Edit tour

Windows Analysis Report
Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

Overview

General Information

Sample name:	Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll renamed because original name is a hash value
Original sample name:	Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.exe
Analysis ID:	1634154
MD5:	3bd1153930937af842e1ee04440c4780
SHA1:	e63fe607068e9bd9a59e212fe2184e1aeb4a4c39
SHA256:	aca09f74ecf712f5de7b45c2b41e5773bfeb3bcd51dc4254e34261c4d227181a
Tags:	efiexeuser-ihatethensa
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Initial sample is a PE file and has a suspicious name

PE file has nameless sections

AV process strings found (often used to terminate AV products)

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

One or more processes crash

PE file contains sections with non-standard names

PE file does not import any functions

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6428 cmdline: loaddll64.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6604 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 6672 cmdline: rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 6896 cmdline: C:\Windows\system32\WerFault.exe -u -p 6672 -s 232 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 6948 cmdline: C:\Windows\system32\WerFault.exe -u -p 6428 -s 184 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

PE file has nameless sections

Source: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

Static PE information: section name:

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6672 -s 232

Source: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

Static PE information: No import functions for PE file found

Source: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal48.winDLL@8/11@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6672
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6452:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6428

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\08d27815-7dd9-4c25-8496-97a3e541254b

Jump to behavior

Source: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6672 -s 232
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6428 -s 184
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Section loaded: apphelp.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll	Static PE information: section name:
Source: Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll	Static PE information: section name: .xdata

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_005302D0 rdtsc

0_2_005302D0

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_005302D0 rdtsc

0_2_005302D0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Software Packing	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll	0%	ReversingLabs
Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1634154
Start date and time:	2025-03-10 20:18:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll renamed because original name is a hash value
Original Sample Name:	Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.exe
Detection:	MAL
Classification:	mal48.winDLL@8/11@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 13.89.230.12, 217.20.57.34, 4.175.87.197
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, fs.microsoft.com, onedsblobvmssprdcus03.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, c.pki.goog, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll64.exe, PID 6428 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 6672 because there are no executed function
Not all processes where analyzed, report is missing behavior information

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll64.exe_7ed25ba9d35d2dfa98d24e4c5869319c43d244d9_606702e6_cc72b0d3-a03a-4659-9a51-a00d0236b91f\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6638503728984497
Encrypted:	false
SSDEEP:	96:QUDqaUap65sthNO7JfUQXIDcQOc6GIcEDcw3+h2v+HbHg/5JZAX/d5FMT2SlPkpA:p+aU66590QDp6hjBzuiFYZ24lO81
MD5:	F39AAB466BEE6F5DBBB8A3AA3A13E78B
SHA1:	13B53D9A7A380CEBC94D041D010AFEC6688AD26D
SHA-256:	1AA1DDBA0A086000C68454756122D637AA1337F76D98BB4B15884277330501B9
SHA-512:	7585121CF397BFD5A94D4ECEEE89EA82949DB2079619FF64B5DACBC820298C3B3F2B79E27125C462095C3B17595BF0E449634D5F57FC35D213527EA648B2FF74
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.6.1.0.7.9.7.6.6.6.8.4.6.9.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.6.1.0.7.9.7.7.4.1.8.4.6.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.9.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.7.2.b.0.d.3.-.a.0.3.a.-.4.6.5.9.-.9.a.5.1.-.a.0.0.d.0.2.3.6.b.9.1.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.6.a.6.c.2.3.1.-.3.7.7.6.-.4.1.8.a.-.b.8.e.1.-.c.9.9.c.6.0.1.5.3.8.0.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.6.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.1.c.-.0.0.0.1.-.0.0.1.7.-.a.f.9.e.-.7.4.5.c.f.1.9.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.f.e.1.f.7.3.2.2.5.e.8.c.2.3.3.1.b.8.d.3.7.3.d.3.f.9.1.a.c.4.2.0.0.0.0.f.f.f.f.!.0.0.0.0.f.2.3.2.e.0.d.e.c.d.5.4.8.8.5.2.f.a.6.0.8.9.e.1.9.5.4.3.1.b.7.3.e.9.4.e.d.0.b.d.!.l.o.a.d.d.l.l.6.4...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.9././.1.5.:.0.8.:.2.3.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_4832f3115ca51c421dd612def8914ea64ab61_46f21159_8aead111-49d8-42ce-a0cd-463243e22d0a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.714277340133259
Encrypted:	false
SSDEEP:	96:IDFeNigGmi6yKylsjR4RvO7JfUQXIDcQOc6GIcEDcw3+hXaXz+HbHgSQgJjnZAXL:iMBvi6ylo0QDp6JjGzuiFYZ24lO8c
MD5:	5F70499AE4AFAA177A4516A2E5C9BC36
SHA1:	0A9CAEF5FDD833BD6300D786648CBCB445C7D582
SHA-256:	98D18D145C349005E19C6E395F4C797F45A7666C919C837FFB36904DA1220EAA
SHA-512:	AD370BB5C598F7DCB68C3D676B9F346264BF6A91C9029384239A9137086F05DC0501742ADCB6D0AFD5547A6EBF6CAD74D852E2265206D6A204377DF480D257C1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.6.1.0.7.9.7.6.6.9.9.0.5.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.6.1.0.7.9.7.7.4.1.7.8.0.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.e.a.d.1.1.1.-.4.9.d.8.-.4.2.c.e.-.a.0.c.d.-.4.6.3.2.4.3.e.2.2.d.0.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.5.3.8.e.b.e.5.-.7.8.f.6.-.4.5.c.a.-.8.3.2.4.-.0.a.4.a.a.1.e.d.3.6.b.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.S.e.c.t.i.o.n._.P.E.3.2._.i.m.a.g.e._.A.m.i.S.y.n.c.S.e.t.u.p.D.a.t.a._.A.m.i.S.y.n.c.S.e.t.u.p.D.a.t.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.1.0.-.0.0.0.1.-.0.0.1.7.-.d.5.0.4.-.8.8.5.c.f.1.9.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8336.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Mar 10 19:19:36 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	47866
Entropy (8bit):	1.424695509096353
Encrypted:	false
SSDEEP:	96:558qwRn0YuplCWdGli7nbwtbr9apOFH5kfutpUmwrjKlLt45zEWIlFI4ICIem2rZ:0naGOGf9apO3kfB64kLIe+wdR
MD5:	271E9E993CAEE104573F1316FB840EF7
SHA1:	C9D8A67A325BE20FE59DC4CC46A4741714C8EBD2
SHA-256:	CF69C54C530E838A14939C02EEDE93950409A4BF5F52FE9F78BA353103D27BD8
SHA-512:	75664E63D83D8488F255E8E33E93CC13D946DBDCD7A876842AEE907B7EDB57D4FE5DBB132F914A09C8132DFAE0DD8BF09496CB0473DE2C37CC0C4BDCF6EAA244
Malicious:	false
Preview:	MDMP..a..... .......H;.g........................d...........$................"..........`.......8...........T...............r...........0...........................................................................................eJ..............Lw......................T...........H;.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8346.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Mar 10 19:19:36 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	49900
Entropy (8bit):	1.4210141036012653
Encrypted:	false
SSDEEP:	96:5U8aZc/07v7+IjFGda6roi7M+UemUTx45bHLqWIw+bIB4kkn4:pXXaLOM+kw4pHLfIi
MD5:	6B669287FF93F90AB60CE8B9429DEA74
SHA1:	4BCF0F7B66D06AF17E920CF34552734BFD4A8611
SHA-256:	9D7886B12B14351CFD0D0EE0AC851A60AD16ECEBE9D40E4191B1E48F53F73923
SHA-512:	6758C68B7048DF36627FB912F03DF8F0634D429877070EE3B179D5977ED9EFED72778FFB3B305A4E7FC6F602FC317470619D6FCD7C38C68DF1809E93DC17F884
Malicious:	false
Preview:	MDMP..a..... .......H;.g.........................................#..........T.......8...........T...............T...........D...........0...............................................................................eJ..............Lw......................T...........H;.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83D4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8680
Entropy (8bit):	3.6989592537955573
Encrypted:	false
SSDEEP:	192:R6l7wVeJIMQzIEX6YCaWg0gmfHIqApDP89bwqCfPOwm:R6lXJTQE86YOLgmfHIq9wXfPQ
MD5:	210CD08E852FAC33EB8E4C66F23EA647
SHA1:	BEE9E1A46D4DC20BB9A7752F81D243074C47A535
SHA-256:	01600F6EA3C412F10DC7E96F757CBFF2A63C0746F1C37F103AD18D7E18858C90
SHA-512:	7DDB1C30260738BCE1FE50D068EEB72D943FACFC1B74E5DD740787BDEECC24FC3EA91A050BEEF82E1881DCBBB4840864B05EA79793CDC61CE89F96BA82C1D776
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83E3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8596
Entropy (8bit):	3.6974706183234396
Encrypted:	false
SSDEEP:	192:R6l7wVeJZb26Y/l4K2RgmfPqApDa89bwLCfawm:R6lXJF26Y9b4gmfPquwOfc
MD5:	137FD3EF31C3B245DEE7CB32685E117D
SHA1:	9D3B081E1B6FDF172775667BDE26B9A73F00DD1A
SHA-256:	ABF4644601ADCE4E95F09EFF1AF1C8585DC271B76F6CC3DCE2E01B76F7205748
SHA-512:	888E3E03A4E0F32AD5B7A7E5ED257FD1F1F95D0EA5C9BDA17C5E8289AADD81E4D721E85EB265F7339C7E0CD01A0D0C40334BCDAE873A9DD9B497515EA7EA1F99
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8490.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4732
Entropy (8bit):	4.490422468421882
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGJg771I9zAWpW8VYVYm8M4J86ZF3yq85ZLuFV1xld:uIjfcI7k57VxJXvF7xld
MD5:	8E1B0D7AD536D4C462D48095F437EF1F
SHA1:	FB2BC7BE72FFA83C196AA387BCAC4D7AA0AB9DC8
SHA-256:	0BFFCB7F66E9132C878B8A36106E10582EA675CB06B910DF9040D1CA0C061CAC
SHA-512:	DA9E0A7CDE1D2EBA2F107742326E900BC5ED5805169FA61802B0C32FC4D265586E11EACAF895493112D27F5693934291301830E6B6FEB07D8B88B338357F2C68
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="755182" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER84A0.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4964
Entropy (8bit):	4.577791169995296
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGJg771I9zAWpW8VYmYm8M4JCLE6ZF+uyq85mnLV5CptSTS2d:uIjfcI7k57VeJNu7EpoO2d
MD5:	89C40177F29B4808A87B13997E5A3881
SHA1:	405DD68A1FF4CC3B071756DD0AAF7C03DB146EAF
SHA-256:	32230D9BBC10B118C7F7970D8355F86B116C3C439722D4B46D9C13F706B89854
SHA-512:	824073412D9952CDA832F7027BEE50A215C147F7D97DE265098BEFE947F9672FFD584A12ABA9A5D6FE846231D64D4401C5DA035C54E88A1BCDEAE45238C4F4E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="755182" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	3.525662109204851
Encrypted:	false
SSDEEP:	6:kKRXo8AQG7DNfUN+SkQlPlEGYRMY9z+s3Ql2DUeXJlOW1:pXojJLkPlE99SCQl2DUeXJlOA
MD5:	30190EBC1EC5F00C97A5EF5A19AF7326
SHA1:	F1FC4B3B99DCF9E8BC00A68FEED03C0C5D2B4D98
SHA-256:	2679A25053269F38D5FEA1C9CB98CE59D9B000B6780AEA5855255ECD4F252A0A
SHA-512:	E62B911D7D9F1E8389DD90B69C3001674FC71F8E66E5911FBF03C0700E25C5EF02EADC511AF9125B4997D89F7FDF7BE0096B4E7541D13BF05A8D71DB7F8CA4E3
Malicious:	false
Preview:	p...... ..........cr...(................................................m.... ........~..MG......&.....6.........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.297857096475728
Encrypted:	false
SSDEEP:	6144:xeXfWRYkg7Di2vXoy00lWZgiWaaKxC4Iiwjf8XuYr3QO/SP9M7HVw:gX/YCW2A4iwjE5QCSl6Hm
MD5:	FC095FD839BA03F50B4A3247D1C43168
SHA1:	9500606F8B2DA7E0BF0EE9D61D59DF428809B9C1
SHA-256:	3506619C30DCDDC998712D9ED11FA51DCC3056438D22E2CE55F4278C5962692D
SHA-512:	E291A8EDFB383D144817A79927FA6957B82155D6C13A22C65BFB1AB934E08F17C470C04C5E6F60CED1119A87788CAC5E852923CCAD2705D50363907527EB75AA
Malicious:	false
Preview:	regfJ...J....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJ+G.f.................................................................................................................................................................................................................................................................................................................................................S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.96139140656291
Encrypted:	false
SSDEEP:	768:4nNaeTJmGcubGcyCU+M+uU421/xndy69Nc:4nN5TJmPuOG
MD5:	B76AF171604A243237FBD9FC51C2926C
SHA1:	63BB50A223CC75AB6C9DD7A0DE6E9BD4D5DEE9FB
SHA-256:	8F66C6458236F29FB877D4E380E54236DD7828AC7F0AE83B6518112301581F41
SHA-512:	3B7E60311234103FF93286E8E3357EF00E3DE22A14A09AD6C2B1762C10F0D4104244104CA0ECA268C09D82F0FDB5C3013F22DB49C91B8DDC184EFBEE09314F35
Malicious:	false
Preview:	regfI...I....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJ+G.f.................................................................................................................................................................................................................................................................................................................................................S.HvLE.n......I....`.......k..2.......p.0............. ... ...............P......hbin.................\.Z............nk,..\.Z....................h...................................<.......&...{11517B7C-E79D-4e20-961B-75A811715ADD}..`...sk.......... ...........\...l.............H.........?...................?...................?........... ... ........... ... ...................$.N..........vk..4...`...........CreatingCommand.....O.n.e.D.r.i.v.e.S.e.t.u.p...e.x.e. ./.s.i.l.e.n.t...

Static File Info

General

File type:	MS-DOS executable PE32+ executable (DLL) (EFI boot service driver) x86-64, for MS Windows
Entropy (8bit):	2.040104157587929
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 84.94% Win64 Executable (generic) (12005/4) 10.00% DOS Executable Borland Pascal 7.0x (2037/25) 1.70% Generic Win/DOS Executable (2004/3) 1.67% DOS Executable Generic (2002/1) 1.67%
File name:	Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll
File size:	5'472 bytes
MD5:	3bd1153930937af842e1ee04440c4780
SHA1:	e63fe607068e9bd9a59e212fe2184e1aeb4a4c39
SHA256:	aca09f74ecf712f5de7b45c2b41e5773bfeb3bcd51dc4254e34261c4d227181a
SHA512:	2d314165971af0e29021b9e9a01360a080d83807758aad2416847d0186e52f2e58efbd0aa4c8d91f3a775d2f3289e61e1e4aa3d4b3fcd1a475daefa1b967c1b4
SSDEEP:	24:FIlndGsl+6H2TVu5RhWISv/ifqNeZMeP43cZXy33ZhAf4Rk5U:+ldGs32T4DWISvaq4ZN4MZCsfV
TLSH:	42B1530322C559A4F629013889EAF146B9FE30213769F4CF7B204C1D1B732E6F278241
File Content Preview:	MZ......................................................................................................................................................................................PE..d................." ....................`........... ... ..........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x304
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x0
Subsystem:	efi boot service driver
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	0
OS Version Minor:	0
File Version Major:	0
File Version Minor:	0
Subsystem Version Major:	0
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+08h], ecx
push edi
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [edx+60h]
dec eax
mov dword ptr [0000040Ah], eax
dec eax
mov eax, dword ptr [edx+58h]
dec eax
mov dword ptr [00000407h], eax
dec eax
mov dword ptr [000003F0h], edx
call 00007FC768711A78h
dec eax
lea ecx, dword ptr [00000384h]
call 00007FC768711AD8h
dec eax
test eax, eax
jne 00007FC768711868h
call 00007FC7687117CAh
dec eax
mov ebx, eax
call 00007FC7687117B2h
shr ebx, 09h
and bl, 00000001h
mov edx, 00001808h
in eax, dx
mov edi, eax
and edi, 00FFFFFFh
call 00007FC768711779h
mov edx, 00001808h
in eax, dx
lea ecx, dword ptr [edi+0000016Bh]
sub ecx, eax
bt ecx, 17h
jc 00007FC768711819h
call 00007FC768711750h
jmp 00007FC7687117F7h
call 00007FC768711759h
test bl, bl
je 00007FC768711819h
call 00007FC768711760h
jmp 00007FC768711817h
call 00007FC768711769h
dec eax
lea eax, dword ptr [esp+40h]
inc ebp
xor ecx, ecx
dec eax
mov dword ptr [esp+28h], eax
dec esp
lea eax, dword ptr [00000030h]
dec eax
lea eax, dword ptr [000002D9h]
mov ecx, 00000200h
dec eax
mov dword ptr [esp+20h], eax
dec eax
mov eax, dword ptr [00000360h]
inc ecx
lea edx, dword ptr [ecx+08h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x700	0x1c	.data
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x260	0x3f0	0x400	9fabd149979a38858a5c7f9986242cf2	False	0.7744140625	data	5.886797304255632	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x660	0xe6c	0xe80	a84072ba5d4c2acc329c136aec808aff	False	0.048760775862068964	data	0.45224921571019977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x14e0	0x30	0x40	3b5d3c7d207e37dceeedd301e35e2e58	False	0.1875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.xdata	0x1520	0x2c	0x40	3b5d3c7d207e37dceeedd301e35e2e58	False	0.1875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 10, 2025 20:20:13.667512894 CET	1.1.1.1	192.168.2.10	0x118d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:20:13.667512894 CET	1.1.1.1	192.168.2.10	0x118d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:20:13.667512894 CET	1.1.1.1	192.168.2.10	0x118d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:20:13.667512894 CET	1.1.1.1	192.168.2.10	0x118d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:20:13.667512894 CET	1.1.1.1	192.168.2.10	0x118d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:20:13.667512894 CET	1.1.1.1	192.168.2.10	0x118d	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.23	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.39	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:21:38.650691032 CET	1.1.1.1	192.168.2.10	0x13eb	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.36	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	15:19:36
Start date:	10/03/2025
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll"
Imagebase:	0x7ff7f92e0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:19:36
Start date:	10/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff60c8c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:19:36
Start date:	10/03/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1
Imagebase:	0x7ff78be50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:19:36
Start date:	10/03/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll",#1
Imagebase:	0x7ff67f9b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:19:36
Start date:	10/03/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6672 -s 232
Imagebase:	0x7ff724140000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:19:36
Start date:	10/03/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6428 -s 184
Imagebase:	0x7ff724140000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 005302D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739956989.0000000000530000.00000080.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65642f6ac5f80987d77bc9ca947e98ce9271ef434a71309184ece8f00ad157cd
Instruction ID: f988002b6f32405c9862b9e46c886e4dfb8d3f2078c4d670929f3849cad84152
Opcode Fuzzy Hash: 65642f6ac5f80987d77bc9ca947e98ce9271ef434a71309184ece8f00ad157cd
Instruction Fuzzy Hash:

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll64.exe_7ed25ba9d35d2dfa98d24e4c5869319c43d244d9_606702e6_cc72b0d3-a03a-4659-9a51-a00d0236b91f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Sec_4832f3115ca51c421dd612def8914ea64ab61_46f21159_8aead111-49d8-42ce-a0cd-463243e22d0a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8336.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8346.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83D4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83E3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8490.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER84A0.tmp.xml

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
Section_PE32_image_AmiSyncSetupData_AmiSyncSetupData_body.efi.dll