Analysis Report f845ef61_by_Libranalysis.dll

Overview

General Information

Sample Name: f845ef61_by_Libranalysis.dll
Analysis ID: 404282
MD5: f845ef6120dfd5a421786e9d818c9ddb
SHA1: 0517da7604bec2311002f113938660db1a7c7c98
SHA256: 26af94089c064eafa3025ac20749882f18213bf8608147a2b842e55e13d7c688
Tags: Dridex
Infos:

Most interesting Screenshot:

Detection

Dridex
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 15.2.rundll32.exe.10000000.3.unpack Malware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["193.200.130.181:443", "95.138.161.226:2303", "167.114.113.13:4125"], "RC4 keys": ["MqW38NQIO70GhjGOOvjtl5AwyenW6A8fcZ", "gVWbIbse4LncmZTrtE5bhEEfziocKyUXoiF1kB3a8v5ucqsS91u1M39nZYKpCWBaZM8JOlA1"]}
Multi AV Scanner detection for submitted file
Source: f845ef61_by_Libranalysis.dll Metadefender: Detection: 21% Perma Link
Source: f845ef61_by_Libranalysis.dll ReversingLabs: Detection: 23%
Machine Learning detection for sample
Source: f845ef61_by_Libranalysis.dll Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: f845ef61_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: f845ef61_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cryptbase.pdbV source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.409569511.0000000004C81000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.503663301.0000000002EB2000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524595619.0000000004ADB000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb[ source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.373365836.0000000002F3D000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.534224836.0000000002C2E000.00000004.00000001.sdmp
Source: Binary string: msctf.pdbs source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb>u source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdbGz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb=z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb+ source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb> source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.501406024.0000000002EB8000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524712511.0000000002C3A000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb7z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb#z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdb8 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb| source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbv source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbL source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb)z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb%z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb| source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbR source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbP source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb_ source: WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdbb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdbc source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: sfc.pdbN source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: imagehlp.pdbz source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb\ source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdbv source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: f845ef61_by_Libranalysis.dll
Source: Binary string: sfc_os.pdbyz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdbQz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: sechost.pdbp source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb;z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: azojr}oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.522361449.00000000007B2000.00000004.00000001.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.372774805.0000000002F37000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000016.00000003.409551953.0000000002F43000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.503663301.0000000002EB2000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524694317.0000000002C34000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdb` source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: winspool.pdbsz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdbi source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb2 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb_z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: combase.pdbL source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb$ source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdbk source: WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp
Source: Binary string: mpr.pdbM source: WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdbF source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdbMz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb@u source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbXu source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb7 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: upwntdll.pdb source: WerFault.exe, 0000001B.00000003.519402498.000000000515E000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000016.00000003.373365836.0000000002F3D000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.502119479.00000000032EC000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.501330183.0000000002EAC000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.534224836.0000000002C2E000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdbR source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdbC source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbT source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb1 source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb1 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 00000016.00000003.372774805.0000000002F37000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdbj source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbuz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbX source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: profapi.pdboz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdbd source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: combase.pdb^ source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdbn source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbKz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000016.00000003.409454819.0000000002F49000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.501406024.0000000002EB8000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524712511.0000000002C3A000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: winspool.pdbX source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb* source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 193.200.130.181:443
Source: Malware configuration extractor IPs: 95.138.161.226:2303
Source: Malware configuration extractor IPs: 167.114.113.13:4125
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 167.114.113.13 167.114.113.13
Source: Joe Sandbox View IP Address: 95.138.161.226 95.138.161.226
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
Source: Joe Sandbox View ASN Name: RACKSPACE-LONGB RACKSPACE-LONGB
Source: WerFault.exe, 0000001C.00000003.552259452.0000000004AE3000.00000004.00000001.sdmp String found in binary or memory: http://crl.microg
Source: WerFault.exe, 0000001C.00000003.552259452.0000000004AE3000.00000004.00000001.sdmp String found in binary or memory: http://crl.microsoftk
Source: WerFault.exe, 0000001C.00000003.552259452.0000000004AE3000.00000004.00000001.sdmp String found in binary or memory: http://microsoft.co
Source: WerFault.exe, 0000001C.00000003.552259452.0000000004AE3000.00000004.00000001.sdmp String found in binary or memory: http://www.microsoft.c7
Source: WerFault.exe, 0000001C.00000003.552259452.0000000004AE3000.00000004.00000001.sdmp String found in binary or memory: http://www.microsoft.co

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: loaddll32.exe, 00000000.00000002.607314256.00000000009DB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected Dridex unpacked file
Source: Yara match File source: 0000000F.00000002.568262933.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.520394010.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.561363853.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.506563386.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.474922417.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.588526568.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 15.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_10011460 3_2_10011460
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_1000846C 3_2_1000846C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_10001494 3_2_10001494
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_1000A52C 3_2_1000A52C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_10011D58 3_2_10011D58
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_10019348 3_2_10019348
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_10010754 3_2_10010754
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_100090CC 3_2_100090CC
One or more processes crash
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 768
Sample file is different than original file name gathered from version info
Source: f845ef61_by_Libranalysis.dll Binary or memory string: OriginalFilenamej2pcsc.dllN vs f845ef61_by_Libranalysis.dll
Uses 32bit PE files
Source: f845ef61_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: f845ef61_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal76.troj.evad.winDLL@22/20@0/4
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7152
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7000
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6036
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6976
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3D1.tmp Jump to behavior
Source: f845ef61_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll,LoxmtYt
Source: f845ef61_by_Libranalysis.dll Metadefender: Detection: 21%
Source: f845ef61_by_Libranalysis.dll ReversingLabs: Detection: 23%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll,LoxmtYt
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 768
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddFileToInstance
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddParameter
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiCancel
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 944
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 776
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 756
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 756
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll,LoxmtYt Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllCanUnloadNow Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',DllGetClassObject Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddFileToInstance Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiAddParameter Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',WdiCancel Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: f845ef61_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: f845ef61_by_Libranalysis.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: cryptbase.pdbV source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.409569511.0000000004C81000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.503663301.0000000002EB2000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524595619.0000000004ADB000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb[ source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.373365836.0000000002F3D000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.534224836.0000000002C2E000.00000004.00000001.sdmp
Source: Binary string: msctf.pdbs source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb>u source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdbGz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb=z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb+ source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb> source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.501406024.0000000002EB8000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524712511.0000000002C3A000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb7z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdb#z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdb8 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb| source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbv source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbL source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdb)z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb%z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb| source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbR source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbP source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb_ source: WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdbb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdbc source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: sfc.pdbN source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: imagehlp.pdbz source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb\ source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: wsspicli.pdbv source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: f845ef61_by_Libranalysis.dll
Source: Binary string: sfc_os.pdbyz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdbQz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: sechost.pdbp source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb;z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: azojr}oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.522361449.00000000007B2000.00000004.00000001.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.372774805.0000000002F37000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000016.00000003.409551953.0000000002F43000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.503663301.0000000002EB2000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524694317.0000000002C34000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdb` source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: winspool.pdbsz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdbi source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb2 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb_z source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: combase.pdbL source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb$ source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdbk source: WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp
Source: Binary string: mpr.pdbM source: WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdbF source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510318514.0000000005312000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdbMz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb@u source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbXu source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb7 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: upwntdll.pdb source: WerFault.exe, 0000001B.00000003.519402498.000000000515E000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000016.00000003.373365836.0000000002F3D000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.502119479.00000000032EC000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.501330183.0000000002EAC000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.534224836.0000000002C2E000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdbR source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdbC source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbT source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb1 source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510644112.0000000005315000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb1 source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 00000016.00000003.372774805.0000000002F37000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdbj source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbuz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbX source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: profapi.pdboz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdbd source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: combase.pdb^ source: WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdbn source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.356546300.00000000057E0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510610057.0000000005310000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519717090.00000000055F0000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549236361.0000000005120000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbKz source: WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000016.00000003.409454819.0000000002F49000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.501406024.0000000002EB8000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.524712511.0000000002C3A000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.510366450.0000000005318000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp, WerFault.exe, 00000020.00000003.549252383.0000000005126000.00000004.00000040.sdmp
Source: Binary string: winspool.pdbX source: WerFault.exe, 0000001B.00000003.519728381.00000000055F6000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb* source: WerFault.exe, 0000000B.00000003.356553275.00000000057E6000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.356533507.0000000005611000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.510219331.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.519684631.0000000005621000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.521829579.0000000005061000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000003.549198466.0000000004F71000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_1000F6CC push esi; mov dword ptr [esp], 00000000h 3_2_1000F6CD
Source: initial sample Static PE information: section name: .text entropy: 7.56345314972

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\WerFault.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\System32\loaddll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: WerFault.exe, 0000000B.00000002.511351141.0000000005800000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.538794659.0000000004E60000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.555178488.0000000005160000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.557175613.0000000004BD0000.00000002.00000001.sdmp, WerFault.exe, 00000020.00000002.584233721.0000000005140000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000B.00000002.510238169.000000000516A000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWhA
Source: WerFault.exe, 00000020.00000002.583537518.0000000004ACA000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWP
Source: WerFault.exe, 0000000B.00000002.510281872.0000000005182000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000002.554604785.0000000005063000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000002.555571430.0000000002EE9000.00000004.00000001.sdmp, WerFault.exe, 00000020.00000002.583457331.00000000049F4000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 0000000B.00000002.511351141.0000000005800000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.538794659.0000000004E60000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.555178488.0000000005160000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.557175613.0000000004BD0000.00000002.00000001.sdmp, WerFault.exe, 00000020.00000002.584233721.0000000005140000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000B.00000002.511351141.0000000005800000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.538794659.0000000004E60000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.555178488.0000000005160000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.557175613.0000000004BD0000.00000002.00000001.sdmp, WerFault.exe, 00000020.00000002.584233721.0000000005140000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000B.00000002.511351141.0000000005800000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.538794659.0000000004E60000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.555178488.0000000005160000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.557175613.0000000004BD0000.00000002.00000001.sdmp, WerFault.exe, 00000020.00000002.584233721.0000000005140000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_10006D50

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\f845ef61_by_Libranalysis.dll',#1 Jump to behavior

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_10006D50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 3_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 3_2_10006D50
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 404282 Sample: f845ef61_by_Libranalysis.dll Startdate: 04/05/2021 Architecture: WINDOWS Score: 76 37 95.138.161.226 RACKSPACE-LONGB United Kingdom 2->37 39 167.114.113.13 OVHFR Canada 2->39 41 193.200.130.181 CLOUD-MANAGEMENT-LLCUS unknown 2->41 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected Dridex unpacked file 2->47 49 2 other signatures 2->49 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 53 Tries to detect sandboxes / dynamic malware analysis system (file name check) 9->53 12 cmd.exe 1 9->12         started        14 rundll32.exe 9->14         started        17 rundll32.exe 9->17         started        19 4 other processes 9->19 process6 signatures7 21 rundll32.exe 12->21         started        55 Tries to detect sandboxes / dynamic malware analysis system (file name check) 14->55 24 WerFault.exe 9 14->24         started        26 WerFault.exe 9 17->26         started        28 WerFault.exe 2 9 19->28         started        30 WerFault.exe 19->30         started        process8 signatures9 51 Tries to detect sandboxes / dynamic malware analysis system (file name check) 21->51 32 WerFault.exe 23 9 21->32         started        process10 dnsIp11 35 192.168.2.1 unknown unknown 32->35
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
167.114.113.13
 unknown Canada
16276 OVHFR true
95.138.161.226
 unknown United Kingdom
15395 RACKSPACE-LONGB true
193.200.130.181
 unknown unknown
42960 CLOUD-MANAGEMENT-LLCUS true

Private
IP
192.168.2.1