Loading ...

Play interactive tourEdit tour

Analysis Report c2b6efb1_by_Libranalysis

Overview

General Information

Sample Name:c2b6efb1_by_Libranalysis (renamed file extension from none to dll)
Analysis ID:413035
MD5:c2b6efb1b15eab83bcec9afd875fbb34
SHA1:fab251bf2316a77c53f3b92ad016ed9697f4f14a
SHA256:2626744dae64045e445cbab9a2a225827d362ef6a0c20efa56b67dcec779857e
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • loaddll32.exe (PID: 6352 cmdline: loaddll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 6360 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 6372 cmdline: rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 5472 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 764 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.328088849.0000000010001000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    2.2.rundll32.exe.10000000.3.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Found malware configurationShow sources
      Source: 2.2.rundll32.exe.10000000.3.unpackMalware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}
      Multi AV Scanner detection for submitted fileShow sources
      Source: c2b6efb1_by_Libranalysis.dllReversingLabs: Detection: 30%
      Machine Learning detection for sampleShow sources
      Source: c2b6efb1_by_Libranalysis.dllJoe Sandbox ML: detected
      Source: c2b6efb1_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: c2b6efb1_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: ole32.pdb$. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb2. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb) source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.300083889.0000000004C39000.00000004.00000001.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.299305257.0000000002DE3000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb* source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb(. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.299742055.0000000002DEF000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb* source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000E.00000003.299305257.0000000002DE3000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.308241383.0000000005271000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb.. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.229634203.0000000010025000.00000002.00020000.sdmp, c2b6efb1_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdb. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdb<. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000E.00000003.299742055.0000000002DEF000.00000004.00000001.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000E.00000003.299310661.0000000002DE9000.00000004.00000001.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp

      Networking:

      barindex
      C2 URLs / IPs found in malware configurationShow sources
      Source: Malware configuration extractorIPs: 43.229.206.212:443
      Source: Malware configuration extractorIPs: 82.209.17.209:8172
      Source: Malware configuration extractorIPs: 162.241.209.225:4125
      Source: Joe Sandbox ViewIP Address: 82.209.17.209 82.209.17.209
      Source: Joe Sandbox ViewIP Address: 162.241.209.225 162.241.209.225
      Source: Joe Sandbox ViewIP Address: 43.229.206.212 43.229.206.212
      Source: Joe Sandbox ViewASN Name: PODA-ASCZ PODA-ASCZ
      Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
      Source: Joe Sandbox ViewASN Name: INET-AS-IDPTInetGlobalIndoID INET-AS-IDPTInetGlobalIndoID
      Source: WerFault.exe, 0000000E.00000003.321854224.0000000004B7C000.00000004.00000001.sdmpString found in binary or memory: http://crl.microsoft

      E-Banking Fraud:

      barindex
      Yara detected Dridex unpacked fileShow sources
      Source: Yara matchFile source: 00000002.00000002.328088849.0000000010001000.00000020.00020000.sdmp, type: MEMORY
      Source: Yara matchFile source: 2.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100220F00_2_100220F0
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100114602_2_10011460
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000846C2_2_1000846C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100014942_2_10001494
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000A52C2_2_1000A52C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10011D582_2_10011D58
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100193482_2_10019348
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100107542_2_10010754
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100090CC2_2_100090CC
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 764
      Source: c2b6efb1_by_Libranalysis.dllBinary or memory string: OriginalFilenamex2otfb.dllN vs c2b6efb1_by_Libranalysis.dll
      Source: c2b6efb1_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: c2b6efb1_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: classification engineClassification label: mal72.troj.winDLL@6/4@0/3
      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6372
      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B85.tmpJump to behavior
      Source: c2b6efb1_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1
      Source: c2b6efb1_by_Libranalysis.dllReversingLabs: Detection: 30%
      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll'
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 764
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1Jump to behavior
      Source: c2b6efb1_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: c2b6efb1_by_Libranalysis.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: ole32.pdb$. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb2. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb) source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.300083889.0000000004C39000.00000004.00000001.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.299305257.0000000002DE3000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb* source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb(. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.299742055.0000000002DEF000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb* source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000E.00000003.299305257.0000000002DE3000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.308241383.0000000005271000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb.. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.229634203.0000000010025000.00000002.00020000.sdmp, c2b6efb1_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdb. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdb<. source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000E.00000003.299742055.0000000002DEF000.00000004.00000001.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.308228455.0000000005260000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000E.00000003.299310661.0000000002DE9000.00000004.00000001.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.308233987.0000000005266000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.308212119.00000000050D1000.00000004.00000001.sdmp
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006207 push ebx; ret 0_2_10006208
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10004E0F push 822377FAh; iretd 0_2_10004E14
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005813 push eax; ret 0_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006830 push 82235DBAh; iretd 0_2_10006855
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002C33 push 0E950FD0h; iretd 0_2_10002D7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000585A push eax; ret 0_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005A7B push cs; iretd 0_2_10005B7E
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006A80 push ebx; iretd 0_2_10006A85
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002C8E push 0E950FD0h; iretd 0_2_10002D7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000388E push 8223930Ah; iretd 0_2_10003893
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100048AF push 8223A1AEh; iretd 0_2_100048B4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100066D0 push 8223737Ah; iretd 0_2_100066D5
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100054EF push 822385B2h; iretd 0_2_100054F4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000530F push 82230D7Eh; iretd 0_2_10005314
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000574F push 82238352h; iretd 0_2_10005754
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100037A2 push cs; retf 0_2_100037DC
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100039C3 push edi; retf 0_2_100039C4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005FD6 push 0E950020h; retf 0_2_10005FDE
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002DF3 push cs; iretd 0_2_10002E7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100037F5 push cs; retf 0_2_100037DC
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000F6CC push esi; mov dword ptr [esp], 00000000h2_2_1000F6CD
      Source: initial sampleStatic PE information: section name: .text entropy: 7.53078515147
      Source: C:\Windows\SysWOW64\WerFault.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: WerFault.exe, 0000000E.00000002.324513624.0000000005280000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
      Source: WerFault.exe, 0000000E.00000002.323547539.0000000004B4E000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAWe
      Source: WerFault.exe, 0000000E.00000002.323547539.0000000004B4E000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
      Source: WerFault.exe, 0000000E.00000002.324513624.0000000005280000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
      Source: WerFault.exe, 0000000E.00000002.324513624.0000000005280000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
      Source: WerFault.exe, 0000000E.00000002.324513624.0000000005280000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection11Virtualization/Sandbox Evasion1OS Credential DumpingQuery Registry1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection11LSASS MemorySecurity Software Discovery21Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerVirtualization/Sandbox Evasion1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Rundll321NTDSAccount Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware Packing2LSA SecretsSystem Owner/User Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Information Discovery11Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 413035 Sample: c2b6efb1_by_Libranalysis Startdate: 13/05/2021 Architecture: WINDOWS Score: 72 17 162.241.209.225 UNIFIEDLAYER-AS-1US United States 2->17 19 82.209.17.209 PODA-ASCZ Czech Republic 2->19 21 43.229.206.212 INET-AS-IDPTInetGlobalIndoID Indonesia 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 8 13->15         started       

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      c2b6efb1_by_Libranalysis.dll30%ReversingLabsWin32.Trojan.Convagent
      c2b6efb1_by_Libranalysis.dll100%Joe Sandbox ML

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      2.2.rundll32.exe.3240000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File

      Domains

      No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://crl.microsoft0%URL Reputationsafe
      http://crl.microsoft0%URL Reputationsafe
      http://crl.microsoft0%URL Reputationsafe
      http://crl.microsoft0%URL Reputationsafe

      Domains and IPs

      Contacted Domains

      No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://crl.microsoftWerFault.exe, 0000000E.00000003.321854224.0000000004B7C000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      unknown

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      82.209.17.209
      unknownCzech Republic
      30764PODA-ASCZtrue
      162.241.209.225
      unknownUnited States
      46606UNIFIEDLAYER-AS-1UStrue
      43.229.206.212
      unknownIndonesia
      24532INET-AS-IDPTInetGlobalIndoIDtrue

      General Information

      Joe Sandbox Version:32.0.0 Black Diamond
      Analysis ID:413035
      Start date:13.05.2021
      Start time:06:40:30
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 6m 33s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:c2b6efb1_by_Libranalysis (renamed file extension from none to dll)
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:26
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal72.troj.winDLL@6/4@0/3
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 97.7% (good quality ratio 85.2%)
      • Quality average: 67.2%
      • Quality standard deviation: 35%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 3
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI

      Simulations

      Behavior and APIs

      TimeTypeDescription
      06:42:05API Interceptor1x Sleep call for process: WerFault.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      82.209.17.2090ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
          1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
            514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                  634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                    7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                      1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                          514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                            512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                  d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                    512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                      7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                        SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                          94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                            e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                              162.241.209.2250ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                  1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                    514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                      a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                        d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                          634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                            7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                  514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                      7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                        7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                          d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                            512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                  94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                    e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                      43.229.206.2120ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                          1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                            514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                  634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                    7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                      1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                          514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                            512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                  d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                    512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                      7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                        SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                          94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                            e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse

                                                                                                                              Domains

                                                                                                                              No context

                                                                                                                              ASN

                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                              PODA-ASCZ0ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              INET-AS-IDPTInetGlobalIndoID0ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              UNIFIEDLAYER-AS-1US0ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225

                                                                                                                              JA3 Fingerprints

                                                                                                                              No context

                                                                                                                              Dropped Files

                                                                                                                              No context

                                                                                                                              Created / dropped Files

                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_ceab9952f15a603fe8bb7fca6d086e06c93d7dd_82810a17_1509c19b\Report.wer
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:modified
                                                                                                                              Size (bytes):12486
                                                                                                                              Entropy (8bit):3.7668343270882034
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:pmi10oXLcHBUZMX4jed+Oe/u7sFS274ItWck:0ibXoBUZMX4jeC/u7sFX4ItWck
                                                                                                                              MD5:6DFFBF5C6C00C1F5231B95602FFFB08F
                                                                                                                              SHA1:8352661017ED09F6E0B75035563905C11E0B8BC4
                                                                                                                              SHA-256:E6E783C8275327F0708FCAFFE43A449098821A3869ACF60845A5FF0FEAE6AF99
                                                                                                                              SHA-512:DE09700139F04851C83958DE016D83537FBAB341ABABBEDA7C5A08A99164C35EA640FD1EE12DDED66A0E7B23A21BCB0ACA5D88B26529671D3C995987E83D7208
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.5.3.8.6.9.1.5.4.0.2.4.9.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.5.3.8.6.9.2.3.1.5.2.4.8.8.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.8.6.4.c.7.c.d.-.e.3.4.b.-.4.9.3.3.-.a.f.a.a.-.6.6.e.8.e.1.6.c.7.f.e.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.1.9.0.4.a.1.-.d.a.c.8.-.4.b.8.e.-.9.7.d.6.-.a.3.9.1.d.6.f.6.b.d.1.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.e.4.-.0.0.0.1.-.0.0.1.6.-.2.4.c.b.-.2.b.a.9.f.d.4.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B85.tmp.dmp
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Mini DuMP crash report, 14 streams, Thu May 13 13:41:58 2021, 0x1205a4 type
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):40226
                                                                                                                              Entropy (8bit):2.3001854423819768
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:PyAjYVeFBzx+jO1UCTsBQ3Qorx7JASZmSMUnaWP:2VeXzx+K2VBCQANASNX
                                                                                                                              MD5:9A5337C702117F71954CB8A514E1B797
                                                                                                                              SHA1:8F5A30385EF6E1E77EE649E0C1EC64E4B4169787
                                                                                                                              SHA-256:B1C93FE264AED4B7C4220357616E1CD6F3C1B173E34F3AB22CB5967FACDCAC57
                                                                                                                              SHA-512:2BEC9F9C7C11C44E44F2C83DE37126A29F78A681FA707D6C84503ECD71C756808B9C29E8FA4E7745CC03591E898007D4EEA3B8371BDD01516450618883D45BC6
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: MDMP....... ........,.`...................U...........B......x.......GenuineIntelW...........T............,.`.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERA903.tmp.WERInternalMetadata.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):8292
                                                                                                                              Entropy (8bit):3.6961104874289186
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:Rrl7r3GLNilh6Y16Y4r6ZfEgmfTnVS4CprI89bPnIsfdlm:RrlsNiz666Yc6ZsgmfTVS1Pn7fe
                                                                                                                              MD5:D43EB03CA72FCC164D25CEFAF3F922E9
                                                                                                                              SHA1:5355AB889FD72B8FB7BAE68A844C9B3AB9555A11
                                                                                                                              SHA-256:3E5F75CCB67ED05ACBF75DB5A4DC121B52991F37958F0193EEAB4DC4465EAC17
                                                                                                                              SHA-512:E80517A8FD403835B70D3E6299665FE0825E74ABD2C4FD7AF945D57085FD49A9F31E970FE3B3AB8A896C6FA866E21A45FB356BD646DD610E78DF400EEC94AEDD
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.7.2.<./.P.i.d.>.......
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB95.tmp.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):4663
                                                                                                                              Entropy (8bit):4.475667455882159
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:48:cvIwSD8zsUNJgtWI9bzWSC8BT8fm8M4JCdsLNrFPS+q8/uNFqMF4SrSjd:uITfSECSN+J9NENN0MFDWjd
                                                                                                                              MD5:824510D40FAC56FC1FA50C58D1BDA86D
                                                                                                                              SHA1:370A3E2ED67C97AC20F14AF08F2A8AC392292B53
                                                                                                                              SHA-256:36704DCDC342D43018950348A683F1097ED865B685535E98FDF19892F0D5ED6C
                                                                                                                              SHA-512:6791EBCEB3BC58014638AA78BA2CA046818D64190C2DAD261F595DD6015454FBC5FF114F5C29DFE7661DD9F65155B4D11FBECD755C900435D50035256C66F62F
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="987772" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                                                                              Static File Info

                                                                                                                              General

                                                                                                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                              Entropy (8bit):7.513878784862757
                                                                                                                              TrID:
                                                                                                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                              • DOS Executable Generic (2002/1) 0.20%
                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                              File name:c2b6efb1_by_Libranalysis.dll
                                                                                                                              File size:167424
                                                                                                                              MD5:c2b6efb1b15eab83bcec9afd875fbb34
                                                                                                                              SHA1:fab251bf2316a77c53f3b92ad016ed9697f4f14a
                                                                                                                              SHA256:2626744dae64045e445cbab9a2a225827d362ef6a0c20efa56b67dcec779857e
                                                                                                                              SHA512:632e3cb1ff7220b5ecc5800ecef4d6ebd69ff7a21d040e76a0a5dce9f06103b98bc3e60b05a34bf2e240ec91b89f028a0436f7b3760e3cb291327d123c5dfb66
                                                                                                                              SSDEEP:3072:89F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:89F6rQXvFczvYpQP
                                                                                                                              File Content Preview:MZ......................@...................................\...........!..L.!This program cannot be run in DOS mode....$.......Xm.o...<...<...<.U!<...<..B<r..<...<...<rQ!<...<;..<...<;..<3..<au.<...<szt<"..<Rich...<.......................................

                                                                                                                              File Icon

                                                                                                                              Icon Hash:74f0e4ecccdce0e4

                                                                                                                              Static PE Info

                                                                                                                              General

                                                                                                                              Entrypoint:0x10024cc0
                                                                                                                              Entrypoint Section:.text
                                                                                                                              Digitally signed:false
                                                                                                                              Imagebase:0x10000000
                                                                                                                              Subsystem:windows gui
                                                                                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                              Time Stamp:0x609C7F8B [Thu May 13 01:23:23 2021 UTC]
                                                                                                                              TLS Callbacks:
                                                                                                                              CLR (.Net) Version:
                                                                                                                              OS Version Major:5
                                                                                                                              OS Version Minor:0
                                                                                                                              File Version Major:5
                                                                                                                              File Version Minor:0
                                                                                                                              Subsystem Version Major:5
                                                                                                                              Subsystem Version Minor:0
                                                                                                                              Import Hash:88962f6760ea005847fb88b87e8ce1fd

                                                                                                                              Entrypoint Preview

                                                                                                                              Instruction
                                                                                                                              mov eax, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              cmp eax, 02h
                                                                                                                              mov eax, ebp
                                                                                                                              mov dword ptr [10029734h], eax
                                                                                                                              mov eax, ebx
                                                                                                                              mov dword ptr [10029730h], eax
                                                                                                                              mov eax, esi
                                                                                                                              mov dword ptr [10029728h], eax
                                                                                                                              jne 00007FD29CB7D4A6h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h

                                                                                                                              Rich Headers

                                                                                                                              Programming Language:
                                                                                                                              • [RES] VS2015 build 23026
                                                                                                                              • [IMP] VS2013 UPD4 build 31101
                                                                                                                              • [ C ] VS2010 build 30319
                                                                                                                              • [RES] VS2015 UPD2 build 23918
                                                                                                                              • [C++] VS2005 build 50727
                                                                                                                              • [IMP] VS2010 SP1 build 40219
                                                                                                                              • [RES] VS2012 build 50727

                                                                                                                              Data Directories

                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x2770a0x5b.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x277d80x59.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x2c0000x3a0.rsrc
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x2d0000x1220
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x100180x38.text
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x250000x4c.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                              Sections

                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                              .text0x10000x23dfe0x23e00False0.756362968206data7.53078515147IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                              .rdata0x250000x2a040x2c00False0.753728693182data7.42331753213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .crt0x280000x389c0x1800False0.79052734375MMDF mailbox7.46423038313IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                              .rsrc0x2c0000x3a00x400False0.4248046875data3.06187161643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .reloc0x2d0000x26c0x400False0.548828125data4.2946697642IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                              Resources

                                                                                                                              NameRVASizeTypeLanguageCountry
                                                                                                                              RT_VERSION0x2c0600x33cdata

                                                                                                                              Imports

                                                                                                                              DLLImport
                                                                                                                              KERNEL32.dllGetProfileSectionW, CloseHandle, OpenSemaphoreW, LoadLibraryW, OutputDebugStringA, CreateFileW, GetProfileSectionA
                                                                                                                              USER32.dllTranslateMessage
                                                                                                                              CLUSAPI.dllClusterEnum
                                                                                                                              ADVAPI32.dllRegOverridePredefKey
                                                                                                                              RASAPI32.dllRasGetConnectionStatistics
                                                                                                                              ole32.dllCreatePointerMoniker, CreateStreamOnHGlobal

                                                                                                                              Version Infos

                                                                                                                              DescriptionData
                                                                                                                              LegalCopyrightCopyright 2018
                                                                                                                              InternalNamex2otfb
                                                                                                                              FileVersion7.2.5422.00
                                                                                                                              Full Version7.2.5_000-b00
                                                                                                                              CompanyNameOracle Corporation
                                                                                                                              ProductNameXhot(BM) Ltloehey YO 8
                                                                                                                              ProductVersion7.2.5422.00
                                                                                                                              FileDescriptionJava(TM) Platform SE binary
                                                                                                                              OriginalFilenamex2otfb.dll
                                                                                                                              Translation0x0000 0x04b0

                                                                                                                              Network Behavior

                                                                                                                              Network Port Distribution

                                                                                                                              UDP Packets

                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                              May 13, 2021 06:41:14.247447014 CEST5378453192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:14.266599894 CEST6530753192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:14.320542097 CEST53537848.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:14.324110985 CEST53653078.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:14.426280022 CEST6434453192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:14.467561007 CEST6206053192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:14.477844000 CEST53643448.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:14.524830103 CEST53620608.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:14.971554041 CEST6180553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:15.020358086 CEST53618058.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:16.134031057 CEST5479553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:16.187882900 CEST53547958.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:17.301340103 CEST4955753192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:17.350217104 CEST53495578.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:18.610131025 CEST6173353192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:18.667332888 CEST53617338.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:18.702156067 CEST6544753192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:18.753598928 CEST53654478.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:20.453843117 CEST5244153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:20.505477905 CEST53524418.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:21.570756912 CEST6217653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:21.619580984 CEST53621768.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:22.765757084 CEST5959653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:22.814429045 CEST53595968.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:25.972207069 CEST6529653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:26.024183989 CEST53652968.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:27.144186974 CEST6318353192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:27.205585957 CEST53631838.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:28.657772064 CEST6015153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:28.709431887 CEST53601518.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:30.613554001 CEST5696953192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:30.662189960 CEST53569698.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:41:40.946412086 CEST5516153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:41:41.006402016 CEST53551618.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:42:04.115586042 CEST5475753192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:42:04.164387941 CEST53547578.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:42:04.823456049 CEST4999253192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:42:04.900413990 CEST53499928.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:42:20.571624994 CEST6007553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:42:20.632805109 CEST53600758.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:42:47.428766966 CEST5501653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:42:47.501671076 CEST53550168.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:42:50.097834110 CEST6434553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:42:50.156563044 CEST53643458.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:43:05.950217962 CEST5712853192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:43:06.015170097 CEST53571288.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:43:26.050312996 CEST5479153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:43:26.122706890 CEST53547918.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 06:43:27.071993113 CEST5046353192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 06:43:27.140410900 CEST53504638.8.8.8192.168.2.5

                                                                                                                              Code Manipulations

                                                                                                                              Statistics

                                                                                                                              CPU Usage

                                                                                                                              Click to jump to process

                                                                                                                              Memory Usage

                                                                                                                              Click to jump to process

                                                                                                                              High Level Behavior Distribution

                                                                                                                              Click to dive into process behavior distribution

                                                                                                                              Behavior

                                                                                                                              Click to jump to process

                                                                                                                              System Behavior

                                                                                                                              General

                                                                                                                              Start time:06:41:21
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\System32\loaddll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:loaddll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll'
                                                                                                                              Imagebase:0xb50000
                                                                                                                              File size:116736 bytes
                                                                                                                              MD5 hash:542795ADF7CC08EFCF675D65310596E8
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:41:21
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x150000
                                                                                                                              File size:232960 bytes
                                                                                                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:41:22
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:rundll32.exe 'C:\Users\user\Desktop\c2b6efb1_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0xa40000
                                                                                                                              File size:61952 bytes
                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Yara matches:
                                                                                                                              • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.328088849.0000000010001000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:41:53
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 764
                                                                                                                              Imagebase:0x380000
                                                                                                                              File size:434592 bytes
                                                                                                                              MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              Disassembly

                                                                                                                              Code Analysis

                                                                                                                              Reset < >

                                                                                                                                Executed Functions

                                                                                                                                Non-executed Functions

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000000.00000002.229629330.0000000010021000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000000.00000002.229605724.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.229609102.0000000010001000.00000020.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.229634203.0000000010025000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.229639372.0000000010028000.00000008.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.229643932.000000001002C000.00000002.00020000.sdmp Download File
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: D$a$c$i$l$l$o$t$u
                                                                                                                                • API String ID: 0-1871623029
                                                                                                                                • Opcode ID: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction ID: 0084815472b1379f451f328db7bdd48fedf0434f01950e1a6ab525a79fee850b
                                                                                                                                • Opcode Fuzzy Hash: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction Fuzzy Hash: 6142A774608780CFD374CF28C894BDABBE1ABD9354F54892EE48D8B391E731A845CB56
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Executed Functions

                                                                                                                                Non-executed Functions

                                                                                                                                C-Code - Quality: 100%
                                                                                                                                			E10006D50() {
                                                                                                                                
                                                                                                                                				 *0x1001d280 = GetUserNameW;
                                                                                                                                				 *0x1001D284 = MessageBoxW;
                                                                                                                                				 *0x1001D288 = GetLastError;
                                                                                                                                				 *0x1001D28C = CreateFileA;
                                                                                                                                				 *0x1001D290 = DebugBreak;
                                                                                                                                				 *0x1001D294 = FlushFileBuffers;
                                                                                                                                				 *0x1001D298 = FreeEnvironmentStringsA;
                                                                                                                                				 *0x1001D29C = GetConsoleOutputCP;
                                                                                                                                				 *0x1001D2A0 = GetEnvironmentStrings;
                                                                                                                                				 *0x1001D2A4 = GetLocaleInfoA;
                                                                                                                                				 *0x1001D2A8 = GetStartupInfoA;
                                                                                                                                				 *0x1001D2AC = GetStringTypeA;
                                                                                                                                				 *0x1001D2B0 = HeapValidate;
                                                                                                                                				 *0x1001D2B4 = IsBadReadPtr;
                                                                                                                                				 *0x1001D2B8 = LCMapStringA;
                                                                                                                                				 *0x1001D2BC = LoadLibraryA;
                                                                                                                                				 *0x1001D2C0 = OutputDebugStringA;
                                                                                                                                				return 0x1001d280;
                                                                                                                                			}



                                                                                                                                0x10006d61
                                                                                                                                0x10006d69
                                                                                                                                0x10006d6c
                                                                                                                                0x10006d7b
                                                                                                                                0x10006d7e
                                                                                                                                0x10006d8d
                                                                                                                                0x10006d90
                                                                                                                                0x10006d9f
                                                                                                                                0x10006da2
                                                                                                                                0x10006db1
                                                                                                                                0x10006db4
                                                                                                                                0x10006dc3
                                                                                                                                0x10006dc6
                                                                                                                                0x10006dd5
                                                                                                                                0x10006dd8
                                                                                                                                0x10006de7
                                                                                                                                0x10006dea
                                                                                                                                0x10006ded

                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.328088849.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.328079618.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.328126714.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.328134933.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.328142061.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID:
                                                                                                                                • API String ID:
                                                                                                                                • Opcode ID: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction ID: 9a9f90be372116ce35b3bf57ca6adafecb814b37ff7dc50591bd4b03753dcc6b
                                                                                                                                • Opcode Fuzzy Hash: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction Fuzzy Hash: 99110FB8A05620CFD34ACF09D5D49117BF2BB8E360312C19AD8098B376D734D985CF54
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                C-Code - Quality: 83%
                                                                                                                                			E1000C218(void* __ecx, void* __edx) {
                                                                                                                                				char _v28;
                                                                                                                                				char _v33;
                                                                                                                                				char _v38;
                                                                                                                                				char _v43;
                                                                                                                                				void* _t24;
                                                                                                                                				char* _t25;
                                                                                                                                				char _t32;
                                                                                                                                				void* _t33;
                                                                                                                                				void* _t34;
                                                                                                                                				signed int _t38;
                                                                                                                                				char* _t40;
                                                                                                                                
                                                                                                                                				_t40 = (_t38 & 0xfffffff0) - 0x2c;
                                                                                                                                				asm("movq xmm0, [edx]");
                                                                                                                                				_t32 = 0;
                                                                                                                                				 *_t40 = 0x7b;
                                                                                                                                				asm("movq [esp+0x1], xmm0");
                                                                                                                                				_v43 = 0x2d;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t32 + 0xa)) =  *((intOrPtr*)(_t32 + __edx + 8));
                                                                                                                                					_t32 = _t32 + 1;
                                                                                                                                				} while (_t32 < 4);
                                                                                                                                				_v38 = 0x2d;
                                                                                                                                				_t33 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t33 + 0xf)) =  *((intOrPtr*)(_t33 + __edx + 0xc));
                                                                                                                                					_t33 = _t33 + 1;
                                                                                                                                				} while (_t33 < 4);
                                                                                                                                				_v33 = 0x2d;
                                                                                                                                				_t34 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t34 + 0x14)) =  *((intOrPtr*)(_t34 + __edx + 0x10));
                                                                                                                                					_t34 = _t34 + 1;
                                                                                                                                				} while (_t34 < 4);
                                                                                                                                				_v28 = 0x2d;
                                                                                                                                				_t24 = 0;
                                                                                                                                				do {
                                                                                                                                					asm("movd xmm0, dword [eax+edx+0x14]");
                                                                                                                                					asm("movd [esp+eax+0x19], xmm0");
                                                                                                                                					_t24 = _t24 + 4;
                                                                                                                                				} while (_t24 < 0xc);
                                                                                                                                				_t25 = _t40;
                                                                                                                                				 *((char*)(_t25 + 0x25)) = 0x7d;
                                                                                                                                				 *((char*)(_t25 + 0x26)) = 0;
                                                                                                                                				E1000DFBC(__ecx, _t25, 0);
                                                                                                                                				return __ecx;
                                                                                                                                			}














                                                                                                                                0x1000c21f
                                                                                                                                0x1000c224
                                                                                                                                0x1000c228
                                                                                                                                0x1000c22a
                                                                                                                                0x1000c22e
                                                                                                                                0x1000c234
                                                                                                                                0x1000c239
                                                                                                                                0x1000c23d
                                                                                                                                0x1000c241
                                                                                                                                0x1000c242
                                                                                                                                0x1000c249
                                                                                                                                0x1000c24e
                                                                                                                                0x1000c250
                                                                                                                                0x1000c254
                                                                                                                                0x1000c258
                                                                                                                                0x1000c259
                                                                                                                                0x1000c260
                                                                                                                                0x1000c265
                                                                                                                                0x1000c267
                                                                                                                                0x1000c26b
                                                                                                                                0x1000c26f
                                                                                                                                0x1000c270
                                                                                                                                0x1000c275
                                                                                                                                0x1000c27a
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c282
                                                                                                                                0x1000c288
                                                                                                                                0x1000c28b
                                                                                                                                0x1000c292
                                                                                                                                0x1000c295
                                                                                                                                0x1000c29b
                                                                                                                                0x1000c2a0
                                                                                                                                0x1000c2ae

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.328088849.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.328079618.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.328126714.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.328134933.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.328142061.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: -$-$-$-
                                                                                                                                • API String ID: 0-1033403326
                                                                                                                                • Opcode ID: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction ID: 6420cdf91b2b9fc5655fa5f82b4c53aa5eb92ddd4154ae73ebf41adf494228f8
                                                                                                                                • Opcode Fuzzy Hash: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction Fuzzy Hash: C811252091C3C04CE749DB7C548462BFFD08F9A208F1886BEE4DA86B53E525D49683B7
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%