Loading ...

Play interactive tourEdit tour

Analysis Report 0ee1d71e_by_Libranalysis

Overview

General Information

Sample Name:0ee1d71e_by_Libranalysis (renamed file extension from none to dll)
Analysis ID:413033
MD5:0ee1d71e84e2bb2c1954045071e5b16d
SHA1:c610338f31bf46502f8f9aefa4d1af2a48006378
SHA256:cd08caa975e730882dc0838646984fae4f369563df84320a04cd1ed86d787f4d
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • loaddll32.exe (PID: 6400 cmdline: loaddll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 6428 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 6440 cmdline: rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 6952 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 764 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.412899748.0000000010001000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    4.2.rundll32.exe.10000000.3.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Found malware configurationShow sources
      Source: 4.2.rundll32.exe.10000000.3.unpackMalware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}
      Multi AV Scanner detection for submitted fileShow sources
      Source: 0ee1d71e_by_Libranalysis.dllReversingLabs: Detection: 29%
      Machine Learning detection for sampleShow sources
      Source: 0ee1d71e_by_Libranalysis.dllJoe Sandbox ML: detected
      Source: 0ee1d71e_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 0ee1d71e_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdbs source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: dwmapi.pdb# source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb] source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000A.00000003.383774545.0000000000F22000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdbG source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.387065149.00000000054E1000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000002.00000002.321705153.0000000010025000.00000002.00020000.sdmp, 0ee1d71e_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000A.00000003.383678349.0000000000F2D000.00000004.00000001.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000A.00000003.383542894.0000000000F27000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp

      Networking:

      barindex
      C2 URLs / IPs found in malware configurationShow sources
      Source: Malware configuration extractorIPs: 43.229.206.212:443
      Source: Malware configuration extractorIPs: 82.209.17.209:8172
      Source: Malware configuration extractorIPs: 162.241.209.225:4125
      Source: Joe Sandbox ViewIP Address: 82.209.17.209 82.209.17.209
      Source: Joe Sandbox ViewIP Address: 162.241.209.225 162.241.209.225
      Source: Joe Sandbox ViewIP Address: 43.229.206.212 43.229.206.212
      Source: Joe Sandbox ViewASN Name: PODA-ASCZ PODA-ASCZ
      Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
      Source: Joe Sandbox ViewASN Name: INET-AS-IDPTInetGlobalIndoID INET-AS-IDPTInetGlobalIndoID

      E-Banking Fraud:

      barindex
      Yara detected Dridex unpacked fileShow sources
      Source: Yara matchFile source: 00000004.00000002.412899748.0000000010001000.00000020.00020000.sdmp, type: MEMORY
      Source: Yara matchFile source: 4.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_100220F02_2_100220F0
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_100114604_2_10011460
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_1000846C4_2_1000846C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_100014944_2_10001494
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_1000A52C4_2_1000A52C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_10011D584_2_10011D58
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_100193484_2_10019348
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_100107544_2_10010754
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_100090CC4_2_100090CC
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 764
      Source: 0ee1d71e_by_Libranalysis.dllBinary or memory string: OriginalFilenamex2otfb.dllN vs 0ee1d71e_by_Libranalysis.dll
      Source: 0ee1d71e_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 0ee1d71e_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: classification engineClassification label: mal72.troj.winDLL@6/4@0/3
      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6440
      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0F0.tmpJump to behavior
      Source: 0ee1d71e_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1
      Source: 0ee1d71e_by_Libranalysis.dllReversingLabs: Detection: 29%
      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll'
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 764
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1Jump to behavior
      Source: 0ee1d71e_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: 0ee1d71e_by_Libranalysis.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdbs source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: dwmapi.pdb# source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb] source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000A.00000003.383774545.0000000000F22000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdbG source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.387065149.00000000054E1000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000002.00000002.321705153.0000000010025000.00000002.00020000.sdmp, 0ee1d71e_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000A.00000003.383678349.0000000000F2D000.00000004.00000001.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.387039509.00000000054D0000.00000004.00000040.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000A.00000003.383542894.0000000000F27000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000A.00000003.387050422.00000000054D7000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000A.00000003.387021682.0000000005341000.00000004.00000001.sdmp
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10006207 push ebx; ret 2_2_10006208
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10004E0F push 822377FAh; iretd 2_2_10004E14
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10005813 push eax; ret 2_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10006830 push 82235DBAh; iretd 2_2_10006855
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10002C33 push 0E950FD0h; iretd 2_2_10002D7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_1000585A push eax; ret 2_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10005A7B push cs; iretd 2_2_10005B7E
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10006A80 push ebx; iretd 2_2_10006A85
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10002C8E push 0E950FD0h; iretd 2_2_10002D7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_1000388E push 8223930Ah; iretd 2_2_10003893
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_100048AF push 8223A1AEh; iretd 2_2_100048B4
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_100066D0 push 8223737Ah; iretd 2_2_100066D5
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_100054EF push 822385B2h; iretd 2_2_100054F4
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_1000530F push 82230D7Eh; iretd 2_2_10005314
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_1000574F push 82238352h; iretd 2_2_10005754
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_100037A2 push cs; retf 2_2_100037DC
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_100039C3 push edi; retf 2_2_100039C4
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10005FD6 push 0E950020h; retf 2_2_10005FDE
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_10002DF3 push cs; iretd 2_2_10002E7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_100037F5 push cs; retf 2_2_100037DC
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_1000F6CC push esi; mov dword ptr [esp], 00000000h4_2_1000F6CD
      Source: initial sampleStatic PE information: section name: .text entropy: 7.53078515147
      Source: C:\Windows\SysWOW64\WerFault.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: WerFault.exe, 0000000A.00000002.409019164.0000000004EB0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
      Source: WerFault.exe, 0000000A.00000002.408515760.0000000003263000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAWP
      Source: WerFault.exe, 0000000A.00000002.409470472.00000000050B0000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
      Source: WerFault.exe, 0000000A.00000002.409019164.0000000004EB0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
      Source: WerFault.exe, 0000000A.00000002.409019164.0000000004EB0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
      Source: WerFault.exe, 0000000A.00000002.409019164.0000000004EB0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,4_2_10006D50
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,4_2_10006D50
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,4_2_10006D50

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection11Virtualization/Sandbox Evasion1OS Credential DumpingQuery Registry1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection11LSASS MemorySecurity Software Discovery21Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerVirtualization/Sandbox Evasion1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Rundll321NTDSAccount Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware Packing2LSA SecretsSystem Owner/User Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Information Discovery11Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 413033 Sample: 0ee1d71e_by_Libranalysis Startdate: 13/05/2021 Architecture: WINDOWS Score: 72 17 162.241.209.225 UNIFIEDLAYER-AS-1US United States 2->17 19 82.209.17.209 PODA-ASCZ Czech Republic 2->19 21 43.229.206.212 INET-AS-IDPTInetGlobalIndoID Indonesia 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      0ee1d71e_by_Libranalysis.dll30%ReversingLabsWin32.Trojan.Convagent
      0ee1d71e_by_Libranalysis.dll100%Joe Sandbox ML

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      4.2.rundll32.exe.2890000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      82.209.17.209
      unknownCzech Republic
      30764PODA-ASCZtrue
      162.241.209.225
      unknownUnited States
      46606UNIFIEDLAYER-AS-1UStrue
      43.229.206.212
      unknownIndonesia
      24532INET-AS-IDPTInetGlobalIndoIDtrue

      General Information

      Joe Sandbox Version:32.0.0 Black Diamond
      Analysis ID:413033
      Start date:13.05.2021
      Start time:06:38:40
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 6m 11s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:0ee1d71e_by_Libranalysis (renamed file extension from none to dll)
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:29
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal72.troj.winDLL@6/4@0/3
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 97.7% (good quality ratio 85.3%)
      • Quality average: 67.1%
      • Quality standard deviation: 35%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 3
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI

      Simulations

      Behavior and APIs

      TimeTypeDescription
      06:40:07API Interceptor1x Sleep call for process: WerFault.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      82.209.17.209ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
        1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
          514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
            a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                  7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                    1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                      ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                        514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                          512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                            7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                  512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                    7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                      SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                        94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                          e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                            061020c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                              162.241.209.225ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                  514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                    a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                      d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                        634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                          7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                            1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                  512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                      7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                        d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                          512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                            7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                  e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                    061020c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                      43.229.206.212ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                        1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                          514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                            a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                  7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                    1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                      ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                        514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                          512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                            7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                  512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                    7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                      SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                        94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                          e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                            061020c5_by_Libranalysis.dllGet hashmaliciousBrowse

                                                                                                                              Domains

                                                                                                                              No context

                                                                                                                              ASN

                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                              PODA-ASCZce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              061020c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              INET-AS-IDPTInetGlobalIndoIDce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              061020c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              UNIFIEDLAYER-AS-1USce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              061020c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225

                                                                                                                              JA3 Fingerprints

                                                                                                                              No context

                                                                                                                              Dropped Files

                                                                                                                              No context

                                                                                                                              Created / dropped Files

                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_48ff3f2beb4969be4281edaafa846a3dc4dbe0_82810a17_1b471aee\Report.wer
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):12490
                                                                                                                              Entropy (8bit):3.7664237335959467
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:a1OQiC0oXMcHBUZMX4jed+9G/u7svS274ItWcw:RQiEXnBUZMX4jeJ/u7svX4ItWcw
                                                                                                                              MD5:5B4DBF4DB44700CCF6A5EA8C11A8567F
                                                                                                                              SHA1:6439D08408D2C16C5A253A5301EEA7E33D7F5F65
                                                                                                                              SHA-256:500671F5D4498374C03FA669458A2C6B4B9F477EDBE77563762676CD66758423
                                                                                                                              SHA-512:B5484B18F713184A56F35116B18C49C50AC9C6527CC24714898C204C988C998F0B01C7BC9D21F9D3391CC53109C593A50F271558EBDF9D01AE6C10D3003BEC75
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.5.3.8.6.7.9.7.2.4.3.1.6.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.5.3.8.6.8.0.3.3.8.3.7.6.4.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.8.6.0.a.2.6.1.-.3.f.9.c.-.4.1.e.1.-.a.4.5.3.-.7.f.2.9.7.c.4.1.6.8.d.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.d.0.3.7.6.6.-.8.f.8.6.-.4.7.9.f.-.9.d.3.7.-.b.5.7.c.f.0.1.c.a.d.9.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.2.8.-.0.0.0.1.-.0.0.1.7.-.5.5.6.d.-.3.1.6.5.f.d.4.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0F0.tmp.dmp
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Mini DuMP crash report, 14 streams, Thu May 13 13:39:58 2021, 0x1205a4 type
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):52422
                                                                                                                              Entropy (8bit):2.0106115839570013
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:XysiCOCyZfY/3EuLrilR2vGj3Ziprpw3MzEsQh5C6YLE1sSEn+a/:1LyZfY/0u/ilR2vGj3gpdweQhs/LE1Qh
                                                                                                                              MD5:1055792DE1BD210212BAB17F3FCC534A
                                                                                                                              SHA1:6113F12BEACBDEFA0E07FD88B0CDBC779AA19242
                                                                                                                              SHA-256:3DF50C2934442F704300E0F0D5A187FD05B170965DBFE351A34C560C339C93AE
                                                                                                                              SHA-512:E5763B9BA4A8EFA5CDBEC3CAAEBED94A108BBA99552807803537D4B8AFC3B017A481E23B09710349E09FE2C7C0CBA44DC2803CE49DADF8C160BC503743B26F54
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: MDMP....... ........,.`...................U...........B..............GenuineIntelW...........T.......(....,.`.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERF660.tmp.WERInternalMetadata.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):8292
                                                                                                                              Entropy (8bit):3.694325658387793
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:Rrl7r3GLNibD6f6YTp65BtgmfT0VSgCprC89bhssfaWrm:RrlsNi/6f6Yd6/tgmfT8Szh/fa7
                                                                                                                              MD5:5811D9CFB20BE88174D298C663EA12B8
                                                                                                                              SHA1:0E166116173A93C88349C0B04DC952C49F70BB67
                                                                                                                              SHA-256:AA8798B80EBAC373A774AAB9DC40858E6A25F6C995082A2CD687A91B50C01985
                                                                                                                              SHA-512:6A8B3F32221DE9027323F9F06B75CBBB3BA508369006DA7F0FC387AD08ECD5EC38D48C7B8D0FB7E3C48434786F4FAB72CDE40B56B5347F64F142ECC1AB2FCD30
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.4.0.<./.P.i.d.>.......
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERFAE5.tmp.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):4663
                                                                                                                              Entropy (8bit):4.474177382475757
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:48:cvIwSD8zsmJgtWI9G4WSC8BN8fm8M4JCdsTuNrFVgA+q8/0uNFo4SrSFd:uITf89xSN0J5uNZJuNiDWFd
                                                                                                                              MD5:FE059999AD378CA497874A7138E8D84A
                                                                                                                              SHA1:959DC73E26B1D3E37F96BD76EE487AC4690EA5B4
                                                                                                                              SHA-256:CDB0E66EA08AC81CA31EF8D2951F6FDCDE6FC16294695065BFCAF33DDF954BE1
                                                                                                                              SHA-512:B80F90AD14273C370A122F3E0F67171E867A7227356935B054B23B8F5D294647980FC671B32D2E954CB1BEDEF9120D26CA292E3F355188EDB1958B0BE28C2484
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="987770" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                                                                              Static File Info

                                                                                                                              General

                                                                                                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                              Entropy (8bit):7.5138956792185425
                                                                                                                              TrID:
                                                                                                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                              • DOS Executable Generic (2002/1) 0.20%
                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                              File name:0ee1d71e_by_Libranalysis.dll
                                                                                                                              File size:167424
                                                                                                                              MD5:0ee1d71e84e2bb2c1954045071e5b16d
                                                                                                                              SHA1:c610338f31bf46502f8f9aefa4d1af2a48006378
                                                                                                                              SHA256:cd08caa975e730882dc0838646984fae4f369563df84320a04cd1ed86d787f4d
                                                                                                                              SHA512:3888dcb56edfb1b166b9f41fb3d2d1c7278cc7abb8fd291a305ff1693eda03a11855d18f67a00748cb9bbd0a718909cc8840de1ceb8b277304509cfa5ae4c0cd
                                                                                                                              SSDEEP:3072:99F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:99F6rQXvFczvYpQP
                                                                                                                              File Content Preview:MZ......................@...................................\...........!..L.!This program cannot be run in DOS mode....$.......Xm.o...<...<...<.U!<...<..B<r..<...<...<rQ!<...<;..<...<;..<3..<au.<...<szt<"..<Rich...<.......................................

                                                                                                                              File Icon

                                                                                                                              Icon Hash:74f0e4ecccdce0e4

                                                                                                                              Static PE Info

                                                                                                                              General

                                                                                                                              Entrypoint:0x10024cc0
                                                                                                                              Entrypoint Section:.text
                                                                                                                              Digitally signed:false
                                                                                                                              Imagebase:0x10000000
                                                                                                                              Subsystem:windows gui
                                                                                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                              Time Stamp:0x609C7F8A [Thu May 13 01:23:22 2021 UTC]
                                                                                                                              TLS Callbacks:
                                                                                                                              CLR (.Net) Version:
                                                                                                                              OS Version Major:5
                                                                                                                              OS Version Minor:0
                                                                                                                              File Version Major:5
                                                                                                                              File Version Minor:0
                                                                                                                              Subsystem Version Major:5
                                                                                                                              Subsystem Version Minor:0
                                                                                                                              Import Hash:88962f6760ea005847fb88b87e8ce1fd

                                                                                                                              Entrypoint Preview

                                                                                                                              Instruction
                                                                                                                              mov eax, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              cmp eax, 02h
                                                                                                                              mov eax, ebp
                                                                                                                              mov dword ptr [10029734h], eax
                                                                                                                              mov eax, ebx
                                                                                                                              mov dword ptr [10029730h], eax
                                                                                                                              mov eax, esi
                                                                                                                              mov dword ptr [10029728h], eax
                                                                                                                              jne 00007FEE9898C0B6h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h

                                                                                                                              Rich Headers

                                                                                                                              Programming Language:
                                                                                                                              • [RES] VS2015 build 23026
                                                                                                                              • [IMP] VS2013 UPD4 build 31101
                                                                                                                              • [ C ] VS2010 build 30319
                                                                                                                              • [RES] VS2015 UPD2 build 23918
                                                                                                                              • [C++] VS2005 build 50727
                                                                                                                              • [IMP] VS2010 SP1 build 40219
                                                                                                                              • [RES] VS2012 build 50727

                                                                                                                              Data Directories

                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x2770a0x5b.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x277d80x59.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x2c0000x3a0.rsrc
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x2d0000x1220
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x100180x38.text
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x250000x4c.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                              Sections

                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                              .text0x10000x23dfe0x23e00False0.756362968206data7.53078515147IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                              .rdata0x250000x2a040x2c00False0.753728693182data7.42331753213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .crt0x280000x331c0x1800False0.79052734375MMDF mailbox7.46423038313IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                              .rsrc0x2c0000x3a00x400False0.4248046875data3.06187161643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .reloc0x2d0000xf6a0x400False0.548828125data4.2946697642IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                              Resources

                                                                                                                              NameRVASizeTypeLanguageCountry
                                                                                                                              RT_VERSION0x2c0600x33cdata

                                                                                                                              Imports

                                                                                                                              DLLImport
                                                                                                                              KERNEL32.dllGetProfileSectionW, CloseHandle, OpenSemaphoreW, LoadLibraryW, OutputDebugStringA, CreateFileW, GetProfileSectionA
                                                                                                                              USER32.dllTranslateMessage
                                                                                                                              CLUSAPI.dllClusterEnum
                                                                                                                              ADVAPI32.dllRegOverridePredefKey
                                                                                                                              RASAPI32.dllRasGetConnectionStatistics
                                                                                                                              ole32.dllCreatePointerMoniker, CreateStreamOnHGlobal

                                                                                                                              Version Infos

                                                                                                                              DescriptionData
                                                                                                                              LegalCopyrightCopyright 2018
                                                                                                                              InternalNamex2otfb
                                                                                                                              FileVersion7.2.5422.00
                                                                                                                              Full Version7.2.5_000-b00
                                                                                                                              CompanyNameOracle Corporation
                                                                                                                              ProductNameXhot(BM) Ltloehey YO 8
                                                                                                                              ProductVersion7.2.5422.00
                                                                                                                              FileDescriptionJava(TM) Platform SE binary
                                                                                                                              OriginalFilenamex2otfb.dll
                                                                                                                              Translation0x0000 0x04b0

                                                                                                                              Network Behavior

                                                                                                                              Network Port Distribution

                                                                                                                              UDP Packets

                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                              May 13, 2021 06:39:20.271405935 CEST6204453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:20.328273058 CEST53620448.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:20.790699005 CEST6379153192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:20.852313042 CEST53637918.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:21.130935907 CEST6426753192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:21.179560900 CEST53642678.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:21.900918961 CEST4944853192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:21.949510098 CEST53494488.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:23.280827999 CEST6034253192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:23.329642057 CEST53603428.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:24.157174110 CEST6134653192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:24.206362009 CEST53613468.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:25.157320023 CEST5177453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:25.206027031 CEST53517748.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:26.088406086 CEST5602353192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:26.139992952 CEST53560238.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:26.940566063 CEST5838453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:26.989379883 CEST53583848.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:27.735356092 CEST6026153192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:27.792566061 CEST53602618.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:28.867238998 CEST5606153192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:28.918163061 CEST53560618.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:33.589374065 CEST5833653192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:33.638278008 CEST53583368.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:34.571788073 CEST5378153192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:34.631139040 CEST53537818.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:35.357460022 CEST5406453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:35.408992052 CEST53540648.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:36.119070053 CEST5281153192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:36.178240061 CEST53528118.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:37.196405888 CEST5529953192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:37.247952938 CEST53552998.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:37.990920067 CEST6374553192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:38.039592028 CEST53637458.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:38.783324003 CEST5005553192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:38.837476969 CEST53500558.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:39:55.335650921 CEST6137453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:39:55.392877102 CEST53613748.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:00.759124041 CEST5033953192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:00.819319010 CEST53503398.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:04.459513903 CEST6330753192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:04.508426905 CEST53633078.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:14.772559881 CEST4969453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:14.833853960 CEST53496948.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:15.035531998 CEST5498253192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:15.084440947 CEST53549828.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:15.377388954 CEST5001053192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:15.436774969 CEST53500108.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:16.080771923 CEST6371853192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:16.141941071 CEST53637188.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:16.465605974 CEST6211653192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:16.525823116 CEST53621168.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:16.972150087 CEST6381653192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:17.029436111 CEST53638168.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:18.641944885 CEST5501453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:18.701982021 CEST53550148.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:19.263159037 CEST6220853192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:19.320216894 CEST53622088.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:19.913536072 CEST5757453192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:19.964834929 CEST53575748.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:20.791613102 CEST5181853192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:20.840454102 CEST53518188.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:21.802761078 CEST5662853192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:21.859930992 CEST53566288.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:22.517947912 CEST6077853192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:22.574938059 CEST53607788.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:29.869573116 CEST5379953192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:29.937352896 CEST53537998.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:31.670311928 CEST5468353192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:31.739255905 CEST53546838.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:40:33.889020920 CEST5932953192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:40:33.959355116 CEST53593298.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:41:01.683732986 CEST6402153192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:41:01.763792992 CEST53640218.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:41:07.792916059 CEST5612953192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:41:07.869481087 CEST53561298.8.8.8192.168.2.6
                                                                                                                              May 13, 2021 06:41:08.994071007 CEST5817753192.168.2.68.8.8.8
                                                                                                                              May 13, 2021 06:41:09.051325083 CEST53581778.8.8.8192.168.2.6

                                                                                                                              Code Manipulations

                                                                                                                              Statistics

                                                                                                                              CPU Usage

                                                                                                                              Click to jump to process

                                                                                                                              Memory Usage

                                                                                                                              Click to jump to process

                                                                                                                              High Level Behavior Distribution

                                                                                                                              Click to dive into process behavior distribution

                                                                                                                              Behavior

                                                                                                                              Click to jump to process

                                                                                                                              System Behavior

                                                                                                                              General

                                                                                                                              Start time:06:39:27
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\System32\loaddll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:loaddll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll'
                                                                                                                              Imagebase:0x12e0000
                                                                                                                              File size:116736 bytes
                                                                                                                              MD5 hash:542795ADF7CC08EFCF675D65310596E8
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:39:27
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x2a0000
                                                                                                                              File size:232960 bytes
                                                                                                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:39:28
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:rundll32.exe 'C:\Users\user\Desktop\0ee1d71e_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x870000
                                                                                                                              File size:61952 bytes
                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Yara matches:
                                                                                                                              • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.412899748.0000000010001000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:39:55
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 764
                                                                                                                              Imagebase:0x11d0000
                                                                                                                              File size:434592 bytes
                                                                                                                              MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              Disassembly

                                                                                                                              Code Analysis

                                                                                                                              Reset < >

                                                                                                                                Executed Functions

                                                                                                                                Non-executed Functions

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.321700020.0000000010021000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.321678335.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.321684545.0000000010001000.00000020.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.321705153.0000000010025000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.321709331.0000000010028000.00000008.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.321714014.000000001002C000.00000002.00020000.sdmp Download File
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: D$a$c$i$l$l$o$t$u
                                                                                                                                • API String ID: 0-1871623029
                                                                                                                                • Opcode ID: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction ID: 0084815472b1379f451f328db7bdd48fedf0434f01950e1a6ab525a79fee850b
                                                                                                                                • Opcode Fuzzy Hash: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction Fuzzy Hash: 6142A774608780CFD374CF28C894BDABBE1ABD9354F54892EE48D8B391E731A845CB56
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Executed Functions

                                                                                                                                Non-executed Functions

                                                                                                                                C-Code - Quality: 100%
                                                                                                                                			E10006D50() {
                                                                                                                                
                                                                                                                                				 *0x1001d280 = GetUserNameW;
                                                                                                                                				 *0x1001D284 = MessageBoxW;
                                                                                                                                				 *0x1001D288 = GetLastError;
                                                                                                                                				 *0x1001D28C = CreateFileA;
                                                                                                                                				 *0x1001D290 = DebugBreak;
                                                                                                                                				 *0x1001D294 = FlushFileBuffers;
                                                                                                                                				 *0x1001D298 = FreeEnvironmentStringsA;
                                                                                                                                				 *0x1001D29C = GetConsoleOutputCP;
                                                                                                                                				 *0x1001D2A0 = GetEnvironmentStrings;
                                                                                                                                				 *0x1001D2A4 = GetLocaleInfoA;
                                                                                                                                				 *0x1001D2A8 = GetStartupInfoA;
                                                                                                                                				 *0x1001D2AC = GetStringTypeA;
                                                                                                                                				 *0x1001D2B0 = HeapValidate;
                                                                                                                                				 *0x1001D2B4 = IsBadReadPtr;
                                                                                                                                				 *0x1001D2B8 = LCMapStringA;
                                                                                                                                				 *0x1001D2BC = LoadLibraryA;
                                                                                                                                				 *0x1001D2C0 = OutputDebugStringA;
                                                                                                                                				return 0x1001d280;
                                                                                                                                			}



                                                                                                                                0x10006d61
                                                                                                                                0x10006d69
                                                                                                                                0x10006d6c
                                                                                                                                0x10006d7b
                                                                                                                                0x10006d7e
                                                                                                                                0x10006d8d
                                                                                                                                0x10006d90
                                                                                                                                0x10006d9f
                                                                                                                                0x10006da2
                                                                                                                                0x10006db1
                                                                                                                                0x10006db4
                                                                                                                                0x10006dc3
                                                                                                                                0x10006dc6
                                                                                                                                0x10006dd5
                                                                                                                                0x10006dd8
                                                                                                                                0x10006de7
                                                                                                                                0x10006dea
                                                                                                                                0x10006ded

                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000004.00000002.412899748.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000004.00000002.412880300.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000004.00000002.412935999.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000004.00000002.412950425.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000004.00000002.412967750.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID:
                                                                                                                                • API String ID:
                                                                                                                                • Opcode ID: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction ID: 9a9f90be372116ce35b3bf57ca6adafecb814b37ff7dc50591bd4b03753dcc6b
                                                                                                                                • Opcode Fuzzy Hash: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction Fuzzy Hash: 99110FB8A05620CFD34ACF09D5D49117BF2BB8E360312C19AD8098B376D734D985CF54
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                C-Code - Quality: 83%
                                                                                                                                			E1000C218(void* __ecx, void* __edx) {
                                                                                                                                				char _v28;
                                                                                                                                				char _v33;
                                                                                                                                				char _v38;
                                                                                                                                				char _v43;
                                                                                                                                				void* _t24;
                                                                                                                                				char* _t25;
                                                                                                                                				char _t32;
                                                                                                                                				void* _t33;
                                                                                                                                				void* _t34;
                                                                                                                                				signed int _t38;
                                                                                                                                				char* _t40;
                                                                                                                                
                                                                                                                                				_t40 = (_t38 & 0xfffffff0) - 0x2c;
                                                                                                                                				asm("movq xmm0, [edx]");
                                                                                                                                				_t32 = 0;
                                                                                                                                				 *_t40 = 0x7b;
                                                                                                                                				asm("movq [esp+0x1], xmm0");
                                                                                                                                				_v43 = 0x2d;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t32 + 0xa)) =  *((intOrPtr*)(_t32 + __edx + 8));
                                                                                                                                					_t32 = _t32 + 1;
                                                                                                                                				} while (_t32 < 4);
                                                                                                                                				_v38 = 0x2d;
                                                                                                                                				_t33 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t33 + 0xf)) =  *((intOrPtr*)(_t33 + __edx + 0xc));
                                                                                                                                					_t33 = _t33 + 1;
                                                                                                                                				} while (_t33 < 4);
                                                                                                                                				_v33 = 0x2d;
                                                                                                                                				_t34 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t34 + 0x14)) =  *((intOrPtr*)(_t34 + __edx + 0x10));
                                                                                                                                					_t34 = _t34 + 1;
                                                                                                                                				} while (_t34 < 4);
                                                                                                                                				_v28 = 0x2d;
                                                                                                                                				_t24 = 0;
                                                                                                                                				do {
                                                                                                                                					asm("movd xmm0, dword [eax+edx+0x14]");
                                                                                                                                					asm("movd [esp+eax+0x19], xmm0");
                                                                                                                                					_t24 = _t24 + 4;
                                                                                                                                				} while (_t24 < 0xc);
                                                                                                                                				_t25 = _t40;
                                                                                                                                				 *((char*)(_t25 + 0x25)) = 0x7d;
                                                                                                                                				 *((char*)(_t25 + 0x26)) = 0;
                                                                                                                                				E1000DFBC(__ecx, _t25, 0);
                                                                                                                                				return __ecx;
                                                                                                                                			}














                                                                                                                                0x1000c21f
                                                                                                                                0x1000c224
                                                                                                                                0x1000c228
                                                                                                                                0x1000c22a
                                                                                                                                0x1000c22e
                                                                                                                                0x1000c234
                                                                                                                                0x1000c239
                                                                                                                                0x1000c23d
                                                                                                                                0x1000c241
                                                                                                                                0x1000c242
                                                                                                                                0x1000c249
                                                                                                                                0x1000c24e
                                                                                                                                0x1000c250
                                                                                                                                0x1000c254
                                                                                                                                0x1000c258
                                                                                                                                0x1000c259
                                                                                                                                0x1000c260
                                                                                                                                0x1000c265
                                                                                                                                0x1000c267
                                                                                                                                0x1000c26b
                                                                                                                                0x1000c26f
                                                                                                                                0x1000c270
                                                                                                                                0x1000c275
                                                                                                                                0x1000c27a
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c282
                                                                                                                                0x1000c288
                                                                                                                                0x1000c28b
                                                                                                                                0x1000c292
                                                                                                                                0x1000c295
                                                                                                                                0x1000c29b
                                                                                                                                0x1000c2a0
                                                                                                                                0x1000c2ae

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000004.00000002.412899748.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000004.00000002.412880300.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000004.00000002.412935999.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000004.00000002.412950425.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000004.00000002.412967750.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: -$-$-$-
                                                                                                                                • API String ID: 0-1033403326
                                                                                                                                • Opcode ID: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction ID: 6420cdf91b2b9fc5655fa5f82b4c53aa5eb92ddd4154ae73ebf41adf494228f8
                                                                                                                                • Opcode Fuzzy Hash: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction Fuzzy Hash: C811252091C3C04CE749DB7C548462BFFD08F9A208F1886BEE4DA86B53E525D49683B7
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%