Loading ...

Play interactive tourEdit tour

Analysis Report 8b521700_by_Libranalysis

Overview

General Information

Sample Name:8b521700_by_Libranalysis (renamed file extension from none to dll)
Analysis ID:413062
MD5:8b52170067bb81519849ffb4932edab7
SHA1:6ae37f7b96c151b8bd4aa8fcf942d7ce1a0a241e
SHA256:c80d214220f67b082bdf7a9da95adcd3dff7a59a505fc7d976cfcf8bafa46e2a
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • loaddll32.exe (PID: 5360 cmdline: loaddll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 5324 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5872 cmdline: rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 6332 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 764 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.325566919.0000000010001000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    2.2.rundll32.exe.10000000.3.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Found malware configurationShow sources
      Source: 2.2.rundll32.exe.10000000.3.unpackMalware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}
      Machine Learning detection for sampleShow sources
      Source: 8b521700_by_Libranalysis.dllJoe Sandbox ML: detected
      Source: 8b521700_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 8b521700_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: oleaut32.pdb$ source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.300734152.0000000005207000.00000004.00000001.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb1 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: sechost.pdb8 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdbd4^8 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: cryptbase.pdb> source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb* source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.305430570.0000000005722000.00000004.00000040.sdmp
      Source: Binary string: advapi32.pdb2 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdbP source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.235836875.0000000010025000.00000002.00020000.sdmp, 8b521700_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdbV source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp

      Networking:

      barindex
      C2 URLs / IPs found in malware configurationShow sources
      Source: Malware configuration extractorIPs: 43.229.206.212:443
      Source: Malware configuration extractorIPs: 82.209.17.209:8172
      Source: Malware configuration extractorIPs: 162.241.209.225:4125
      Source: Joe Sandbox ViewIP Address: 82.209.17.209 82.209.17.209
      Source: Joe Sandbox ViewIP Address: 162.241.209.225 162.241.209.225
      Source: Joe Sandbox ViewIP Address: 43.229.206.212 43.229.206.212
      Source: Joe Sandbox ViewASN Name: PODA-ASCZ PODA-ASCZ
      Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
      Source: Joe Sandbox ViewASN Name: INET-AS-IDPTInetGlobalIndoID INET-AS-IDPTInetGlobalIndoID

      E-Banking Fraud:

      barindex
      Yara detected Dridex unpacked fileShow sources
      Source: Yara matchFile source: 00000002.00000002.325566919.0000000010001000.00000020.00020000.sdmp, type: MEMORY
      Source: Yara matchFile source: 2.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100220F00_2_100220F0
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100114602_2_10011460
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000846C2_2_1000846C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100014942_2_10001494
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000A52C2_2_1000A52C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10011D582_2_10011D58
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100193482_2_10019348
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100107542_2_10010754
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100090CC2_2_100090CC
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 764
      Source: 8b521700_by_Libranalysis.dllBinary or memory string: OriginalFilenamex2otfb.dllN vs 8b521700_by_Libranalysis.dll
      Source: 8b521700_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 8b521700_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: classification engineClassification label: mal64.troj.winDLL@6/4@0/3
      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5872
      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER130.tmpJump to behavior
      Source: 8b521700_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1
      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll'
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 764
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1Jump to behavior
      Source: 8b521700_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: 8b521700_by_Libranalysis.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: oleaut32.pdb$ source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.300734152.0000000005207000.00000004.00000001.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb1 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: sechost.pdb8 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdbd4^8 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: cryptbase.pdb> source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb* source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.305430570.0000000005722000.00000004.00000040.sdmp
      Source: Binary string: advapi32.pdb2 source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdbP source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.235836875.0000000010025000.00000002.00020000.sdmp, 8b521700_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.305395546.0000000005710000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdbV source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.305417966.0000000005716000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.305379291.0000000005741000.00000004.00000001.sdmp
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006207 push ebx; ret 0_2_10006208
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10004E0F push 822377FAh; iretd 0_2_10004E14
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005813 push eax; ret 0_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006830 push 82235DBAh; iretd 0_2_10006855
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002C33 push 0E950FD0h; iretd 0_2_10002D7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000585A push eax; ret 0_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005A7B push cs; iretd 0_2_10005B7E
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006A80 push ebx; iretd 0_2_10006A85
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002C8E push 0E950FD0h; iretd 0_2_10002D7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000388E push 8223930Ah; iretd 0_2_10003893
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100048AF push 8223A1AEh; iretd 0_2_100048B4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100066D0 push 8223737Ah; iretd 0_2_100066D5
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100054EF push 822385B2h; iretd 0_2_100054F4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000530F push 82230D7Eh; iretd 0_2_10005314
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000574F push 82238352h; iretd 0_2_10005754
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100037A2 push cs; retf 0_2_100037DC
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100039C3 push edi; retf 0_2_100039C4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005FD6 push 0E950020h; retf 0_2_10005FDE
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002DF3 push cs; iretd 0_2_10002E7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100037F5 push cs; retf 0_2_100037DC
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000F6CC push esi; mov dword ptr [esp], 00000000h2_2_1000F6CD
      Source: initial sampleStatic PE information: section name: .text entropy: 7.53078515147
      Source: C:\Windows\SysWOW64\WerFault.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: WerFault.exe, 0000000E.00000002.321966998.0000000005210000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
      Source: WerFault.exe, 0000000E.00000003.320264121.0000000005156000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAWet Scheduler-0000
      Source: WerFault.exe, 0000000E.00000003.320264121.0000000005156000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
      Source: WerFault.exe, 0000000E.00000002.321966998.0000000005210000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
      Source: WerFault.exe, 0000000E.00000002.321966998.0000000005210000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
      Source: WerFault.exe, 0000000E.00000002.321966998.0000000005210000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection11Virtualization/Sandbox Evasion1OS Credential DumpingQuery Registry1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection11LSASS MemorySecurity Software Discovery21Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerVirtualization/Sandbox Evasion1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Rundll321NTDSAccount Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware Packing2LSA SecretsSystem Owner/User Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Information Discovery11Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      8b521700_by_Libranalysis.dll100%Joe Sandbox ML

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      2.2.rundll32.exe.1a0000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      82.209.17.209
      unknownCzech Republic
      30764PODA-ASCZtrue
      162.241.209.225
      unknownUnited States
      46606UNIFIEDLAYER-AS-1UStrue
      43.229.206.212
      unknownIndonesia
      24532INET-AS-IDPTInetGlobalIndoIDtrue

      General Information

      Joe Sandbox Version:32.0.0 Black Diamond
      Analysis ID:413062
      Start date:13.05.2021
      Start time:07:20:37
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 6m 37s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:8b521700_by_Libranalysis (renamed file extension from none to dll)
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:28
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal64.troj.winDLL@6/4@0/3
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 94.5% (good quality ratio 86.4%)
      • Quality average: 72%
      • Quality standard deviation: 32.2%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 2
      • Number of non-executed functions: 3
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI

      Simulations

      Behavior and APIs

      TimeTypeDescription
      07:22:10API Interceptor1x Sleep call for process: WerFault.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      82.209.17.20994a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
        a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
          4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
            0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                    fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                        4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                          a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                            cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                    6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                        052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                          fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                            5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                              162.241.209.22594a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                  4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                    0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                      cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                        2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                          86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                            fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                  a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                      4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                        27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                          86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                            6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                  fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                    5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                      43.229.206.21294a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                        a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                          4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                            0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                    fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                        4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                          a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                            cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                    6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                        052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                          fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                            5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse

                                                                                                                              Domains

                                                                                                                              No context

                                                                                                                              ASN

                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                              PODA-ASCZ94a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              INET-AS-IDPTInetGlobalIndoID94a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              UNIFIEDLAYER-AS-1US94a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225

                                                                                                                              JA3 Fingerprints

                                                                                                                              No context

                                                                                                                              Dropped Files

                                                                                                                              No context

                                                                                                                              Created / dropped Files

                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_2ac979c0c493e4f29eb4b741e1f7e3129c653d0_82810a17_18dd2293\Report.wer
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):12478
                                                                                                                              Entropy (8bit):3.766424046441743
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:cpiuf0oXZHcHBUZMX4jed+AG/u7sSS274ItWcTp:GiuhXKBUZMX4jeU/u7sSX4ItWcTp
                                                                                                                              MD5:56D056B54D5E29C35DC0EB101A8B372F
                                                                                                                              SHA1:7854A660F59AF3D41A374F4E3B02413AC7B0D857
                                                                                                                              SHA-256:8146E50BAF6878E71DB25BA958352F7CE1FF5B523F9B37DDE84CA40F19BC8727
                                                                                                                              SHA-512:728D6D5D8F6050795D7272BFAA9523DAD1FB55C8C8C3655C2F470457CE0287DD68943241874F81BFBF285DCE9F3DB6203BA5DBF79CF6667F229CB796D820EEC9
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.5.3.8.9.3.2.1.7.4.4.5.9.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.5.3.8.9.3.2.8.5.8.8.3.4.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.8.6.c.7.e.4.-.f.f.c.8.-.4.2.3.3.-.b.4.7.2.-.b.d.e.b.0.9.8.3.7.e.4.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.d.0.9.e.9.3.5.-.2.8.d.3.-.4.3.9.f.-.8.7.d.2.-.8.b.9.5.5.0.2.2.c.2.2.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.f.0.-.0.0.0.1.-.0.0.1.6.-.2.c.a.6.-.f.c.4.4.0.3.4.8.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER130.tmp.dmp
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Mini DuMP crash report, 14 streams, Thu May 13 14:22:03 2021, 0x1205a4 type
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):48290
                                                                                                                              Entropy (8bit):2.0596277425380727
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:iYqHq5i9F1eXvV5w8BvTeaZOoDMnjz+H66vnD90JJIshwP/P:pHMFcxq2QnjzEFb90Ji5/P
                                                                                                                              MD5:6F71414E79338050E54BAB460AD2030E
                                                                                                                              SHA1:1081D7042FF7AACDE74B80F7119D4062EE42EC63
                                                                                                                              SHA-256:0529C35023DC15B741F6AAD6CFFDA55E4752C48D981A3F87F2D7626472A04D05
                                                                                                                              SHA-512:F756356CF316FD00F195B746DEC2CCF78BE2F480EC54B11DACAA17F85237C9C90AC54F6DE3D06600DFC6EF96C6ADD09DCE26F90CA8B74A06A02A124EA8D45061
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: MDMP....... ........6.`...................U...........B..............GenuineIntelW...........T............5.`.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER865.tmp.WERInternalMetadata.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):8292
                                                                                                                              Entropy (8bit):3.695231877029818
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:Rrl7r3GLNi1Q6P6YXDp62lgmfTZVSoCpre89bKnrsfmum:RrlsNiy6P6YXt62lgmfTbSHKnwfm
                                                                                                                              MD5:D89A92A7BAFB354AE81E1C44C856DBB9
                                                                                                                              SHA1:3E2921181C311B66A8BEE7863848640E3B800F16
                                                                                                                              SHA-256:C6EAE934940A4909425BB3D4A96ECFC101152D119D4EAFB9D02363F8F4E58056
                                                                                                                              SHA-512:7E6536299F3748DDDBD21A3DE73C97200D93882178B8CD491F484499620BB40BDC5113D9D4BDA484DBE36CD346BAF19222766A41650EE2D39BFF2DB934B8F041
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.7.2.<./.P.i.d.>.......
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF6.tmp.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):4663
                                                                                                                              Entropy (8bit):4.471910948630518
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:48:cvIwSD8zsHJgtWI9kaWSC8Bi8fm8M4JCdsemNrFk+q8/pmNFG4SrST6d:uITfprbSNJJrN27NgDWT6d
                                                                                                                              MD5:87063F1DFF812D09318548B19BDD7EFA
                                                                                                                              SHA1:347BAB464E04C7092975FD595ED0FCA0123522F0
                                                                                                                              SHA-256:F31BE0AD9B7B6C5F9BD19621523894C9745D90AC1AEC4F86410E6189382BE770
                                                                                                                              SHA-512:00490C30F58C8FD7BF73822709F727435A891586E0C35E13E68C9D50889CA4762F70258574ABDD46F869840B9165E219D98611D60328E719C515D233C1605E40
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="987812" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                                                                              Static File Info

                                                                                                                              General

                                                                                                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                              Entropy (8bit):7.513872045218068
                                                                                                                              TrID:
                                                                                                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                              • DOS Executable Generic (2002/1) 0.20%
                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                              File name:8b521700_by_Libranalysis.dll
                                                                                                                              File size:167424
                                                                                                                              MD5:8b52170067bb81519849ffb4932edab7
                                                                                                                              SHA1:6ae37f7b96c151b8bd4aa8fcf942d7ce1a0a241e
                                                                                                                              SHA256:c80d214220f67b082bdf7a9da95adcd3dff7a59a505fc7d976cfcf8bafa46e2a
                                                                                                                              SHA512:60b370460ac0b3692d440ecb039752763eccff30d1a34977b6341f49dbe109e5bafcbb08d59c867f231fed026102772fe8b029d2a552035ea157f3ab18d9512c
                                                                                                                              SSDEEP:3072:+9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:+9F6rQXvFczvYpQP
                                                                                                                              File Content Preview:MZ......................@...................................\...........!..L.!This program cannot be run in DOS mode....$.......Xm.o...<...<...<.U!<...<..B<r..<...<...<rQ!<...<;..<...<;..<3..<au.<...<szt<"..<Rich...<.......................................

                                                                                                                              File Icon

                                                                                                                              Icon Hash:74f0e4ecccdce0e4

                                                                                                                              Static PE Info

                                                                                                                              General

                                                                                                                              Entrypoint:0x10024cc0
                                                                                                                              Entrypoint Section:.text
                                                                                                                              Digitally signed:false
                                                                                                                              Imagebase:0x10000000
                                                                                                                              Subsystem:windows gui
                                                                                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                              Time Stamp:0x609C8024 [Thu May 13 01:25:56 2021 UTC]
                                                                                                                              TLS Callbacks:
                                                                                                                              CLR (.Net) Version:
                                                                                                                              OS Version Major:5
                                                                                                                              OS Version Minor:0
                                                                                                                              File Version Major:5
                                                                                                                              File Version Minor:0
                                                                                                                              Subsystem Version Major:5
                                                                                                                              Subsystem Version Minor:0
                                                                                                                              Import Hash:88962f6760ea005847fb88b87e8ce1fd

                                                                                                                              Entrypoint Preview

                                                                                                                              Instruction
                                                                                                                              mov eax, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              cmp eax, 02h
                                                                                                                              mov eax, ebp
                                                                                                                              mov dword ptr [10029734h], eax
                                                                                                                              mov eax, ebx
                                                                                                                              mov dword ptr [10029730h], eax
                                                                                                                              mov eax, esi
                                                                                                                              mov dword ptr [10029728h], eax
                                                                                                                              jne 00007F9A78BE7556h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h

                                                                                                                              Rich Headers

                                                                                                                              Programming Language:
                                                                                                                              • [RES] VS2015 build 23026
                                                                                                                              • [IMP] VS2013 UPD4 build 31101
                                                                                                                              • [ C ] VS2010 build 30319
                                                                                                                              • [RES] VS2015 UPD2 build 23918
                                                                                                                              • [C++] VS2005 build 50727
                                                                                                                              • [IMP] VS2010 SP1 build 40219
                                                                                                                              • [RES] VS2012 build 50727

                                                                                                                              Data Directories

                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x2770a0x5b.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x277d80x59.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x2c0000x3a0.rsrc
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x2d0000x1220
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x100180x38.text
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x250000x4c.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                              Sections

                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                              .text0x10000x23dfe0x23e00False0.756362968206data7.53078515147IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                              .rdata0x250000x2a040x2c00False0.753728693182data7.42331753213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .crt0x280000x331c0x1800False0.79052734375MMDF mailbox7.46423038313IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                              .rsrc0x2c0000x3a00x400False0.4248046875data3.06187161643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .reloc0x2d0000xf6a0x400False0.548828125data4.2946697642IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                              Resources

                                                                                                                              NameRVASizeTypeLanguageCountry
                                                                                                                              RT_VERSION0x2c0600x33cdata

                                                                                                                              Imports

                                                                                                                              DLLImport
                                                                                                                              KERNEL32.dllGetProfileSectionW, CloseHandle, OpenSemaphoreW, LoadLibraryW, OutputDebugStringA, CreateFileW, GetProfileSectionA
                                                                                                                              USER32.dllTranslateMessage
                                                                                                                              CLUSAPI.dllClusterEnum
                                                                                                                              ADVAPI32.dllRegOverridePredefKey
                                                                                                                              RASAPI32.dllRasGetConnectionStatistics
                                                                                                                              ole32.dllCreatePointerMoniker, CreateStreamOnHGlobal

                                                                                                                              Version Infos

                                                                                                                              DescriptionData
                                                                                                                              LegalCopyrightCopyright 2018
                                                                                                                              InternalNamex2otfb
                                                                                                                              FileVersion7.2.5422.00
                                                                                                                              Full Version7.2.5_000-b00
                                                                                                                              CompanyNameOracle Corporation
                                                                                                                              ProductNameXhot(BM) Ltloehey YO 8
                                                                                                                              ProductVersion7.2.5422.00
                                                                                                                              FileDescriptionJava(TM) Platform SE binary
                                                                                                                              OriginalFilenamex2otfb.dll
                                                                                                                              Translation0x0000 0x04b0

                                                                                                                              Network Behavior

                                                                                                                              Network Port Distribution

                                                                                                                              UDP Packets

                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                              May 13, 2021 07:21:21.650492907 CEST6434453192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:21.702116013 CEST53643448.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:22.247760057 CEST6206053192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:22.269733906 CEST6180553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:22.313265085 CEST53620608.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:22.334413052 CEST53618058.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:22.480453968 CEST5479553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:22.529206038 CEST53547958.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:23.605246067 CEST4955753192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:23.654114008 CEST53495578.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:24.642443895 CEST6173353192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:24.692874908 CEST53617338.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:25.104310036 CEST6544753192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:25.165618896 CEST53654478.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:25.747581005 CEST5244153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:25.800504923 CEST53524418.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:27.379569054 CEST6217653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:27.430699110 CEST53621768.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:28.325726032 CEST5959653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:28.377069950 CEST53595968.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:30.475465059 CEST6529653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:30.527209044 CEST53652968.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:31.631347895 CEST6318353192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:31.683028936 CEST53631838.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:32.796655893 CEST6015153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:32.848305941 CEST53601518.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:36.018026114 CEST5696953192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:36.067061901 CEST53569698.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:21:45.304126978 CEST5516153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:21:45.387736082 CEST53551618.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:22:09.296978951 CEST5475753192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:22:09.377091885 CEST53547578.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:22:10.297214985 CEST4999253192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:22:10.348773003 CEST53499928.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:22:17.959539890 CEST6007553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:22:18.020986080 CEST53600758.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:22:18.121637106 CEST5501653192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:22:18.170644999 CEST53550168.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:22:27.177175999 CEST6434553192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:22:27.235286951 CEST53643458.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:22:53.475148916 CEST5712853192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:22:53.534316063 CEST53571288.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:23:00.742816925 CEST5479153192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:23:00.801660061 CEST53547918.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:23:13.930670023 CEST5046353192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:23:14.001513004 CEST53504638.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:23:28.057881117 CEST5039453192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:23:28.110372066 CEST53503948.8.8.8192.168.2.5
                                                                                                                              May 13, 2021 07:23:33.788625002 CEST5853053192.168.2.58.8.8.8
                                                                                                                              May 13, 2021 07:23:33.846060038 CEST53585308.8.8.8192.168.2.5

                                                                                                                              Code Manipulations

                                                                                                                              Statistics

                                                                                                                              CPU Usage

                                                                                                                              Click to jump to process

                                                                                                                              Memory Usage

                                                                                                                              Click to jump to process

                                                                                                                              High Level Behavior Distribution

                                                                                                                              Click to dive into process behavior distribution

                                                                                                                              Behavior

                                                                                                                              Click to jump to process

                                                                                                                              System Behavior

                                                                                                                              General

                                                                                                                              Start time:07:21:30
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\System32\loaddll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:loaddll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll'
                                                                                                                              Imagebase:0xd30000
                                                                                                                              File size:116736 bytes
                                                                                                                              MD5 hash:542795ADF7CC08EFCF675D65310596E8
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:07:21:30
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x150000
                                                                                                                              File size:232960 bytes
                                                                                                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:07:21:31
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:rundll32.exe 'C:\Users\user\Desktop\8b521700_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x1040000
                                                                                                                              File size:61952 bytes
                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Yara matches:
                                                                                                                              • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.325566919.0000000010001000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:07:21:59
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 764
                                                                                                                              Imagebase:0x60000
                                                                                                                              File size:434592 bytes
                                                                                                                              MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              Disassembly

                                                                                                                              Code Analysis

                                                                                                                              Reset < >

                                                                                                                                Executed Functions

                                                                                                                                Non-executed Functions

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000000.00000002.235831446.0000000010021000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000000.00000002.235813049.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.235817151.0000000010001000.00000020.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.235836875.0000000010025000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.235841675.0000000010028000.00000008.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.235850916.000000001002C000.00000002.00020000.sdmp Download File
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: D$a$c$i$l$l$o$t$u
                                                                                                                                • API String ID: 0-1871623029
                                                                                                                                • Opcode ID: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction ID: 0084815472b1379f451f328db7bdd48fedf0434f01950e1a6ab525a79fee850b
                                                                                                                                • Opcode Fuzzy Hash: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction Fuzzy Hash: 6142A774608780CFD374CF28C894BDABBE1ABD9354F54892EE48D8B391E731A845CB56
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Executed Functions

                                                                                                                                C-Code - Quality: 42%
                                                                                                                                			E001A23D4(long __ebx, void* __edi, long __esi, intOrPtr* _a4) {
                                                                                                                                				char _v20;
                                                                                                                                				intOrPtr _v24;
                                                                                                                                				intOrPtr _v28;
                                                                                                                                				intOrPtr _v32;
                                                                                                                                				intOrPtr _v36;
                                                                                                                                				intOrPtr _v40;
                                                                                                                                				char _v44;
                                                                                                                                				intOrPtr _v48;
                                                                                                                                				intOrPtr _v52;
                                                                                                                                				intOrPtr _v56;
                                                                                                                                				intOrPtr _v60;
                                                                                                                                				intOrPtr _v64;
                                                                                                                                				void* _v68;
                                                                                                                                				char* _v72;
                                                                                                                                				int _v76;
                                                                                                                                				long _v80;
                                                                                                                                				long _v84;
                                                                                                                                				DWORD* _v88;
                                                                                                                                				intOrPtr _v92;
                                                                                                                                				int _v96;
                                                                                                                                				intOrPtr* _v100;
                                                                                                                                				intOrPtr _v104;
                                                                                                                                				intOrPtr _v108;
                                                                                                                                				intOrPtr _v112;
                                                                                                                                				void* _v116;
                                                                                                                                				intOrPtr _v120;
                                                                                                                                				intOrPtr _v124;
                                                                                                                                				intOrPtr _v128;
                                                                                                                                				intOrPtr _v132;
                                                                                                                                				intOrPtr _v136;
                                                                                                                                				char* _v140;
                                                                                                                                				intOrPtr _v144;
                                                                                                                                				intOrPtr _v148;
                                                                                                                                				intOrPtr _v152;
                                                                                                                                				intOrPtr _v156;
                                                                                                                                				unsigned int _v160;
                                                                                                                                				signed int _v164;
                                                                                                                                				signed int _v168;
                                                                                                                                				signed int _v172;
                                                                                                                                				intOrPtr _v176;
                                                                                                                                				int _v180;
                                                                                                                                				char* _v184;
                                                                                                                                				intOrPtr _v188;
                                                                                                                                				intOrPtr _v192;
                                                                                                                                				char _v196;
                                                                                                                                				intOrPtr* _t142;
                                                                                                                                				int _t148;
                                                                                                                                				int _t156;
                                                                                                                                				int _t160;
                                                                                                                                				unsigned int _t180;
                                                                                                                                				int _t196;
                                                                                                                                				intOrPtr _t230;
                                                                                                                                				intOrPtr _t232;
                                                                                                                                				void* _t237;
                                                                                                                                				intOrPtr _t240;
                                                                                                                                				void* _t247;
                                                                                                                                				intOrPtr _t251;
                                                                                                                                				intOrPtr _t258;
                                                                                                                                				DWORD* _t271;
                                                                                                                                				void* _t275;
                                                                                                                                				intOrPtr* _t278;
                                                                                                                                				intOrPtr* _t279;
                                                                                                                                
                                                                                                                                				_t142 = _a4;
                                                                                                                                				_v20 = 0;
                                                                                                                                				_t247 =  *_t142;
                                                                                                                                				 *0x1a4418 = 1;
                                                                                                                                				asm("movaps xmm0, [0x1a3010]");
                                                                                                                                				asm("movups [0x1a4428], xmm0");
                                                                                                                                				_v48 = _t142;
                                                                                                                                				_v52 =  *((intOrPtr*)(_t142 + 0x48));
                                                                                                                                				_v56 =  *((intOrPtr*)(_v48 + 0x6c));
                                                                                                                                				_v196 = _t247;
                                                                                                                                				_v192 =  *((intOrPtr*)(_v48 + 0x24));
                                                                                                                                				_v188 = 4;
                                                                                                                                				_v184 =  &_v20;
                                                                                                                                				_v60 =  *((intOrPtr*)(_t142 + 0x1c));
                                                                                                                                				_v64 = 4;
                                                                                                                                				_v68 = _t247;
                                                                                                                                				_v72 =  &_v20;
                                                                                                                                				_t148 = VirtualProtect(__edi, __esi, __ebx, _t271); // executed
                                                                                                                                				_v76 = _t148;
                                                                                                                                				_v196 = _v68;
                                                                                                                                				_v192 = 0;
                                                                                                                                				_v188 =  *((intOrPtr*)(_v48 + 0x24));
                                                                                                                                				_v80 = 0x400;
                                                                                                                                				_v84 = 2;
                                                                                                                                				_v88 =  &_v20;
                                                                                                                                				_v92 = 0;
                                                                                                                                				E001A1E7B();
                                                                                                                                				E001A1094(_v68,  *((intOrPtr*)(_v48 + 0x44)), _v56);
                                                                                                                                				E001A1E7B( *((intOrPtr*)(_v48 + 0x44)), 0, _v56);
                                                                                                                                				_t156 = VirtualProtect(_v68, 0x400, 2, _v88); // executed
                                                                                                                                				_t278 = _t275 - 0x94;
                                                                                                                                				_t237 = _v68;
                                                                                                                                				_t258 =  *((intOrPtr*)(_t237 + 0x3c));
                                                                                                                                				_v96 = _t156;
                                                                                                                                				_v100 = _v68 + 0x3c;
                                                                                                                                				_v104 = _t237;
                                                                                                                                				_v108 = _t258;
                                                                                                                                				if(_t258 != 0) {
                                                                                                                                					_v104 = _v68 + (_v108 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                				}
                                                                                                                                				_v120 = _v104;
                                                                                                                                				if(_v52 != 0) {
                                                                                                                                					_v144 = _v120 + 0x18 + ( *(_v120 + 0x14) & 0x0000ffff);
                                                                                                                                					_v148 = 0;
                                                                                                                                					while(1) {
                                                                                                                                						_t230 = _v144;
                                                                                                                                						_v156 = _v148;
                                                                                                                                						_t180 =  *(_t230 + 0x24);
                                                                                                                                						_v160 = _t180;
                                                                                                                                						_v164 = _t180 >> 0x1e;
                                                                                                                                						_v168 = _v160 >> 0x1f;
                                                                                                                                						_v172 = _v160 >> 0x0000001d & 0x00000001;
                                                                                                                                						_v196 = _v68 +  *((intOrPtr*)(_t230 + 0xc));
                                                                                                                                						_v192 =  *((intOrPtr*)(_t230 + 8));
                                                                                                                                						_v188 =  *((intOrPtr*)(0x1a4418 + ((_v164 & 0x00000001) << 4) + (_v168 << 3) + (_v172 << 2)));
                                                                                                                                						_v184 =  &_v20;
                                                                                                                                						_v176 = _t230;
                                                                                                                                						_t196 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                                                						_t278 = _t278 - 0x10;
                                                                                                                                						_t232 = _v156 + 1;
                                                                                                                                						_v180 = _t196;
                                                                                                                                						_v144 = _v176 + 0x28;
                                                                                                                                						_v148 = _t232;
                                                                                                                                						if(_t232 == _v52) {
                                                                                                                                							goto L11;
                                                                                                                                						}
                                                                                                                                					}
                                                                                                                                				}
                                                                                                                                				L11:
                                                                                                                                				 *_t278 = _v68;
                                                                                                                                				_v124 = _v68 +  *((intOrPtr*)(_v48 + 0x10));
                                                                                                                                				_t160 = DisableThreadLibraryCalls(??);
                                                                                                                                				_t279 = _t278 - 4;
                                                                                                                                				_t240 =  *_v100;
                                                                                                                                				_v152 = _t160;
                                                                                                                                				_v112 = _t240;
                                                                                                                                				_v116 = _v68;
                                                                                                                                				if(_t240 == 0) {
                                                                                                                                					L7:
                                                                                                                                					_t251 = _v48;
                                                                                                                                					_v44 =  *((intOrPtr*)(_t251 + 0x40));
                                                                                                                                					_v40 =  *((intOrPtr*)(_t251 + 0x4c));
                                                                                                                                					_v36 =  *((intOrPtr*)(_t251 + 0x20));
                                                                                                                                					_v32 =  *((intOrPtr*)(_t251 + 0x54));
                                                                                                                                					_v28 =  *((intOrPtr*)(_t251 + 0x58));
                                                                                                                                					_v24 = _v124;
                                                                                                                                					 *_t279 = _t251;
                                                                                                                                					_v196 = 0;
                                                                                                                                					_v192 = 0x74;
                                                                                                                                					_v128 =  *((intOrPtr*)(_v116 + 0x28));
                                                                                                                                					_v132 = 0;
                                                                                                                                					_v136 = 0x74;
                                                                                                                                					_v140 =  &_v44;
                                                                                                                                					E001A1E7B();
                                                                                                                                					if(_v128 != 0) {
                                                                                                                                						_t278 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                                                						goto __eax;
                                                                                                                                					}
                                                                                                                                					return 1;
                                                                                                                                				} else {
                                                                                                                                					_v116 = _v68 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                					goto L7;
                                                                                                                                				}
                                                                                                                                			}

































































                                                                                                                                0x001a23e0
                                                                                                                                0x001a23ee
                                                                                                                                0x001a23f5
                                                                                                                                0x001a23f7
                                                                                                                                0x001a2401
                                                                                                                                0x001a2408
                                                                                                                                0x001a2412
                                                                                                                                0x001a2418
                                                                                                                                0x001a2421
                                                                                                                                0x001a242a
                                                                                                                                0x001a242d
                                                                                                                                0x001a2431
                                                                                                                                0x001a2439
                                                                                                                                0x001a243d
                                                                                                                                0x001a2440
                                                                                                                                0x001a2443
                                                                                                                                0x001a2446
                                                                                                                                0x001a2449
                                                                                                                                0x001a2463
                                                                                                                                0x001a2469
                                                                                                                                0x001a246c
                                                                                                                                0x001a2474
                                                                                                                                0x001a2478
                                                                                                                                0x001a247b
                                                                                                                                0x001a247e
                                                                                                                                0x001a2481
                                                                                                                                0x001a2484
                                                                                                                                0x001a24a0
                                                                                                                                0x001a24bd
                                                                                                                                0x001a24e2
                                                                                                                                0x001a24e4
                                                                                                                                0x001a24ed
                                                                                                                                0x001a24f0
                                                                                                                                0x001a24fa
                                                                                                                                0x001a24fd
                                                                                                                                0x001a2500
                                                                                                                                0x001a2503
                                                                                                                                0x001a2506
                                                                                                                                0x001a255a
                                                                                                                                0x001a255a
                                                                                                                                0x001a2566
                                                                                                                                0x001a2569
                                                                                                                                0x001a25ed
                                                                                                                                0x001a25f3
                                                                                                                                0x001a265e
                                                                                                                                0x001a2664
                                                                                                                                0x001a2679
                                                                                                                                0x001a267f
                                                                                                                                0x001a2682
                                                                                                                                0x001a268b
                                                                                                                                0x001a269a
                                                                                                                                0x001a26ac
                                                                                                                                0x001a26dd
                                                                                                                                0x001a26e0
                                                                                                                                0x001a26e4
                                                                                                                                0x001a26e8
                                                                                                                                0x001a26ef
                                                                                                                                0x001a26f5
                                                                                                                                0x001a26f7
                                                                                                                                0x001a2700
                                                                                                                                0x001a2711
                                                                                                                                0x001a2717
                                                                                                                                0x001a271d
                                                                                                                                0x001a2723
                                                                                                                                0x00000000
                                                                                                                                0x00000000
                                                                                                                                0x001a2729
                                                                                                                                0x001a265e
                                                                                                                                0x001a261a
                                                                                                                                0x001a2628
                                                                                                                                0x001a2630
                                                                                                                                0x001a2633
                                                                                                                                0x001a2635
                                                                                                                                0x001a263b
                                                                                                                                0x001a2647
                                                                                                                                0x001a264d
                                                                                                                                0x001a2650
                                                                                                                                0x001a2653
                                                                                                                                0x001a2571
                                                                                                                                0x001a2581
                                                                                                                                0x001a2587
                                                                                                                                0x001a258d
                                                                                                                                0x001a2593
                                                                                                                                0x001a2599
                                                                                                                                0x001a259f
                                                                                                                                0x001a25a5
                                                                                                                                0x001a25a8
                                                                                                                                0x001a25ab
                                                                                                                                0x001a25b3
                                                                                                                                0x001a25bb
                                                                                                                                0x001a25be
                                                                                                                                0x001a25c1
                                                                                                                                0x001a25c7
                                                                                                                                0x001a25cd
                                                                                                                                0x001a25d8
                                                                                                                                0x001a2532
                                                                                                                                0x001a2538
                                                                                                                                0x001a2538
                                                                                                                                0x001a2614
                                                                                                                                0x001a2659
                                                                                                                                0x001a251f
                                                                                                                                0x00000000
                                                                                                                                0x001a251f

                                                                                                                                APIs
                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.323385010.00000000001A0000.00000040.00000001.sdmp, Offset: 001A0000, based on PE: true
                                                                                                                                Similarity
                                                                                                                                • API ID: ProtectVirtual
                                                                                                                                • String ID: t
                                                                                                                                • API String ID: 544645111-2238339752
                                                                                                                                • Opcode ID: 7a8042b966a9d50a69dc5d959baf0a21e4e24744685021e496eab3033123171c
                                                                                                                                • Instruction ID: 4101c244cea0b08ed41ae7e9842a93c869606e34e5ec75906259536381c66e8d
                                                                                                                                • Opcode Fuzzy Hash: 7a8042b966a9d50a69dc5d959baf0a21e4e24744685021e496eab3033123171c
                                                                                                                                • Instruction Fuzzy Hash: 1DB1ACB4E04218CFDB14CF68C980A9DFBF1BF89300F1585AAE958AB351D730A981CF91
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                APIs
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.323385010.00000000001A0000.00000040.00000001.sdmp, Offset: 001A0000, based on PE: true
                                                                                                                                Similarity
                                                                                                                                • API ID: AllocVirtual
                                                                                                                                • String ID:
                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                • Opcode ID: 033d263155ffc3d0b6236b8629689c658cf4e2d9a96ebed7f8aabdbc96411034
                                                                                                                                • Instruction ID: 5c0a8d157a8993cc3f756d8bd7c7c893ce2a0d370f170dea66e3b42fda0bddc5
                                                                                                                                • Opcode Fuzzy Hash: 033d263155ffc3d0b6236b8629689c658cf4e2d9a96ebed7f8aabdbc96411034
                                                                                                                                • Instruction Fuzzy Hash: 5D41D3B5D052199FDB08DFA8D890AAEBBF1FF48314F15852DE948AB340D375A845CF84
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Non-executed Functions

                                                                                                                                C-Code - Quality: 100%
                                                                                                                                			E10006D50() {
                                                                                                                                
                                                                                                                                				 *0x1001d280 = GetUserNameW;
                                                                                                                                				 *0x1001D284 = MessageBoxW;
                                                                                                                                				 *0x1001D288 = GetLastError;
                                                                                                                                				 *0x1001D28C = CreateFileA;
                                                                                                                                				 *0x1001D290 = DebugBreak;
                                                                                                                                				 *0x1001D294 = FlushFileBuffers;
                                                                                                                                				 *0x1001D298 = FreeEnvironmentStringsA;
                                                                                                                                				 *0x1001D29C = GetConsoleOutputCP;
                                                                                                                                				 *0x1001D2A0 = GetEnvironmentStrings;
                                                                                                                                				 *0x1001D2A4 = GetLocaleInfoA;
                                                                                                                                				 *0x1001D2A8 = GetStartupInfoA;
                                                                                                                                				 *0x1001D2AC = GetStringTypeA;
                                                                                                                                				 *0x1001D2B0 = HeapValidate;
                                                                                                                                				 *0x1001D2B4 = IsBadReadPtr;
                                                                                                                                				 *0x1001D2B8 = LCMapStringA;
                                                                                                                                				 *0x1001D2BC = LoadLibraryA;
                                                                                                                                				 *0x1001D2C0 = OutputDebugStringA;
                                                                                                                                				return 0x1001d280;
                                                                                                                                			}



                                                                                                                                0x10006d61
                                                                                                                                0x10006d69
                                                                                                                                0x10006d6c
                                                                                                                                0x10006d7b
                                                                                                                                0x10006d7e
                                                                                                                                0x10006d8d
                                                                                                                                0x10006d90
                                                                                                                                0x10006d9f
                                                                                                                                0x10006da2
                                                                                                                                0x10006db1
                                                                                                                                0x10006db4
                                                                                                                                0x10006dc3
                                                                                                                                0x10006dc6
                                                                                                                                0x10006dd5
                                                                                                                                0x10006dd8
                                                                                                                                0x10006de7
                                                                                                                                0x10006dea
                                                                                                                                0x10006ded

                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.325566919.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.325556317.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.325612859.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.325628003.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.325643920.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID:
                                                                                                                                • API String ID:
                                                                                                                                • Opcode ID: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction ID: 9a9f90be372116ce35b3bf57ca6adafecb814b37ff7dc50591bd4b03753dcc6b
                                                                                                                                • Opcode Fuzzy Hash: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction Fuzzy Hash: 99110FB8A05620CFD34ACF09D5D49117BF2BB8E360312C19AD8098B376D734D985CF54
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                C-Code - Quality: 83%
                                                                                                                                			E1000C218(void* __ecx, void* __edx) {
                                                                                                                                				char _v28;
                                                                                                                                				char _v33;
                                                                                                                                				char _v38;
                                                                                                                                				char _v43;
                                                                                                                                				void* _t24;
                                                                                                                                				char* _t25;
                                                                                                                                				char _t32;
                                                                                                                                				void* _t33;
                                                                                                                                				void* _t34;
                                                                                                                                				signed int _t38;
                                                                                                                                				char* _t40;
                                                                                                                                
                                                                                                                                				_t40 = (_t38 & 0xfffffff0) - 0x2c;
                                                                                                                                				asm("movq xmm0, [edx]");
                                                                                                                                				_t32 = 0;
                                                                                                                                				 *_t40 = 0x7b;
                                                                                                                                				asm("movq [esp+0x1], xmm0");
                                                                                                                                				_v43 = 0x2d;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t32 + 0xa)) =  *((intOrPtr*)(_t32 + __edx + 8));
                                                                                                                                					_t32 = _t32 + 1;
                                                                                                                                				} while (_t32 < 4);
                                                                                                                                				_v38 = 0x2d;
                                                                                                                                				_t33 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t33 + 0xf)) =  *((intOrPtr*)(_t33 + __edx + 0xc));
                                                                                                                                					_t33 = _t33 + 1;
                                                                                                                                				} while (_t33 < 4);
                                                                                                                                				_v33 = 0x2d;
                                                                                                                                				_t34 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t34 + 0x14)) =  *((intOrPtr*)(_t34 + __edx + 0x10));
                                                                                                                                					_t34 = _t34 + 1;
                                                                                                                                				} while (_t34 < 4);
                                                                                                                                				_v28 = 0x2d;
                                                                                                                                				_t24 = 0;
                                                                                                                                				do {
                                                                                                                                					asm("movd xmm0, dword [eax+edx+0x14]");
                                                                                                                                					asm("movd [esp+eax+0x19], xmm0");
                                                                                                                                					_t24 = _t24 + 4;
                                                                                                                                				} while (_t24 < 0xc);
                                                                                                                                				_t25 = _t40;
                                                                                                                                				 *((char*)(_t25 + 0x25)) = 0x7d;
                                                                                                                                				 *((char*)(_t25 + 0x26)) = 0;
                                                                                                                                				E1000DFBC(__ecx, _t25, 0);
                                                                                                                                				return __ecx;
                                                                                                                                			}














                                                                                                                                0x1000c21f
                                                                                                                                0x1000c224
                                                                                                                                0x1000c228
                                                                                                                                0x1000c22a
                                                                                                                                0x1000c22e
                                                                                                                                0x1000c234
                                                                                                                                0x1000c239
                                                                                                                                0x1000c23d
                                                                                                                                0x1000c241
                                                                                                                                0x1000c242
                                                                                                                                0x1000c249
                                                                                                                                0x1000c24e
                                                                                                                                0x1000c250
                                                                                                                                0x1000c254
                                                                                                                                0x1000c258
                                                                                                                                0x1000c259
                                                                                                                                0x1000c260
                                                                                                                                0x1000c265
                                                                                                                                0x1000c267
                                                                                                                                0x1000c26b
                                                                                                                                0x1000c26f
                                                                                                                                0x1000c270
                                                                                                                                0x1000c275
                                                                                                                                0x1000c27a
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c282
                                                                                                                                0x1000c288
                                                                                                                                0x1000c28b
                                                                                                                                0x1000c292
                                                                                                                                0x1000c295
                                                                                                                                0x1000c29b
                                                                                                                                0x1000c2a0
                                                                                                                                0x1000c2ae

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.325566919.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.325556317.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.325612859.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.325628003.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.325643920.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: -$-$-$-
                                                                                                                                • API String ID: 0-1033403326
                                                                                                                                • Opcode ID: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction ID: 6420cdf91b2b9fc5655fa5f82b4c53aa5eb92ddd4154ae73ebf41adf494228f8
                                                                                                                                • Opcode Fuzzy Hash: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction Fuzzy Hash: C811252091C3C04CE749DB7C548462BFFD08F9A208F1886BEE4DA86B53E525D49683B7
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%