SHA512:	c4b5e716af2c38d21cb11cd3fb06cb8f2c6cdeeece6a56a6cc7c999062049baa07d71661e79962bd478f9b65fd5c3d4078ead62df409f4012f698f0dc78908bc
SSDEEP:	12288:mlM9hCaaXGx7Q6hFlcODMuNkk21MSXI+ygne0N0scCQAS4kmEJ57chCVseIkR:RUpiFlcO2MRBO0sFS4kmEJ50S
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Td.e..............0.................. ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation Security Software Discovery
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Credentials in Registry
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
PE / OLE file has an invalid certificate	System Summary
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)	Malware Analysis System Evasion
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Sample file is different than original file name gathered from version info	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Checks if Microsoft Office is installed	System Summary	System Information Discovery
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FVN001-230824.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FVN001-230824.exe.log
Category:	dropped
Dump:	FVN001-230824.exe.log.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Users\user\Desktop\FVN001-230824.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
PE / OLE file has an invalid certificate	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
URLs found in memory or binary data	Networking
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\FVN001-230824.exe

Details

Is windows:	false
Is dropped:	false
PID:	1256
Target ID:	2
Parent PID:	3504
Name:	FVN001-230824.exe
Path:	C:\Users\user\Desktop\FVN001-230824.exe
Commandline:	C:\Users\user\Desktop\FVN001-230824.exe
Size:	714248
MD5:	F9A102868BCD7A4C6779C73D678B50E4
Time:	14:38:01
Date:	18/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x3b0000
Modulesize:	720896
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE / OLE file has an invalid certificate	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\FVN001-230824.exe

Details

Is windows:	false
Is dropped:	false
PID:	1968
Target ID:	5
Parent PID:	1256
Name:	FVN001-230824.exe
Path:	C:\Users\user\Desktop\FVN001-230824.exe
Commandline:	C:\Users\user\Desktop\FVN001-230824.exe
Size:	714248
MD5:	F9A102868BCD7A4C6779C73D678B50E4
Time:	14:38:03
Date:	18/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xad0000
Modulesize:	720896
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE / OLE file has an invalid certificate	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

https://api.ipify.org/

172.67.74.152

Details

Name:	https://api.ipify.org/
IP:	172.67.74.152
TargetID:	5
From Memory:	false
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

http://smtp.pcpatelinfra.com

unknown

http://support.mailhostbox.com/email-administrators-guide-error-codes/

unknown

Details

Name:	http://support.mailhostbox.com/email-administrators-guide-error-codes/
TargetID:	5
From Memory:	true
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Source:	FVN001-230824.exe, 00000005.00000002.2559950919.0000000002FBB000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org

unknown

Details

Name:	https://api.ipify.org
TargetID:	2
From Memory:	true
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Source:	FVN001-230824.exe, 00000002.00000002.1352521735.0000000003A35000.00000004.00000800.00020000.00000000.sdmp, FVN001-230824.exe, 00000002.00000002.1352521735.0000000003AAF000.00000004.00000800.00020000.00000000.sdmp, FVN001-230824.exe, 00000005.00000002.2557513424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, FVN001-230824.exe, 00000005.00000002.2559950919.0000000002F31000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	2
From Memory:	true
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Source:	FVN001-230824.exe, 00000002.00000002.1352521735.0000000003A35000.00000004.00000800.00020000.00000000.sdmp, FVN001-230824.exe, 00000002.00000002.1352521735.0000000003AAF000.00000004.00000800.00020000.00000000.sdmp, FVN001-230824.exe, 00000005.00000002.2557513424.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org/t

unknown

Details

Name:	https://api.ipify.org/t
TargetID:	5
From Memory:	true
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Source:	FVN001-230824.exe, 00000005.00000002.2559950919.0000000002F31000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://us2.smtp.mailhostbox.com

unknown

Details

Name:	http://us2.smtp.mailhostbox.com
TargetID:	5
From Memory:	true
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Source:	FVN001-230824.exe, 00000005.00000002.2559950919.0000000002FAB000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	5
From Memory:	true
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Source:	FVN001-230824.exe, 00000005.00000002.2559950919.0000000002F31000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://www.chiark.greenend.org.uk/~sgtatham/putty/0

unknown

Domains

Name

Malicious

smtp.pcpatelinfra.com

unknown

us2.smtp.mailhostbox.com

208.91.198.143

Details

Name:	us2.smtp.mailhostbox.com
IP:	208.91.198.143
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
URLs found in memory or binary data	Networking

api.ipify.org

172.67.74.152

Details

Name:	api.ipify.org
IP:	172.67.74.152
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

208.91.198.143

us2.smtp.mailhostbox.com

United States

Details

IP:	208.91.198.143
TargetID:	5
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Country:	United States
Countrycode:	USA
ASN number:	394695
ASN name:	PUBLIC-DOMAIN-REGISTRYUS
Private:	false
Domain:	us2.smtp.mailhostbox.com

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

172.67.74.152

api.ipify.org

United States

Details

IP:	172.67.74.152
TargetID:	5
Current Path:	C:\Users\user\Desktop\FVN001-230824.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ipify.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FVN001-230824_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

402000

remote allocation

page execute and read and write

2FAB000

trusted library allocation

page read and write

2F81000

trusted library allocation

page read and write

3A35000

trusted library allocation

page read and write

3AAF000

trusted library allocation

page read and write

2EC4000

trusted library allocation

page read and write

B83000

heap

page read and write

58BE000

stack

page read and write

6B07000

heap

page read and write

4F40000

trusted library allocation

page read and write

B18000

heap

page read and write

6F20000

trusted library section

page read and write

538A000

trusted library allocation

page read and write

103D000

heap

page read and write

6AEE000

stack

page read and write

F80000

heap

page read and write

5FCE000

stack

page read and write

2E70000

trusted library allocation

page execute and read and write

2672000

trusted library allocation

page read and write

2661000

trusted library allocation

page read and write

2EF3000

heap

page read and write

6A8F000

stack

page read and write

28B4000

trusted library allocation

page read and write

539D000

trusted library allocation

page read and write

6F1E000

stack

page read and write

A43000

trusted library allocation

page read and write

4CF0000

trusted library allocation

page read and write

2610000

trusted library allocation

page read and write

6D20000

trusted library allocation

page read and write

37B1000

trusted library allocation

page read and write

2620000

trusted library allocation

page read and write

6EDE000

stack

page read and write

14C3000

trusted library allocation

page execute and read and write

11E0000

heap

page read and write

4CD0000

heap

page read and write

7EEC0000

trusted library allocation

page execute and read and write

A62000

trusted library allocation

page read and write

1039000

heap

page read and write

502D000

stack

page read and write

D30000

trusted library allocation

page read and write

51F0000

trusted library section

page read and write

5220000

trusted library allocation

page read and write

96D000

stack

page read and write

5910000

heap

page read and write

2D20000

heap

page read and write

27AF000

stack

page read and write

6AFB000

heap

page read and write

65CF000

stack

page read and write

6616000

heap

page read and write

D2B000

stack

page read and write

537E000

trusted library allocation

page read and write

65D0000

heap

page read and write

68F0000

heap

page read and write

266D000

trusted library allocation

page read and write

2C0A000

trusted library allocation

page execute and read and write

2EB0000

trusted library allocation

page read and write

A3D000

trusted library allocation

page execute and read and write

2640000

trusted library allocation

page read and write

38A3000

trusted library allocation

page read and write

3B2000

unkown

page readonly

51A0000

heap

page read and write

A6B000

trusted library allocation

page execute and read and write

47EE000

stack

page read and write

F70000

heap

page read and write

680E000

stack

page read and write

3807000

trusted library allocation

page read and write

3B0000

unkown

page readonly

58FE000

stack

page read and write

57F0000

heap

page read and write

2ED0000

trusted library allocation

page read and write

5376000

trusted library allocation

page read and write

4EA000

stack

page read and write

6657000

heap

page read and write

5391000

trusted library allocation

page read and write

538E000

trusted library allocation

page read and write

4FA0000

trusted library section

page readonly

687E000

stack

page read and write

68FE000

heap

page read and write

2F7D000

trusted library allocation

page read and write

998E000

stack

page read and write

AFE000

heap

page read and write

14C4000

trusted library allocation

page read and write

624D000

stack

page read and write

2814000

trusted library allocation

page read and write

B31000

heap

page read and write

9F0000

heap

page read and write

A5A000

trusted library allocation

page execute and read and write

14C0000

trusted library allocation

page read and write

27B1000

trusted library allocation

page read and write

14D0000

heap

page read and write

D60000

heap

page read and write

5140000

heap

page read and write

2C00000

trusted library allocation

page read and write

AE0000

trusted library allocation

page read and write

2F66000

trusted library allocation

page read and write

5800000

heap

page read and write

6B1B000

heap

page read and write

14D7000

heap

page read and write

2615000

trusted library allocation

page read and write

1026000

heap

page read and write

5190000

trusted library allocation

page execute and read and write

FC9000

heap

page read and write

670E000

stack

page read and write

AFA000

heap

page read and write

2690000

trusted library allocation

page read and write

103F000

heap

page read and write

3F98000

trusted library allocation

page read and write

2E2E000

stack

page read and write

A30000

trusted library allocation

page read and write

9A8D000

stack

page read and write

FA8000

heap

page read and write

5150000

heap

page read and write

264B000

trusted library allocation

page read and write

2C7E000

stack

page read and write

265E000

trusted library allocation

page read and write

634E000

stack

page read and write

2C88000

trusted library allocation

page read and write

5E7000

stack

page read and write

47F0000

trusted library allocation

page read and write

6661000

heap

page read and write

BAA000

heap

page read and write

398E000

trusted library allocation

page read and write

2C06000

trusted library allocation

page execute and read and write

BF0000

heap

page read and write

2E90000

heap

page read and write

537B000

trusted library allocation

page read and write

37B9000

trusted library allocation

page read and write

6D60000

heap

page read and write

47F5000

trusted library allocation

page read and write

9AE000

stack

page read and write

4F30000

trusted library allocation

page read and write

400000

remote allocation

page execute and read and write

494C000

stack

page read and write

B25000

heap

page read and write

6D30000

trusted library allocation

page read and write

3855000

trusted library allocation

page read and write

9C0000

heap

page read and write

2F6F000

trusted library allocation

page read and write

5530000

heap

page execute and read and write

69AD000

trusted library allocation

page read and write

5180000

trusted library allocation

page execute and read and write

B0F000

heap

page read and write

9C8E000

stack

page read and write

9C7000

heap

page read and write

2666000

trusted library allocation

page read and write

2F31000

trusted library allocation

page read and write

2C1B000

trusted library allocation

page execute and read and write

958D000

stack

page read and write

65E8000

heap

page read and write

AD0000

trusted library allocation

page execute and read and write

5396000

trusted library allocation

page read and write

D40000

trusted library allocation

page read and write

2E6C000

stack

page read and write

4D00000

trusted library allocation

page read and write

E39000

stack

page read and write

FA0000

heap

page read and write

50BE000

stack

page read and write

4820000

trusted library allocation

page read and write

9CCD000

stack

page read and write

6B1E000

heap

page read and write

53B0000

heap

page read and write

2FA9000

trusted library allocation

page read and write

69A0000

trusted library allocation

page read and write

6839000

trusted library allocation

page read and write

26A0000

heap

page read and write

6D10000

trusted library allocation

page read and write

69B0000

trusted library allocation

page read and write

9A90000

heap

page read and write

D50000

heap

page execute and read and write

7FB6000

trusted library allocation

page read and write

A34000

trusted library allocation

page read and write

51A5000

heap

page read and write

5382000

trusted library allocation

page read and write

6D70000

heap

page read and write

6D17000

trusted library allocation

page read and write

2670000

trusted library allocation

page read and write

840000

heap

page read and write

2630000

heap

page read and write

978F000

stack

page read and write

28B2000

trusted library allocation

page read and write

2C17000

trusted library allocation

page execute and read and write

FD6000

heap

page read and write

4CB0000

heap

page read and write

BE7000

heap

page read and write

638D000

stack

page read and write

4CE0000

trusted library allocation

page execute and read and write

6AD0000

trusted library allocation

page read and write

648F000

stack

page read and write

697F000

stack

page read and write

A20000

trusted library allocation

page read and write

2C30000

trusted library allocation

page read and write

822F000

stack

page read and write

6AF2000

heap

page read and write

2EC0000

trusted library allocation

page read and write

A50000

trusted library allocation

page read and write

51EE000

stack

page read and write

2C15000

trusted library allocation

page execute and read and write

A80000

trusted library allocation

page read and write

9D0000

heap

page read and write

6AE0000

trusted library allocation

page execute and read and write

5170000

trusted library section

page read and write

2FA7000

trusted library allocation

page read and write

95CD000

stack

page read and write

F39000

stack

page read and write

2BFD000

trusted library allocation

page execute and read and write

6C5E000

stack

page read and write

A56000

trusted library allocation

page execute and read and write

2C02000

trusted library allocation

page read and write

4D20000

trusted library allocation

page execute and read and write

5210000

trusted library allocation

page read and write

11D0000

trusted library allocation

page read and write

6AF0000

heap

page read and write

A40000

trusted library allocation

page read and write

6990000

trusted library allocation

page execute and read and write

9DCE000

stack

page read and write

69FE000

stack

page read and write

2644000

trusted library allocation

page read and write

FD3000

heap

page read and write

CEF000

stack

page read and write

BF5000

heap

page read and write

6655000

heap

page read and write

6AFE000

heap

page read and write

6830000

trusted library allocation

page read and write

54EC000

stack

page read and write

2C10000

trusted library allocation

page read and write

3F59000

trusted library allocation

page read and write

BD7000

heap

page read and write

4810000

trusted library allocation

page execute and read and write

587E000

stack

page read and write

9F5000

heap

page read and write

A4D000

trusted library allocation

page execute and read and write

4FB0000

heap

page execute and read and write

AF0000

heap

page read and write

5370000

trusted library allocation

page read and write

920000

heap

page read and write

E6F000

stack

page read and write

A33000

trusted library allocation

page execute and read and write

577C000

stack

page read and write

14CD000

trusted library allocation

page execute and read and write

4F9B000

stack

page read and write

A52000

trusted library allocation

page read and write

988F000

stack

page read and write

2C12000

trusted library allocation

page read and write

69B7000

trusted library allocation

page read and write

552E000

stack

page read and write

2633000

heap

page read and write

A67000

trusted library allocation

page execute and read and write

2EF0000

heap

page read and write

3F31000

trusted library allocation

page read and write

60CE000

stack

page read and write

2FBB000

trusted library allocation

page read and write

ACE000

stack

page read and write

6D80000

trusted library allocation

page execute and read and write

6B00000

heap

page read and write

64CE000

stack

page read and write

2F20000

heap

page execute and read and write

2BF0000

trusted library allocation

page read and write

2E80000

trusted library allocation

page read and write

B2F000

heap

page read and write

5200000

trusted library allocation

page read and write

There are 250 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
FVN001-230824.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportFVN001-230824.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
FVN001-230824.exe