Analysis Report 3c271eae_by_Libranalysis

Overview

General Information

Sample Name: 3c271eae_by_Libranalysis (renamed file extension from none to dll)
Analysis ID: 404285
MD5: 3c271eae5a3a2817cfd8704f75fdf405
SHA1: 03b821b5d8b5416900245a05fce8541a21b6da7c
SHA256: dbd00287fe0c78430fee81ec6333b9c9b1863b7c62ac305de627ce6ca9fb314e
Tags: Dridex
Infos:

Most interesting Screenshot:

Detection

Dridex
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 1.2.loaddll32.exe.10000000.2.unpack Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["193.200.130.181:443", "95.138.161.226:2303", "167.114.113.13:4125"], "RC4 keys": ["MqW38NQIO70GhjGOOvjtl5AwyenW6A8fcZ", "xeMr6QHn7uRk1D2ChU8OuyaRFUZJZZHUIgxCzaPXtOkjmhTMtNxfWU8nlnD7q009ahEI51R1"]}
Multi AV Scanner detection for submitted file
Source: 3c271eae_by_Libranalysis.dll Metadefender: Detection: 21% Perma Link
Source: 3c271eae_by_Libranalysis.dll ReversingLabs: Detection: 27%
Machine Learning detection for sample
Source: 3c271eae_by_Libranalysis.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 15.2.rundll32.exe.31b0000.2.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 13.2.rundll32.exe.c00000.2.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 1.2.loaddll32.exe.580000.1.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 4.2.rundll32.exe.5a0000.2.unpack Avira: Label: TR/ATRAPS.Gen2

Compliance:

barindex
Uses 32bit PE files
Source: 3c271eae_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Source: 3c271eae_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.732940731.0000000000A45000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736721982.0000000003752000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.783765282.00000000052A0000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926913116.0000000005675000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: dnsapi.pdb5S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 00000007.00000003.734585712.0000000000A3F000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736372515.000000000374C000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: opengl32.pdbf source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb@ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdbt source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdbN source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdbe source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbP source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb_ source: WerFault.exe, 00000011.00000002.934165093.00000000052A2000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.733841780.0000000000A4B000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736729941.0000000003758000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb. source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbw source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbH source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbGS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdbQS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.816014446.0000000005AE5000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdbM source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb- source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdbx source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdbo source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb\ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926913116.0000000005675000.00000004.00000040.sdmp
Source: Binary string: KiUserCallbackDispatcherRSDSwntdll.pdb source: WerFault.exe, 00000011.00000002.928673597.0000000001072000.00000004.00000001.sdmp
Source: Binary string: rasapi32.pdbY source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: glu32.pdbG source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb~ source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbr source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdbwS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: 3c271eae_by_Libranalysis.dll
Source: Binary string: advapi32.pdbN source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdbV source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbx source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926659853.0000000005672000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.732940731.0000000000A45000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736721982.0000000003752000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.791534182.00000000012A1000.00000004.00000001.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736367252.0000000003746000.00000004.00000001.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdbA source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: KERNEL32C:\Windows\System32\KERNEL32.DLLC:\Windows\System32\KERNEL32.DLLRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.928673597.0000000001072000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdbV source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.816014446.0000000005AE5000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbe source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbk source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbS source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbD source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb( source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.734585712.0000000000A3F000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736372515.000000000374C000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdbZ source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 00000007.00000003.732917274.0000000000A39000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736367252.0000000003746000.00000004.00000001.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb}2> source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb]S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb+ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb?S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb!S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: sfc_os.pdbl source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdbeS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.733841780.0000000000A4B000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736729941.0000000003758000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.811134617.00000000012A7000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 00000011.00000003.926659853.0000000005672000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdbZ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 193.200.130.181:443
Source: Malware configuration extractor IPs: 95.138.161.226:2303
Source: Malware configuration extractor IPs: 167.114.113.13:4125
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 167.114.113.13 167.114.113.13
Source: Joe Sandbox View IP Address: 95.138.161.226 95.138.161.226
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
Source: Joe Sandbox View ASN Name: RACKSPACE-LONGB RACKSPACE-LONGB
Source: WerFault.exe, 00000007.00000003.888034392.0000000004976000.00000004.00000001.sdmp String found in binary or memory: http://crl.micro

E-Banking Fraud:

barindex
Yara detected Dridex unpacked file
Source: Yara match File source: 0000000F.00000002.933498628.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.932757910.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.929835817.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.933327968.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match File source: 1.2.loaddll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE

System Summary:

barindex
Detected potential crypto function
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_10001494 1_2_10001494
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_10011460 1_2_10011460
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_1000846C 1_2_1000846C
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_1000A52C 1_2_1000A52C
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_10011D58 1_2_10011D58
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_10019348 1_2_10019348
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_10010754 1_2_10010754
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_100090CC 1_2_100090CC
One or more processes crash
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 760
Sample file is different than original file name gathered from version info
Source: 3c271eae_by_Libranalysis.dll Binary or memory string: OriginalFilenamej2pcsc.dllN vs 3c271eae_by_Libranalysis.dll
Uses 32bit PE files
Source: 3c271eae_by_Libranalysis.dll Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
Yara signature match
Source: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_7584c961c6fefb28629a227a579a8cc1f481e81d_82810a17_1806e157\Report.wer, type: DROPPED Matched rule: SUSP_WER_Critical_HeapCorruption date = 2019-10-18, author = Florian Roth, description = Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation), reference = https://twitter.com/cyb3rops/status/1185459425710092288, score =
Source: 3c271eae_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal76.troj.evad.winDLL@20/9@0/3
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7132
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7144
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7108
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC9B.tmp Jump to behavior
Source: 3c271eae_by_Libranalysis.dll Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll,LoxmtYt
Source: 3c271eae_by_Libranalysis.dll Metadefender: Detection: 21%
Source: 3c271eae_by_Libranalysis.dll ReversingLabs: Detection: 27%
Source: unknown Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll,LoxmtYt
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 760
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 928
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddFileToInstance
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddParameter
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiCancel
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 588
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1 Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll,LoxmtYt Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllCanUnloadNow Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllGetClassObject Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddFileToInstance Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddParameter Jump to behavior
Source: C:\Windows\System32\loaddll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiCancel Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1 Jump to behavior
Source: 3c271eae_by_Libranalysis.dll Static PE information: DYNAMIC_BASE, NX_COMPAT
Source: 3c271eae_by_Libranalysis.dll Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.732940731.0000000000A45000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736721982.0000000003752000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.783765282.00000000052A0000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926913116.0000000005675000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: dnsapi.pdb5S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 00000007.00000003.734585712.0000000000A3F000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736372515.000000000374C000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: CoreMessaging.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: opengl32.pdbf source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: profapi.pdb@ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdbt source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdbN source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdbe source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdbP source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb_ source: WerFault.exe, 00000011.00000002.934165093.00000000052A2000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.733841780.0000000000A4B000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736729941.0000000003758000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb. source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbw source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbH source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdbGS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdbQS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.816014446.0000000005AE5000.00000004.00000040.sdmp
Source: Binary string: dwmapi.pdbM source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb- source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdbx source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: nsi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdbo source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb\ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926913116.0000000005675000.00000004.00000040.sdmp
Source: Binary string: KiUserCallbackDispatcherRSDSwntdll.pdb source: WerFault.exe, 00000011.00000002.928673597.0000000001072000.00000004.00000001.sdmp
Source: Binary string: rasapi32.pdbY source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: glu32.pdbG source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb~ source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbr source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: opengl32.pdbwS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: FGERN.pdb source: 3c271eae_by_Libranalysis.dll
Source: Binary string: advapi32.pdbN source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdbV source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdbx source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926659853.0000000005672000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.732940731.0000000000A45000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736721982.0000000003752000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.791534182.00000000012A1000.00000004.00000001.sdmp
Source: Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736367252.0000000003746000.00000004.00000001.sdmp
Source: Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdbA source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: KERNEL32C:\Windows\System32\KERNEL32.DLLC:\Windows\System32\KERNEL32.DLLRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.928673597.0000000001072000.00000004.00000001.sdmp
Source: Binary string: wimm32.pdbV source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: glu32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.816014446.0000000005AE5000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbe source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbk source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: dnsapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: rasman.pdbS source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: rasapi32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdbD source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb( source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.734585712.0000000000A3F000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736372515.000000000374C000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdbZ source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rasman.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.808991952.0000000005AE2000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdb( source: WerFault.exe, 00000007.00000003.732917274.0000000000A39000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736367252.0000000003746000.00000004.00000001.sdmp
Source: Binary string: TextInputFramework.pdb source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: iphlpapi.pdb}2> source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ClusApi.pdb]S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb+ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: ws2_32.pdb?S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb!S source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: sfc_os.pdbl source: WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdbeS source: WerFault.exe, 00000011.00000003.926946031.0000000005678000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.733841780.0000000000A4B000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.736729941.0000000003758000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.811134617.00000000012A7000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.739554715.0000000004EE0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.815252847.0000000005AE0000.00000004.00000040.sdmp, WerFault.exe, 00000011.00000003.926637905.0000000005871000.00000004.00000001.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 00000011.00000003.926659853.0000000005672000.00000004.00000040.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.810520936.0000000005AE8000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdbZ source: WerFault.exe, 00000007.00000003.739561126.0000000004EE6000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.739537983.0000000004D51000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.805767429.0000000005901000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.926884946.0000000005670000.00000004.00000040.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_1000F6CC push esi; mov dword ptr [esp], 00000000h 1_2_1000F6CD
Source: initial sample Static PE information: section name: .text entropy: 7.5511794748
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Source: C:\Windows\System32\loaddll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: \KnownDlls32\Testapp.EXE Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\loaddll32.exe Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe Thread delayed: delay time: 120000 Jump to behavior
Source: WerFault.exe, 00000007.00000002.922410876.00000000012D0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.934188762.0000000005320000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000007.00000002.927600121.0000000004A44000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000007.00000002.922410876.00000000012D0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.934188762.0000000005320000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000007.00000002.922410876.00000000012D0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.934188762.0000000005320000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000007.00000002.927600121.0000000004A44000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWb
Source: WerFault.exe, 00000007.00000002.922410876.00000000012D0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.934188762.0000000005320000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 1_2_10006D50

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1 Jump to behavior
Source: loaddll32.exe, 00000001.00000002.929674446.0000000000C90000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.931879093.00000000038B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.932017454.0000000003890000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: loaddll32.exe, 00000001.00000002.929674446.0000000000C90000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.931879093.00000000038B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.932017454.0000000003890000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000001.00000002.929674446.0000000000C90000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.931879093.00000000038B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.932017454.0000000003890000.00000002.00000001.sdmp Binary or memory string: Progman
Source: loaddll32.exe, 00000001.00000002.929674446.0000000000C90000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.931879093.00000000038B0000.00000002.00000001.sdmp, WerFault.exe, 00000011.00000002.932017454.0000000003890000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\System32\loaddll32.exe Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 1_2_10006D50
Source: C:\Windows\System32\loaddll32.exe Code function: 1_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA, 1_2_10006D50
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 404285 Sample: 3c271eae_by_Libranalysis Startdate: 04/05/2021 Architecture: WINDOWS Score: 76 28 95.138.161.226 RACKSPACE-LONGB United Kingdom 2->28 30 167.114.113.13 OVHFR Canada 2->30 32 193.200.130.181 CLOUD-MANAGEMENT-LLCUS unknown 2->32 34 Found malware configuration 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 Yara detected Dridex unpacked file 2->38 40 2 other signatures 2->40 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 44 Tries to detect sandboxes / dynamic malware analysis system (file name check) 9->44 12 cmd.exe 1 9->12         started        14 rundll32.exe 9->14         started        17 rundll32.exe 9->17         started        19 5 other processes 9->19 process6 signatures7 21 rundll32.exe 12->21         started        46 Tries to detect sandboxes / dynamic malware analysis system (file name check) 14->46 24 WerFault.exe 8 14->24         started        process8 signatures9 42 Tries to detect sandboxes / dynamic malware analysis system (file name check) 21->42 26 WerFault.exe 23 9 21->26         started        process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
167.114.113.13
 unknown Canada
16276 OVHFR true
95.138.161.226
 unknown United Kingdom
15395 RACKSPACE-LONGB true
193.200.130.181
 unknown unknown
42960 CLOUD-MANAGEMENT-LLCUS true