Analysis Report b8fe43e6_by_Libranalysis

Overview

General Information

Sample Name: b8fe43e6_by_Libranalysis (renamed file extension from none to dll)
Analysis ID: 404281
MD5: b8fe43e6e418db516c1deda8d2b1e8d0
SHA1: d6901a2528977ed284f9e6808a73029371cd2ecc
SHA256: 6ea1efc4c1dd494c71fbfb23ea1fdc5530f9cbb6602993d96a74a7b014a96ee3
Tags: Dridex
Infos:

Most interesting Screenshot:

Detection

Dridex
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 15.2.rundll32.exe.10000000.3.unpack Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["193.200.130.181:443", "95.138.161.226:2303", "167.114.113.13:4125"], "RC4 keys": ["MqW38NQIO70GhjGOOvjtl5AwyenW6A8fcZ", "xeMr6QHn7uRk1D2ChU8OuyaRFUZJZZHUIgxCzaPXtOkjmhTMtNxfWU8nlnD7q009ahEI51R1"]}
Multi AV Scanner detection for submitted file
Source: b8fe43e6_by_Libranalysis.dll Metadefender: Detection: 21% Perma Link
Source: b8fe43e6_by_Libranalysis.dll ReversingLabs: Detection: 29%
Machine Learning detection for sample
Source: b8fe43e6_by_Libranalysis.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 15.2.rundll32.exe.7f0000.1.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 19.2.rundll32.exe.1a0000.2.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 18.2.rundll32.exe.cf0000.2.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 16.2.rundll32.exe.2db0000.2.unpack Avira: Label: TR/ATRAPS.Gen2

Compliance:

barindex
Uses 32bit PE files
Source: b8fe43e6_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: b8fe43e6_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.343884757.000000000493B000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347640493.0000000000684000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.390865537.0000000005250000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499498394.0000000003092000.00000004.00000001.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501239275.00000000055A5000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: rasman.pdbe{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.342065583.0000000000A1F000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347540628.000000000067E000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499460892.000000000308C000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb$ source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb`n source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000E.00000002.501546084.00000000000F2000.00000004.00000001.sdmp
Source: Binary string: powrprof.pdbVn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.345845744.0000000000A2B000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.348844819.000000000068A000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbHn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb, source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486379544.0000000004B35000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb/ source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdbw source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501239275.00000000055A5000.00000004.00000040.sdmp
Source: Binary string: KiUserCallbackDispatcherRSDSwntdll.pdb source: WerFault.exe, 0000001C.00000002.509473746.0000000000922000.00000004.00000001.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: WinTypes.pdb5 source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: wUxTheme.pdbw{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdbnn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: rundll32.exe, 00000014.00000002.514218411.0000000010025000.00000002.00020000.sdmp, b8fe43e6_by_Libranalysis.dll
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500685057.00000000055A2000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000A.00000003.342061380.0000000000A19000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347534673.0000000000678000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000A.00000003.344185164.0000000000A25000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347640493.0000000000684000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499498394.0000000003092000.00000004.00000001.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb3{4 source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: KERNEL32C:\Windows\System32\KERNEL32.DLLC:\Windows\System32\KERNEL32.DLLRSDSwkernel32.pdb source: WerFault.exe, 0000001C.00000002.509473746.0000000000922000.00000004.00000001.sdmp
Source: Binary string: combase.pdbrn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb^' source: WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdbtn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb]& source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486379544.0000000004B35000.00000004.00000040.sdmp
Source: Binary string: winspool.pdbZn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb/ source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb{{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000A.00000003.342065583.0000000000A1F000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347540628.000000000067E000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499460892.000000000308C000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdbxn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb\n source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb\! source: WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 0000000A.00000003.342061380.0000000000A19000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347534673.0000000000678000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499438158.0000000003086000.00000004.00000001.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000A.00000003.345845744.0000000000A2B000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.348844819.000000000068A000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499549411.0000000003098000.00000004.00000001.sdmp
Source: Binary string: ClusApi.pdb{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 00000017.00000003.500685057.00000000055A2000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: dnsapi.pdbG{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 193.200.130.181:443
Source: Malware configuration extractor IPs: 95.138.161.226:2303
Source: Malware configuration extractor IPs: 167.114.113.13:4125
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 167.114.113.13 167.114.113.13
Source: Joe Sandbox View IP Address: 95.138.161.226 95.138.161.226
Source: Joe Sandbox View IP Address: 193.200.130.181 193.200.130.181
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
Source: Joe Sandbox View ASN Name: RACKSPACE-LONGB RACKSPACE-LONGB
Source: Joe Sandbox View ASN Name: CLOUD-MANAGEMENT-LLCUS CLOUD-MANAGEMENT-LLCUS
Source: WerFault.exe, 0000000A.00000002.502947562.00000000009E9000.00000004.00000020.sdmp String found in binary or memory: http://crl.micr
Source: WerFault.exe, 0000000A.00000003.501370498.0000000004868000.00000004.00000001.sdmp String found in binary or memory: http://crl.micro

E-Banking Fraud:

barindex
Yara detected Dridex unpacked file
Source: Yara match File source: 00000012.00000002.500958542.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.497125131.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.514739033.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.494023927.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 19.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_10001494 15_2_10001494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_10011460 15_2_10011460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_1000846C 15_2_1000846C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_1000A52C 15_2_1000A52C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_10011D58 15_2_10011D58
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_10019348 15_2_10019348
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_10010754 15_2_10010754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_100090CC 15_2_100090CC
One or more processes crash
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 752
Sample file is different than original file name gathered from version info
Source: b8fe43e6_by_Libranalysis.dll Binary or memory string: OriginalFilenamej2pcsc.dllN vs b8fe43e6_by_Libranalysis.dll
Uses 32bit PE files
Source: b8fe43e6_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Yara signature match
Source: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_d09d9774ec98621253c28ca1027c73a9bab30_82810a17_1a23c1a4\Report.wer, type: DROPPED Matched rule: SUSP_WER_Critical_HeapCorruption date = 2019-10-18, author = Florian Roth, description = Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation), reference = https://twitter.com/cyb3rops/status/1185459425710092288, score =
Source: b8fe43e6_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal76.troj.evad.winDLL@21/11@0/4
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5604
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5544
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5512
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6976
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERA92F.tmp Jump to behavior
Source: b8fe43e6_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll,LoxmtYt
Source: b8fe43e6_by_Libranalysis.dll Metadefender: Detection: 21%
Source: b8fe43e6_by_Libranalysis.dll ReversingLabs: Detection: 29%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll,LoxmtYt
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 752
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 892
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',WdiAddFileToInstance
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',WdiAddParameter
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',WdiCancel
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 608
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 756
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll,LoxmtYt Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',DllCanUnloadNow Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',DllGetClassObject Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',WdiAddFileToInstance Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',WdiAddParameter Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',WdiCancel Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',#1 Jump to behavior
Source: b8fe43e6_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: b8fe43e6_by_Libranalysis.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.343884757.000000000493B000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347640493.0000000000684000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.390865537.0000000005250000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499498394.0000000003092000.00000004.00000001.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501239275.00000000055A5000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: rasman.pdbe{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.342065583.0000000000A1F000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347540628.000000000067E000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499460892.000000000308C000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb$ source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb`n source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000E.00000002.501546084.00000000000F2000.00000004.00000001.sdmp
Source: Binary string: powrprof.pdbVn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.345845744.0000000000A2B000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.348844819.000000000068A000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbHn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb, source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486379544.0000000004B35000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb/ source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdbw source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501239275.00000000055A5000.00000004.00000040.sdmp
Source: Binary string: KiUserCallbackDispatcherRSDSwntdll.pdb source: WerFault.exe, 0000001C.00000002.509473746.0000000000922000.00000004.00000001.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: WinTypes.pdb5 source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: wUxTheme.pdbw{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdbnn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: rundll32.exe, 00000014.00000002.514218411.0000000010025000.00000002.00020000.sdmp, b8fe43e6_by_Libranalysis.dll
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500685057.00000000055A2000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000A.00000003.342061380.0000000000A19000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347534673.0000000000678000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000A.00000003.344185164.0000000000A25000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347640493.0000000000684000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499498394.0000000003092000.00000004.00000001.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb3{4 source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: KERNEL32C:\Windows\System32\KERNEL32.DLLC:\Windows\System32\KERNEL32.DLLRSDSwkernel32.pdb source: WerFault.exe, 0000001C.00000002.509473746.0000000000922000.00000004.00000001.sdmp
Source: Binary string: combase.pdbrn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb^' source: WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdbtn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb]& source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486379544.0000000004B35000.00000004.00000040.sdmp
Source: Binary string: winspool.pdbZn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb/ source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb{{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000A.00000003.342065583.0000000000A1F000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347540628.000000000067E000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499460892.000000000308C000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdbxn source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb\n source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.483923294.0000000004B32000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb\! source: WerFault.exe, 00000017.00000003.501272551.00000000055A8000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 0000000A.00000003.342061380.0000000000A19000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.347534673.0000000000678000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499438158.0000000003086000.00000004.00000001.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.352186128.0000000004E80000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.485947047.0000000004B30000.00000004.00000040.sdmp, WerFault.exe, 00000017.00000003.500658090.00000000055D1000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000A.00000003.345845744.0000000000A2B000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.348844819.000000000068A000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.499549411.0000000003098000.00000004.00000001.sdmp
Source: Binary string: ClusApi.pdb{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 00000017.00000003.500685057.00000000055A2000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp, WerFault.exe, 0000000E.00000003.486881658.0000000004B38000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.352158662.0000000004EB1000.00000004.00000001.sdmp, WerFault.exe, 0000000E.00000003.482963978.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000017.00000003.501207923.00000000055A0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000002.519773343.0000000005391000.00000004.00000001.sdmp
Source: Binary string: dnsapi.pdbG{ source: WerFault.exe, 0000000A.00000003.352200487.0000000004E86000.00000004.00000040.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_1000F6CC push esi; mov dword ptr [esp], 00000000h 15_2_1000F6CD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 20_2_10003A29 push ds; iretd 20_2_10003A2A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 20_2_10003866 pushfd ; iretd 20_2_10003867
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 20_2_10004B78 push esi; ret 20_2_10004B86
Source: initial sample Static PE information: section name: .text entropy: 7.5511794748
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\System32\loaddll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\loaddll32.exe Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: WerFault.exe, 0000000A.00000002.506407108.0000000004B40000.00000002.00000001.sdmp, WerFault.exe, 0000000E.00000002.504929075.0000000004C50000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.519784751.0000000005480000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000A.00000002.502947562.00000000009E9000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 0000000A.00000002.506407108.0000000004B40000.00000002.00000001.sdmp, WerFault.exe, 0000000E.00000002.504929075.0000000004C50000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.519784751.0000000005480000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000A.00000002.506407108.0000000004B40000.00000002.00000001.sdmp, WerFault.exe, 0000000E.00000002.504929075.0000000004C50000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.519784751.0000000005480000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000A.00000002.506407108.0000000004B40000.00000002.00000001.sdmp, WerFault.exe, 0000000E.00000002.504929075.0000000004C50000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.519784751.0000000005480000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 15_2_10006D50

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\b8fe43e6_by_Libranalysis.dll',#1 Jump to behavior
Source: rundll32.exe, 0000000F.00000002.513548625.0000000003130000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.513389214.0000000003710000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.514777331.00000000034D0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 0000000F.00000002.513548625.0000000003130000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.513389214.0000000003710000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.514777331.00000000034D0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: rundll32.exe, 0000000F.00000002.513548625.0000000003130000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.513389214.0000000003710000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.514777331.00000000034D0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: rundll32.exe, 0000000F.00000002.513548625.0000000003130000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.513389214.0000000003710000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.514777331.00000000034D0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 0000000F.00000002.513548625.0000000003130000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.513389214.0000000003710000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.514777331.00000000034D0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 15_2_10006D50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 15_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 15_2_10006D50
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 404281 Sample: b8fe43e6_by_Libranalysis Startdate: 04/05/2021 Architecture: WINDOWS Score: 76 31 95.138.161.226 RACKSPACE-LONGB United Kingdom 2->31 33 167.114.113.13 OVHFR Canada 2->33 35 193.200.130.181 CLOUD-MANAGEMENT-LLCUS unknown 2->35 39 Found malware configuration 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected Dridex unpacked file 2->43 45 2 other signatures 2->45 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 49 Tries to detect sandboxes / dynamic malware analysis system (file name check) 9->49 12 cmd.exe 1 9->12         started        14 rundll32.exe 9->14         started        17 rundll32.exe 9->17         started        19 5 other processes 9->19 process6 signatures7 21 rundll32.exe 12->21         started        51 Tries to detect sandboxes / dynamic malware analysis system (file name check) 14->51 24 WerFault.exe 9 14->24         started        26 WerFault.exe 3 17->26         started        process8 signatures9 47 Tries to detect sandboxes / dynamic malware analysis system (file name check) 21->47 28 WerFault.exe 23 9 21->28         started        process10 dnsIp11 37 192.168.2.1 unknown unknown 28->37
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
167.114.113.13
unknown Canada
16276 OVHFR true
95.138.161.226
unknown United Kingdom
15395 RACKSPACE-LONGB true
193.200.130.181
unknown unknown
42960 CLOUD-MANAGEMENT-LLCUS true

Private

IP
192.168.2.1