Analysis Report f845ef61_by_Libranalysis

Overview

General Information

Sample Name: f845ef61_by_Libranalysis (renamed file extension from none to dll)
Analysis ID: 404282
MD5: f845ef6120dfd5a421786e9d818c9ddb
SHA1: 0517da7604bec2311002f113938660db1a7c7c98
SHA256: 26af94089c064eafa3025ac20749882f18213bf8608147a2b842e55e13d7c688
Tags: Dridex
Infos:

Most interesting Screenshot:

Detection

Dridex
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 15.2.rundll32.exe.10000000.3.unpack Malware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["193.200.130.181:443", "95.138.161.226:2303", "167.114.113.13:4125"], "RC4 keys": ["MqW38NQIO70GhjGOOvjtl5AwyenW6A8fcZ", "gVWbIbse4LncmZTrtE5bhEEfziocKyUXoiF1kB3a8v5ucqsS91u1M39nZYKpCWBaZM8JOlA1"]}
Multi AV Scanner detection for submitted file
Source: f845ef61_by_Libranalysis.dll Metadefender: Detection: 21% Perma Link
Source: f845ef61_by_Libranalysis.dll ReversingLabs: Detection: 23%
Machine Learning detection for sample
Source: f845ef61_by_Libranalysis.dll Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: f845ef61_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: f845ef61_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: winspool.pdba% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.434205216.0000000004E75000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.437623888.0000000002A82000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.558772594.0000000004597000.00000004.00000001.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000B.00000003.435060985.0000000002F40000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438760333.0000000002A7C000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdbE% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb[% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.434470631.0000000002F4C000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438229075.0000000002A88000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdbp source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb.LK source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb2LG source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdbI% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb]% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593519957.0000000004DF5000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb7 source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb% source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdbW% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp
Source: Binary string: dwmapi.pdb|0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: combase.pdbC% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: f845ef61_by_Libranalysis.dll
Source: Binary string: dwmapi.pdb(LM source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000B.00000003.434230037.0000000002F46000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.437623888.0000000002A82000.00000004.00000001.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: ole32.pdbCC source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: mpr.pdbs source: WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: a/pjr2pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000D.00000002.602833822.00000000023D2000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdbm source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: sfc.pdbp source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593519957.0000000004DF5000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdbk source: WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: msctf.pdbL0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb*0!% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdbk source: WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb$LQ source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000B.00000003.435060985.0000000002F40000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438760333.0000000002A7C000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb<Ly source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: combase.pdbs source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdbz0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 0000000D.00000003.436771504.0000000002A76000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdbg source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb,0+% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdba source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbh0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000B.00000003.434470631.0000000002F4C000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438229075.0000000002A88000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdbeN source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbF^ source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 193.200.130.181:443
Source: Malware configuration extractor IPs: 95.138.161.226:2303
Source: Malware configuration extractor IPs: 167.114.113.13:4125
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 167.114.113.13 167.114.113.13
Source: Joe Sandbox View IP Address: 95.138.161.226 95.138.161.226
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
Source: Joe Sandbox View ASN Name: RACKSPACE-LONGB RACKSPACE-LONGB

E-Banking Fraud:

barindex
Yara detected Dridex unpacked file
Source: Yara match File source: 00000010.00000002.593134823.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.593304791.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.590448594.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.594741649.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.605551680.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 15.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_10011460 14_2_10011460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_1000846C 14_2_1000846C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_10001494 14_2_10001494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_1000A52C 14_2_1000A52C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_10011D58 14_2_10011D58
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_10019348 14_2_10019348
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_10010754 14_2_10010754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_100090CC 14_2_100090CC
One or more processes crash
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 764
Sample file is different than original file name gathered from version info
Source: f845ef61_by_Libranalysis.dll Binary or memory string: OriginalFilenamej2pcsc.dllN vs f845ef61_by_Libranalysis.dll
Uses 32bit PE files
Source: f845ef61_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: f845ef61_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal76.troj.evad.winDLL@24/16@0/4
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6560
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess340
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6612
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6624
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERA522.tmp Jump to behavior
Source: f845ef61_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll,LoxmtYt
Source: f845ef61_by_Libranalysis.dll Metadefender: Detection: 21%
Source: f845ef61_by_Libranalysis.dll ReversingLabs: Detection: 23%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll,LoxmtYt
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 764
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 888
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddFileToInstance
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddParameter
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiCancel
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 604
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 760
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 760
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll,LoxmtYt Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllCanUnloadNow Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllGetClassObject Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddFileToInstance Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddParameter Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiCancel Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 760 Jump to behavior
Source: f845ef61_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: f845ef61_by_Libranalysis.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: winspool.pdba% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.434205216.0000000004E75000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.437623888.0000000002A82000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.558772594.0000000004597000.00000004.00000001.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000B.00000003.435060985.0000000002F40000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438760333.0000000002A7C000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdbE% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb[% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.434470631.0000000002F4C000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438229075.0000000002A88000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdbp source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb.LK source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb2LG source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdbI% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb]% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593519957.0000000004DF5000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb7 source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb% source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdbW% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp
Source: Binary string: dwmapi.pdb|0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: combase.pdbC% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: f845ef61_by_Libranalysis.dll
Source: Binary string: dwmapi.pdb(LM source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000B.00000003.434230037.0000000002F46000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.437623888.0000000002A82000.00000004.00000001.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: ole32.pdbCC source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: mpr.pdbs source: WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: a/pjr2pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000D.00000002.602833822.00000000023D2000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdbm source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: sfc.pdbp source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593519957.0000000004DF5000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdbk source: WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: msctf.pdbL0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb*0!% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdbk source: WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596557954.0000000004962000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb$LQ source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000B.00000003.435060985.0000000002F40000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438760333.0000000002A7C000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596797767.0000000004960000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb<Ly source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: combase.pdbs source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593173201.0000000004DF2000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdbz0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 0000000D.00000003.436771504.0000000002A76000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdbg source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb,0+% source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdba source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbh0 source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.440503440.00000000052D0000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593477740.0000000004DF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000B.00000003.434470631.0000000002F4C000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.438229075.0000000002A88000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdbeN source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbF^ source: WerFault.exe, 00000014.00000003.596847466.0000000004968000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.440529525.00000000052D6000.00000004.00000040.sdmp, WerFault.exe, 0000000D.00000003.593251198.0000000004DF8000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.440473246.0000000005301000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.593009404.0000000004CC1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596512885.0000000004B51000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_1000F6CC push esi; mov dword ptr [esp], 00000000h 14_2_1000F6CD
Source: initial sample Static PE information: section name: .text entropy: 7.56345314972

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\WerFault.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\System32\loaddll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\loaddll32.exe Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: WerFault.exe, 0000000B.00000002.604193896.00000000053F0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.605983948.0000000004E80000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000B.00000002.602500515.0000000004D70000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 0000000B.00000002.604193896.00000000053F0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.605983948.0000000004E80000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000B.00000002.604193896.00000000053F0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.605983948.0000000004E80000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000B.00000002.604193896.00000000053F0000.00000002.00000001.sdmp, WerFault.exe, 0000000D.00000002.605983948.0000000004E80000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 14_2_10006D50
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 760 Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 760 Jump to behavior

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 14_2_10006D50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 14_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 14_2_10006D50
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 404282 Sample: f845ef61_by_Libranalysis Startdate: 04/05/2021 Architecture: WINDOWS Score: 76 33 95.138.161.226 RACKSPACE-LONGB United Kingdom 2->33 35 167.114.113.13 OVHFR Canada 2->35 37 193.200.130.181 CLOUD-MANAGEMENT-LLCUS unknown 2->37 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected Dridex unpacked file 2->45 47 2 other signatures 2->47 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 51 Tries to detect sandboxes / dynamic malware analysis system (file name check) 9->51 12 cmd.exe 1 9->12         started        14 rundll32.exe 9->14         started        17 rundll32.exe 9->17         started        19 5 other processes 9->19 process6 signatures7 21 rundll32.exe 12->21         started        53 Tries to detect sandboxes / dynamic malware analysis system (file name check) 14->53 24 WerFault.exe 2 9 14->24         started        26 WerFault.exe 14->26         started        28 WerFault.exe 9 17->28         started        process8 signatures9 49 Tries to detect sandboxes / dynamic malware analysis system (file name check) 21->49 30 WerFault.exe 23 9 21->30         started        process10 dnsIp11 39 192.168.2.1 unknown unknown 30->39
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
167.114.113.13
unknown Canada
16276 OVHFR true
95.138.161.226
unknown United Kingdom
15395 RACKSPACE-LONGB true
193.200.130.181
unknown unknown
42960 CLOUD-MANAGEMENT-LLCUS true

Private

IP
192.168.2.1