Analysis Report 3c271eae_by_Libranalysis.dll

AV Detection:

Found malware configuration

Source: 15.2.rundll32.exe.10000000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["193.200.130.181:443", "95.138.161.226:2303", "167.114.113.13:4125"], "RC4 keys": ["MqW38NQIO70GhjGOOvjtl5AwyenW6A8fcZ", "xeMr6QHn7uRk1D2ChU8OuyaRFUZJZZHUIgxCzaPXtOkjmhTMtNxfWU8nlnD7q009ahEI51R1"]}

Multi AV Scanner detection for submitted file

Source: 3c271eae_by_Libranalysis.dll	Metadefender: Detection: 21%			Perma Link
Source: 3c271eae_by_Libranalysis.dll	ReversingLabs: Detection: 27%

Machine Learning detection for sample

Source: 3c271eae_by_Libranalysis.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 17.2.rundll32.exe.7b0000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 15.2.rundll32.exe.560000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 0.2.loaddll32.exe.b40000.1.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 16.2.rundll32.exe.9e0000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.2.rundll32.exe.850000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 18.2.rundll32.exe.d90000.2.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 13.2.rundll32.exe.b90000.1.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 2.2.rundll32.exe.2fc0000.2.unpack	Avira: Label: TR/ATRAPS.Gen2

Compliance:

Uses 32bit PE files

Source: 3c271eae_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 3c271eae_by_Libranalysis.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: dnsapi.pdbF source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdbnq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.424911525.0000000002A92000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.590103743.0000000002EA1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.592752094.00000000047CB000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb#dc source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb, source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588098874.0000000002E9B000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb! source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb~ source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdbl source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb3 source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb' source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb8 source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbX source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.423591311.0000000002A98000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.589251650.0000000003399000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdbv source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbx source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdbA source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbO source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbi source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb] source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: ClusApi.pdb@q source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb0 source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb/d source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdbW source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb[ source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb| source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb|, source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb5 source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: FGERN.pdb source: 3c271eae_by_Libranalysis.dll
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588054272.0000000002E95000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000C.00000003.424911525.0000000002A92000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.590103743.0000000002EA1000.00000004.00000001.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbhq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdbc source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb+ source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: a'pjr*pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000C.00000002.574931083.0000000000632000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb)d source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: ClusApi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb2 source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb|q source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdbR source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb& source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbT source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: ClusApi.pdbt source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb3 source: WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb=d source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000C.00000003.423735765.0000000002A8C000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588098874.0000000002E9B000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.588684577.000000000338D000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb* source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbpq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdbbq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb|% source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb0 source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb5 source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbq source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb( source: WerFault.exe, 0000000C.00000003.423542715.0000000002A86000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588054272.0000000002E95000.00000004.00000001.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbe source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000C.00000003.423591311.0000000002A98000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588185425.0000000002EA7000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.589251650.0000000003399000.00000004.00000001.sdmp
Source:	Binary string: rasapi32.pdbvq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 193.200.130.181:443
Source: Malware configuration extractor	IPs: 95.138.161.226:2303
Source: Malware configuration extractor	IPs: 167.114.113.13:4125

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 167.114.113.13 167.114.113.13
Source: Joe Sandbox View	IP Address: 95.138.161.226 95.138.161.226

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: RACKSPACE-LONGB RACKSPACE-LONGB

URLs found in memory or binary data

Source: WerFault.exe, 0000001C.00000003.648753130.0000000005092000.00000004.00000001.sdmp	String found in binary or memory: http://crl.micro
Source: WerFault.exe, 0000001B.00000003.645645354.0000000004C20000.00000004.00000001.sdmp	String found in binary or memory: http://crl.micro8
Source: WerFault.exe, 0000001E.00000003.646412621.0000000002A79000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microH

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 00000010.00000002.578383295.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.659180073.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.599608439.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.660063361.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.578360981.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.663523541.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 15.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE

System Summary:

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001494		3_2_10001494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10011460		3_2_10011460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000846C		3_2_1000846C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000A52C		3_2_1000A52C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10011D58		3_2_10011D58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10019348		3_2_10019348
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010754		3_2_10010754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100090CC		3_2_100090CC

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 764

Sample file is different than original file name gathered from version info

Source: 3c271eae_by_Libranalysis.dll

Binary or memory string: OriginalFilenamej2pcsc.dllN vs 3c271eae_by_Libranalysis.dll

Uses 32bit PE files

Source: 3c271eae_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Yara signature match

Source: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_1d91dafffd792f9b512ff42d10d3dd5f24a3f5de_82810a17_1790f1d2\Report.wer, type: DROPPED	Matched rule: SUSP_WER_Critical_HeapCorruption date = 2019-10-18, author = Florian Roth, description = Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation), reference = https://twitter.com/cyb3rops/status/1185459425710092288, score =
Source: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_1d91dafffd792f9b512ff42d10d3dd5f24a3f5de_82810a17_01d168c7\Report.wer, type: DROPPED	Matched rule: SUSP_WER_Critical_HeapCorruption date = 2019-10-18, author = Florian Roth, description = Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation), reference = https://twitter.com/cyb3rops/status/1185459425710092288, score =

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: 3c271eae_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal76.troj.evad.winDLL@22/20@0/3

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5492
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5100
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5648
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess644
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6004

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD297.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: 3c271eae_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll,LoxmtYt

Sample is known by Antivirus

Source: 3c271eae_by_Libranalysis.dll	Metadefender: Detection: 21%
Source: 3c271eae_by_Libranalysis.dll	ReversingLabs: Detection: 27%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll,LoxmtYt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 764
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 888
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddFileToInstance
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddParameter
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiCancel
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 752
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 756
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 764
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll,LoxmtYt			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllCanUnloadNow			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',DllGetClassObject			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddFileToInstance			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiAddParameter			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',WdiCancel			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1			Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 3c271eae_by_Libranalysis.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: 3c271eae_by_Libranalysis.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: dnsapi.pdbF source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdbnq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.424911525.0000000002A92000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.590103743.0000000002EA1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.592752094.00000000047CB000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb#dc source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb, source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588098874.0000000002E9B000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb! source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb~ source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdbl source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb3 source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb' source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb8 source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbX source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.423591311.0000000002A98000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.589251650.0000000003399000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdbv source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbx source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdbA source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbO source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbi source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb] source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: ClusApi.pdb@q source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb0 source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb/d source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdbW source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb[ source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb| source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb|, source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb5 source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: FGERN.pdb source: 3c271eae_by_Libranalysis.dll
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588054272.0000000002E95000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000C.00000003.424911525.0000000002A92000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.590103743.0000000002EA1000.00000004.00000001.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbhq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb_ source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdbc source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb+ source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: a'pjr*pCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000C.00000002.574931083.0000000000632000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb)d source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: ClusApi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb2 source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb|q source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdbR source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb& source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbT source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: ClusApi.pdbt source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb3 source: WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb=d source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000C.00000003.423735765.0000000002A8C000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588098874.0000000002E9B000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.588684577.000000000338D000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb* source: WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbpq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdbbq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.511740943.0000000004DE2000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb|% source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb0 source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb5 source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbq source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb( source: WerFault.exe, 0000000C.00000003.423542715.0000000002A86000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588054272.0000000002E95000.00000004.00000001.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbe source: WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000009.00000003.427375651.0000000005180000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.517865960.0000000004DE0000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605811960.00000000051C0000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606439459.00000000055B0000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609305997.0000000004C30000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000C.00000003.423591311.0000000002A98000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.588185425.0000000002EA7000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.589251650.0000000003399000.00000004.00000001.sdmp
Source:	Binary string: rasapi32.pdbvq source: WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000009.00000003.427384192.0000000005186000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.513207382.0000000004DE8000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.605850778.00000000051C6000.00000004.00000040.sdmp, WerFault.exe, 0000001C.00000003.606466131.00000000055B6000.00000004.00000040.sdmp, WerFault.exe, 0000001E.00000003.609386178.0000000004C36000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000009.00000003.427340993.0000000004FF1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.508553143.0000000004E11000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.605759791.00000000051F1000.00000004.00000001.sdmp, WerFault.exe, 0000001C.00000003.606391797.00000000055E1000.00000004.00000001.sdmp, WerFault.exe, 0000001E.00000003.609217077.0000000004C61000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000F6CC push esi; mov dword ptr [esp], 00000000h

3_2_1000F6CD

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.5511794748

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\System32\loaddll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\Testapp.EXE			Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: WerFault.exe, 00000009.00000002.590600572.0000000004D60000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.576175012.0000000004AA0000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.652189195.0000000004C80000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.655711395.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001E.00000002.653365977.00000000049D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000001B.00000003.640882384.0000000004C76000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: WerFault.exe, 00000009.00000002.590399877.0000000004B42000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000002.649430287.0000000002E5D000.00000004.00000020.sdmp, WerFault.exe, 0000001C.00000002.652211709.0000000003350000.00000004.00000020.sdmp, WerFault.exe, 0000001E.00000002.653157247.00000000047BF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000009.00000002.590600572.0000000004D60000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.576175012.0000000004AA0000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.652189195.0000000004C80000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.655711395.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001E.00000002.653365977.00000000049D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000009.00000002.590600572.0000000004D60000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.576175012.0000000004AA0000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.652189195.0000000004C80000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.655711395.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001E.00000002.653365977.00000000049D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000001B.00000003.645667418.0000000004C76000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW0w
Source: WerFault.exe, 00000009.00000002.590600572.0000000004D60000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.576175012.0000000004AA0000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.652189195.0000000004C80000.00000002.00000001.sdmp, WerFault.exe, 0000001C.00000002.655711395.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001E.00000002.653365977.00000000049D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_10006D50

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3c271eae_by_Libranalysis.dll',#1

Jump to behavior

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_10006D50

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_10006D50