Analysis Report a98ab505_by_Libranalysis.dll

Overview

General Information

Sample Name:	a98ab505_by_Libranalysis.dll
Analysis ID:	413039
MD5:	a98ab505ecc3ec9d5c5d4571f4a2b5fe
SHA1:	ff5d7193d073303d7821ea418a7fdede1a62d384
SHA256:	cf3a3944a4a37b5c13842e1acc85b10a69dddb1b1c9c7de2a432b4ba32bb1781
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection:

Found malware configuration

Source: 2.2.rundll32.exe.10000000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["BwjTiXD0nMT8wuL0lzuDMT1lwajgYLnSPMpMch1H2fk8H", "duBYwiNAKNjPWhQIWm9t4nFdK0AZ0qg5qRVUphxjgPm8fOpLdTGQDOkY8vper"]}

Multi AV Scanner detection for submitted file

Source: a98ab505_by_Libranalysis.dll

ReversingLabs: Detection: 48%

Machine Learning detection for sample

Source: a98ab505_by_Libranalysis.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: a98ab505_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: a98ab505_by_Libranalysis.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb4 source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: HD`lbase.pdb source: WerFault.exe, 0000000E.00000003.726295606.0000000004635000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb? source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb& source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.734209164.0000000004BF0000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.655496338.0000000010024000.00000002.00020000.sdmp, a98ab505_by_Libranalysis.dll
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wUxTheme.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb* source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 43.229.206.212:443
Source: Malware configuration extractor	IPs: 82.209.17.209:8172
Source: Malware configuration extractor	IPs: 162.241.209.225:4125

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 82.209.17.209 82.209.17.209
Source: Joe Sandbox View	IP Address: 162.241.209.225 162.241.209.225

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: PODA-ASCZ PODA-ASCZ
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: WerFault.exe, 0000000E.00000003.748855263.000000000456C000.00000004.00000001.sdmp

String found in binary or memory: http://crl.micro

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 00000002.00000002.755906569.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE

System Summary:

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10011460	2_2_10011460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_1000846C	2_2_1000846C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10001494	2_2_10001494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_1000A52C	2_2_1000A52C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10011D58	2_2_10011D58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10019348	2_2_10019348
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10010754	2_2_10010754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_100090CC	2_2_100090CC

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 764

Sample file is different than original file name gathered from version info

Source: a98ab505_by_Libranalysis.dll

Binary or memory string: OriginalFilenamex2otfb.dllN vs a98ab505_by_Libranalysis.dll

Uses 32bit PE files

Source: a98ab505_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: a98ab505_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal76.troj.evad.winDLL@6/4@0/3

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6656

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF22.tmp

Jump to behavior

Source: a98ab505_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1

Source: a98ab505_by_Libranalysis.dll

ReversingLabs: Detection: 48%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 764
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1	Jump to behavior

Source: a98ab505_by_Libranalysis.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: a98ab505_by_Libranalysis.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb4 source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: HD`lbase.pdb source: WerFault.exe, 0000000E.00000003.726295606.0000000004635000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb? source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb& source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.734209164.0000000004BF0000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.655496338.0000000010024000.00000002.00020000.sdmp, a98ab505_by_Libranalysis.dll
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wUxTheme.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb* source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000742D push ebx; iretd	0_2_100073E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004836 push esp; ret	0_2_1000483B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000888E push ds; ret	0_2_100088AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100090C5 push ds; retf	0_2_100090ED
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100070CF push ebx; retf	0_2_100070E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10006909 push ds; ret	0_2_1000690C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007540 push bx; retf	0_2_10007548
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10005168 push ds; iretd	0_2_1000516B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000918C push es; retf	0_2_1000918D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007D8D push es; ret	0_2_10007D8E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100079B5 push ecx; retf	0_2_100079C1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000762B push ds; retf	0_2_1000761D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000523E push esi; retf	0_2_10005248
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000428B push FFFFFFA0h; ret	0_2_10004380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002691 push edx; iretd	0_2_1000269F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100036A2 push ecx; iretd	0_2_100036A3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100066A4 push ecx; iretd	0_2_100066A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100036A5 push ds; iretd	0_2_100036A6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007ECA push ds; iretd	0_2_10007F2D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100036ED push ds; iretd	0_2_10003746
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100042EE push FFFFFFA0h; ret	0_2_10004380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007307 push ebx; iretd	0_2_100073E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000772D push ecx; ret	0_2_1000772E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10022F50 push edx; iretd	0_2_1000269F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000435C push ebx; retf	0_2_10004366
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000476B push es; ret	0_2_1000476C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004389 push FFFFFFA0h; ret	0_2_10004380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100073B5 push ebx; iretd	0_2_100073E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100063C9 push esi; retf	0_2_100063E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100067CB push edi; ret	0_2_100067D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_1000F6CC push esi; mov dword ptr [esp], 00000000h	2_2_1000F6CD

Source: initial sample

Static PE information: section name: .text entropy: 7.58982753446

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: \KnownDlls32\TESTAPP.exe

Jump to behavior

Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000E.00000003.748950202.0000000004648000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_10006D50

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1

Jump to behavior

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_10006D50

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_10006D50

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
82.209.17.209	unknown	Czech Republic	30764	PODA-ASCZ	true
162.241.209.225	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
43.229.206.212	unknown	Indonesia	24532	INET-AS-IDPTInetGlobalIndoID	true

AV Detection:

Found malware configuration

Source: 2.2.rundll32.exe.10000000.3.unpack

Multi AV Scanner detection for submitted file

Source: a98ab505_by_Libranalysis.dll

ReversingLabs: Detection: 48%

Machine Learning detection for sample

Source: a98ab505_by_Libranalysis.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: a98ab505_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: a98ab505_by_Libranalysis.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb4 source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: HD`lbase.pdb source: WerFault.exe, 0000000E.00000003.726295606.0000000004635000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb? source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb& source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.734209164.0000000004BF0000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.655496338.0000000010024000.00000002.00020000.sdmp, a98ab505_by_Libranalysis.dll
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wUxTheme.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb* source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 43.229.206.212:443
Source: Malware configuration extractor	IPs: 82.209.17.209:8172
Source: Malware configuration extractor	IPs: 162.241.209.225:4125

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 82.209.17.209 82.209.17.209
Source: Joe Sandbox View	IP Address: 162.241.209.225 162.241.209.225

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: PODA-ASCZ PODA-ASCZ
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: WerFault.exe, 0000000E.00000003.748855263.000000000456C000.00000004.00000001.sdmp

String found in binary or memory: http://crl.micro

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 00000002.00000002.755906569.0000000010001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE

System Summary:

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10011460	2_2_10011460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_1000846C	2_2_1000846C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10001494	2_2_10001494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_1000A52C	2_2_1000A52C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10011D58	2_2_10011D58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10019348	2_2_10019348
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_10010754	2_2_10010754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_100090CC	2_2_100090CC

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 764

Sample file is different than original file name gathered from version info

Source: a98ab505_by_Libranalysis.dll

Binary or memory string: OriginalFilenamex2otfb.dllN vs a98ab505_by_Libranalysis.dll

Uses 32bit PE files

Source: a98ab505_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: a98ab505_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal76.troj.evad.winDLL@6/4@0/3

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6656

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF22.tmp

Jump to behavior

Source: a98ab505_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1

Source: a98ab505_by_Libranalysis.dll

ReversingLabs: Detection: 48%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 764
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1	Jump to behavior

Source: a98ab505_by_Libranalysis.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: a98ab505_by_Libranalysis.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb4 source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 0000000E.00000003.725980115.0000000004634000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: glu32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: HD`lbase.pdb source: WerFault.exe, 0000000E.00000003.726295606.0000000004635000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb? source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb& source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: opengl32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.734209164.0000000004BF0000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.655496338.0000000010024000.00000002.00020000.sdmp, a98ab505_by_Libranalysis.dll
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wUxTheme.pdb< source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.734170143.0000000004BE0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.734096122.0000000004AC1000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb* source: WerFault.exe, 0000000E.00000003.734183815.0000000004BE6000.00000004.00000040.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000742D push ebx; iretd	0_2_100073E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004836 push esp; ret	0_2_1000483B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000888E push ds; ret	0_2_100088AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100090C5 push ds; retf	0_2_100090ED
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100070CF push ebx; retf	0_2_100070E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10006909 push ds; ret	0_2_1000690C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007540 push bx; retf	0_2_10007548
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10005168 push ds; iretd	0_2_1000516B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000918C push es; retf	0_2_1000918D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007D8D push es; ret	0_2_10007D8E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100079B5 push ecx; retf	0_2_100079C1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000762B push ds; retf	0_2_1000761D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000523E push esi; retf	0_2_10005248
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000428B push FFFFFFA0h; ret	0_2_10004380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002691 push edx; iretd	0_2_1000269F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100036A2 push ecx; iretd	0_2_100036A3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100066A4 push ecx; iretd	0_2_100066A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100036A5 push ds; iretd	0_2_100036A6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007ECA push ds; iretd	0_2_10007F2D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100036ED push ds; iretd	0_2_10003746
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100042EE push FFFFFFA0h; ret	0_2_10004380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007307 push ebx; iretd	0_2_100073E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000772D push ecx; ret	0_2_1000772E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10022F50 push edx; iretd	0_2_1000269F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000435C push ebx; retf	0_2_10004366
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000476B push es; ret	0_2_1000476C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004389 push FFFFFFA0h; ret	0_2_10004380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100073B5 push ebx; iretd	0_2_100073E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100063C9 push esi; retf	0_2_100063E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100067CB push edi; ret	0_2_100067D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_1000F6CC push esi; mov dword ptr [esp], 00000000h	2_2_1000F6CD

Source: initial sample

Static PE information: section name: .text entropy: 7.58982753446

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: \KnownDlls32\TESTAPP.exe

Jump to behavior

Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 0000000E.00000003.748950202.0000000004648000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 0000000E.00000002.753015700.0000000004830000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_10006D50

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\a98ab505_by_Libranalysis.dll',#1

Jump to behavior

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_10006D50

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_10006D50

ID:	413039
Product:	CloudBasic
Start time:	06:54:07
Start date:	13.05.2021
Sample:	a98ab505_by_Libranalysis.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	a98ab505ecc3ec9d5c5d4571f4a2b5fe
SHA1:	ff5d7193d073303d7821ea418a7fdede1a62d384
SHA256:	cf3a3944a4a37b5c13842e1acc85b10a69dddb1b1c9c7de2a432b4ba32bb1781
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_d1933e54dec77ed372db99aebc0b4554f9da850_82810a17_1a60e121\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	E08CBB1D441D88BDE4065ACAF4011018	F3484E678D6F0365DEC61113308FC2B73786EBBA	2CC5AA0258F78DBA838ACE173AB8661168795596EF822389C57AE0213BE3A78D
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF22.tmp.dmp	Mini DuMP crash report, 14 streams, Thu May 13 04:55:36 2021, 0x1205a4 type	5D86A78862C271FFAA90AF0B090594CD	75C3193765597FC6EBE2855FAACB36866FF7571F	8FFF2A44A9EE0A10E2E764F4DA7073546711C70E742A7EDB20A6266A623548AB
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC695.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	CF068ADA221E4144E98A7872F3875885	C754910C932EF8CDD8DA8910C5FD06DA571933F8	D326B9BE4CD1C7E1BADFEBABF355930A4A46FDC3646888A686D93EC73815AF73
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9B3.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	C2832FDD823216C133067E69989034B6	86AF26EB5AAE25548EF6B32DF32AA407F57CCE02	E8125B9BCB4F2AF73338A4B3A7F5B93480FE172C75E42BDBB9B03F1890E396F3

Analysis Report a98ab505_by_Libranalysis.dll

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs