Loading ...

Play interactive tourEdit tour

Analysis Report 7587f225_by_Libranalysis

Overview

General Information

Sample Name:7587f225_by_Libranalysis (renamed file extension from none to dll)
Analysis ID:413064
MD5:7587f225f8e2da52308a97f7df04d1f7
SHA1:badcfb611d6978526673c39bf9d179ac74d95890
SHA256:5f19ffeafabe9b3271411cb543a58764d3798d69f47f6e2c798827c99eafc648
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • loaddll32.exe (PID: 6668 cmdline: loaddll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 6680 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 6696 cmdline: rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 6260 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 764 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22202, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "UlufoCqJDohDzGOdBY6ldd1IbFW5KV8BqCAnkqwdDzvq0CsZOOngL"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.739761197.0000000010001000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    2.2.rundll32.exe.10000000.3.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Found malware configurationShow sources
      Source: 2.2.rundll32.exe.10000000.3.unpackMalware Configuration Extractor: Dridex {"Version": 22202, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "UlufoCqJDohDzGOdBY6ldd1IbFW5KV8BqCAnkqwdDzvq0CsZOOngL"]}
      Machine Learning detection for sampleShow sources
      Source: 7587f225_by_Libranalysis.dllJoe Sandbox ML: detected
      Source: 7587f225_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 7587f225_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: oleaut32.pdb[Q"@ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb6G source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdbz source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.716449185.0000000000765000.00000004.00000001.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: cryptbase.pdbgQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.716444261.000000000075F000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdbEQ4@r source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdbz source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.719121031.000000000076B000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: rasman.pdb,G source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb*G source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdbQQ(@t source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000E.00000003.716444261.000000000075F000.00000004.00000001.sdmp
      Source: Binary string: winspool.pdbuQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdbOQ.@ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.643733888.0000000010025000.00000002.00020000.sdmp, 7587f225_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: propsys.pdbsQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000E.00000003.719121031.000000000076B000.00000004.00000001.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000E.00000003.716449185.0000000000765000.00000004.00000001.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdby source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: sechost.pdb]Q source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdbiQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp

      Networking:

      barindex
      C2 URLs / IPs found in malware configurationShow sources
      Source: Malware configuration extractorIPs: 43.229.206.212:443
      Source: Malware configuration extractorIPs: 82.209.17.209:8172
      Source: Malware configuration extractorIPs: 162.241.209.225:4125
      Source: Joe Sandbox ViewIP Address: 82.209.17.209 82.209.17.209
      Source: Joe Sandbox ViewIP Address: 162.241.209.225 162.241.209.225
      Source: Joe Sandbox ViewIP Address: 43.229.206.212 43.229.206.212
      Source: Joe Sandbox ViewASN Name: PODA-ASCZ PODA-ASCZ
      Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
      Source: Joe Sandbox ViewASN Name: INET-AS-IDPTInetGlobalIndoID INET-AS-IDPTInetGlobalIndoID
      Source: WerFault.exe, 0000000E.00000003.735574945.00000000045A2000.00000004.00000001.sdmpString found in binary or memory: http://crl.microsoft

      E-Banking Fraud:

      barindex
      Yara detected Dridex unpacked fileShow sources
      Source: Yara matchFile source: 00000002.00000002.739761197.0000000010001000.00000020.00020000.sdmp, type: MEMORY
      Source: Yara matchFile source: 2.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10021E900_2_10021E90
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100114602_2_10011460
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000846C2_2_1000846C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100014942_2_10001494
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000A52C2_2_1000A52C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10011D582_2_10011D58
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100193482_2_10019348
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100107542_2_10010754
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100090CC2_2_100090CC
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 764
      Source: 7587f225_by_Libranalysis.dllBinary or memory string: OriginalFilenamex2otfb.dllN vs 7587f225_by_Libranalysis.dll
      Source: 7587f225_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 7587f225_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: classification engineClassification label: mal64.troj.winDLL@6/4@0/3
      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6696
      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER67B4.tmpJump to behavior
      Source: 7587f225_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1
      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll'
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 764
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1Jump to behavior
      Source: 7587f225_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: 7587f225_by_Libranalysis.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: oleaut32.pdb[Q"@ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb6G source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdbz source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ClusApi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000E.00000003.716449185.0000000000765000.00000004.00000001.sdmp
      Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: cryptbase.pdbgQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb source: WerFault.exe, 0000000E.00000003.716444261.000000000075F000.00000004.00000001.sdmp
      Source: Binary string: shcore.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: rundll32.pdbk source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: sfc_os.pdbEQ4@r source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdbz source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shell32.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: dnsapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000E.00000003.719121031.000000000076B000.00000004.00000001.sdmp
      Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: rasman.pdb,G source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: dnsapi.pdb*G source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shlwapi.pdbQQ(@t source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wntdll.pdb( source: WerFault.exe, 0000000E.00000003.716444261.000000000075F000.00000004.00000001.sdmp
      Source: Binary string: winspool.pdbuQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: winspool.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: sechost.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: rasapi32.pdbOQ.@ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: rasman.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: nsi.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: propsys.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.643733888.0000000010025000.00000002.00020000.sdmp, 7587f225_by_Libranalysis.dll
      Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: msctf.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: ole32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: propsys.pdbsQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000E.00000003.719121031.000000000076B000.00000004.00000001.sdmp
      Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: combase.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: wkernel32.pdb( source: WerFault.exe, 0000000E.00000003.716449185.0000000000765000.00000004.00000001.sdmp
      Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: sfc.pdb source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: mpr.pdby source: WerFault.exe, 0000000E.00000003.723819330.0000000004C10000.00000004.00000040.sdmp
      Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000E.00000003.723797884.0000000004B11000.00000004.00000001.sdmp
      Source: Binary string: sechost.pdb]Q source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: Binary string: profapi.pdbiQ source: WerFault.exe, 0000000E.00000003.723861501.0000000004C16000.00000004.00000040.sdmp
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10007550 push ebp; ret 0_2_10007557
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000F6CC push esi; mov dword ptr [esp], 00000000h2_2_1000F6CD
      Source: initial sampleStatic PE information: section name: .text entropy: 7.52981613282
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: WerFault.exe, 0000000E.00000002.737370323.0000000004680000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
      Source: WerFault.exe, 0000000E.00000002.736251756.00000000006A8000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
      Source: WerFault.exe, 0000000E.00000002.737370323.0000000004680000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
      Source: WerFault.exe, 0000000E.00000002.737370323.0000000004680000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
      Source: WerFault.exe, 0000000E.00000002.737513488.0000000004870000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW`
      Source: WerFault.exe, 0000000E.00000002.736251756.00000000006A8000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAWNative MAC Layer LightWeight Filter-0000
      Source: WerFault.exe, 0000000E.00000002.737370323.0000000004680000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection11Virtualization/Sandbox Evasion1OS Credential DumpingSecurity Software Discovery21Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRundll321LSASS MemoryVirtualization/Sandbox Evasion1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Software Packing2Security Account ManagerAccount Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection11NTDSSystem Owner/User Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information2LSA SecretsSystem Information Discovery11SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      7587f225_by_Libranalysis.dll100%Joe Sandbox ML

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      2.2.rundll32.exe.30f0000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File

      Domains

      No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://crl.microsoft0%URL Reputationsafe
      http://crl.microsoft0%URL Reputationsafe
      http://crl.microsoft0%URL Reputationsafe
      http://crl.microsoft0%URL Reputationsafe

      Domains and IPs

      Contacted Domains

      No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://crl.microsoftWerFault.exe, 0000000E.00000003.735574945.00000000045A2000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      unknown

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      82.209.17.209
      unknownCzech Republic
      30764PODA-ASCZtrue
      162.241.209.225
      unknownUnited States
      46606UNIFIEDLAYER-AS-1UStrue
      43.229.206.212
      unknownIndonesia
      24532INET-AS-IDPTInetGlobalIndoIDtrue

      General Information

      Joe Sandbox Version:32.0.0 Black Diamond
      Analysis ID:413064
      Start date:13.05.2021
      Start time:07:21:23
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 6m 18s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:7587f225_by_Libranalysis (renamed file extension from none to dll)
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:25
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal64.troj.winDLL@6/4@0/3
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 94% (good quality ratio 84.2%)
      • Quality average: 68.9%
      • Quality standard deviation: 34%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 3
      • Number of non-executed functions: 4
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI

      Simulations

      Behavior and APIs

      TimeTypeDescription
      07:22:52API Interceptor1x Sleep call for process: WerFault.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      82.209.17.20994a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
        a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
          4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
            0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                    fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                        4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                          a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                            cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                    6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                        052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                          fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                            5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                              162.241.209.22594a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                  4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                    0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                      cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                        2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                          86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                            fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                  a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                      4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                        27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                          86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                            6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                  fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                    5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                      43.229.206.21294a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                        a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                          4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                            0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                    fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                        4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                          a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                            cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                  86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                    6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                      13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                        052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                          fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                            5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse

                                                                                                                              Domains

                                                                                                                              No context

                                                                                                                              ASN

                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                              PODA-ASCZ94a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              INET-AS-IDPTInetGlobalIndoID94a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              UNIFIEDLAYER-AS-1US94a4d66c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              0f72be74_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              2a71d07d_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              4bfaad72_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              a194019c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              cdc733ac_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              4e021da2_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              27c06d28_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              86fa0c16_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              6bea48e8_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              13f88d67_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              052a78c5_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              fe1d4238_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              5322b76c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225

                                                                                                                              JA3 Fingerprints

                                                                                                                              No context

                                                                                                                              Dropped Files

                                                                                                                              No context

                                                                                                                              Created / dropped Files

                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_36c34591d0260dac04d5ae147c5cb91369e236_82810a17_181d8435\Report.wer
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):12478
                                                                                                                              Entropy (8bit):3.767728681173746
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:Y+lEi30oXGSHBUZMX4jed+hG/u7sZS274ItWcM:REiJXjBUZMX4jed/u7sZX4ItWcM
                                                                                                                              MD5:08D3C04B37CD49B0E8EF03B019D58986
                                                                                                                              SHA1:8294762494D433F3247BCC0C1410C94C2F3A088F
                                                                                                                              SHA-256:40EF543A1E8D0165717D7D5A6750A1024C42690C097D34F39E5BD6429D023F5D
                                                                                                                              SHA-512:FF243082E28545D778E6354A2CAC856AEFFB31A8BCAF5FC4D6E70AC07E5817E5ADB94230FAB541D13594D97D012E8BCC680BEED0111E6799499327094D221DCA
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.5.3.5.6.9.6.5.4.0.7.3.5.9.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.5.3.5.6.9.7.0.7.9.7.9.6.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.a.9.d.d.3.6.-.2.a.f.e.-.4.0.b.0.-.9.d.f.4.-.f.3.7.3.a.4.3.c.a.c.8.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.b.1.3.0.2.3.-.f.a.4.7.-.4.4.9.e.-.a.c.9.f.-.e.b.2.d.b.b.0.8.c.9.2.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.2.8.-.0.0.0.1.-.0.0.1.b.-.5.c.9.a.-.3.7.e.c.b.7.4.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER67B4.tmp.dmp
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Mini DuMP crash report, 14 streams, Thu May 13 05:22:47 2021, 0x1205a4 type
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):41726
                                                                                                                              Entropy (8bit):2.241700066742228
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:ULY5MHXNlr0j5+UrgGAIy2/aPHsUuOTjirXT7bIDognotp:aY5GY8ka/NRirXbIEgotp
                                                                                                                              MD5:0C2A8833251AE6EA7EC95CEE09BF9190
                                                                                                                              SHA1:B9374A742FA78A1C4D5BC82EA09E79A87832CB42
                                                                                                                              SHA-256:BC93F20B63868EC899C1879120C119AA0F97509BE0BD2FFC4F2BA91EBD88177B
                                                                                                                              SHA-512:C3D436F9AA741C92F19AE67AC3B18C54AFD61B801A7272938559A278568E9BC37102CADD902A91243FC2022570FBDE48E6E17D8431E42B6CD5FFCC14ED4E5A44
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: MDMP....... ..........`...................U...........B......x.......GenuineIntelW...........T.......(......`.............................0..=...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F17.tmp.WERInternalMetadata.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):8294
                                                                                                                              Entropy (8bit):3.697386728780599
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:Rrl7r3GLNiib63u6YTb6AXgmfTkLSEX+pr189bCmsfazWm:RrlsNiG6e6YP6AXgmfT+SExCFf0
                                                                                                                              MD5:31654A56036EEE4B9CCA2C8B0D5E1746
                                                                                                                              SHA1:3E90B8F57A7A7D644230716D747974AD4D2CA2A1
                                                                                                                              SHA-256:AB5E290B6D58552C0AF0E5C7B0C5D01BA7AB980485558798001B27F73EFB533D
                                                                                                                              SHA-512:78DC0FBD4663416A5DB51D088C3A3A6B3947748B163E8F315A9C4FBB7C4F84206FF38BD86DCE1E0998E9B30E595DD70CA23CB795D7CF3FCF9D76F385951DB3BE
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.9.6.<./.P.i.d.>.......
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER71A9.tmp.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):4663
                                                                                                                              Entropy (8bit):4.47739651698539
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:48:cvIwSD8zsIJgtWI9m4WSC8BP8fm8M4JCdsENpFGPl+q8/FNF14SrSkd:uITfOBxSNWJSN+liN7DWkd
                                                                                                                              MD5:7FC18CA585860EC2576DD54E3FA033FF
                                                                                                                              SHA1:D4ED934265B2843316A386F38F316562E2698C39
                                                                                                                              SHA-256:19EE2B6B136146F8F30C66CC43D6AE4060FD6832AF31A8E373F7A35EF0B4E2BE
                                                                                                                              SHA-512:30670FAEE2F1AC9C300DF1FADE2E7BBC907EFD66220614052966B80D97DB5926A1A2C27CB6DED7C3CB4FB564A13937F42F9817D1EFEA090D086F48AA9001FB3D
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="987273" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                                                                              Static File Info

                                                                                                                              General

                                                                                                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                              Entropy (8bit):7.510335149747457
                                                                                                                              TrID:
                                                                                                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                              • DOS Executable Generic (2002/1) 0.20%
                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                              File name:7587f225_by_Libranalysis.dll
                                                                                                                              File size:167424
                                                                                                                              MD5:7587f225f8e2da52308a97f7df04d1f7
                                                                                                                              SHA1:badcfb611d6978526673c39bf9d179ac74d95890
                                                                                                                              SHA256:5f19ffeafabe9b3271411cb543a58764d3798d69f47f6e2c798827c99eafc648
                                                                                                                              SHA512:a7ef8f39e93589fcea2a80043b9102698f1b6c58d34ed7ade9f91f05cd03cf20da04491c62424ca7a0ecf44190b647d1ce42591e4fe8494d4bb92df239e9af83
                                                                                                                              SSDEEP:3072:nar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Rs4p+ADxnSO6D2cOp
                                                                                                                              File Content Preview:MZ......................@...................................\...........!..L.!This program cannot be run in DOS mode....$.......Xm.o...<...<...<.U!<...<..B<r..<...<...<rQ!<...<;..<...<;..<3..<au.<...<szt<"..<Rich...<.......................................

                                                                                                                              File Icon

                                                                                                                              Icon Hash:74f0e4ecccdce0e4

                                                                                                                              Static PE Info

                                                                                                                              General

                                                                                                                              Entrypoint:0x10024b60
                                                                                                                              Entrypoint Section:.text
                                                                                                                              Digitally signed:false
                                                                                                                              Imagebase:0x10000000
                                                                                                                              Subsystem:windows gui
                                                                                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                              Time Stamp:0x609C8025 [Thu May 13 01:25:57 2021 UTC]
                                                                                                                              TLS Callbacks:
                                                                                                                              CLR (.Net) Version:
                                                                                                                              OS Version Major:5
                                                                                                                              OS Version Minor:0
                                                                                                                              File Version Major:5
                                                                                                                              File Version Minor:0
                                                                                                                              Subsystem Version Major:5
                                                                                                                              Subsystem Version Minor:0
                                                                                                                              Import Hash:a5d8d3bddce161fe65c4f476bd18c6da

                                                                                                                              Entrypoint Preview

                                                                                                                              Instruction
                                                                                                                              mov eax, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              cmp eax, 02h
                                                                                                                              mov eax, ebp
                                                                                                                              mov dword ptr [10029734h], eax
                                                                                                                              mov eax, ebx
                                                                                                                              mov dword ptr [10029730h], eax
                                                                                                                              mov eax, esi
                                                                                                                              mov dword ptr [10029728h], eax
                                                                                                                              jne 00007F4668B52776h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h

                                                                                                                              Rich Headers

                                                                                                                              Programming Language:
                                                                                                                              • [RES] VS2015 build 23026
                                                                                                                              • [IMP] VS2013 UPD4 build 31101
                                                                                                                              • [ C ] VS2010 build 30319
                                                                                                                              • [RES] VS2015 UPD2 build 23918
                                                                                                                              • [C++] VS2005 build 50727
                                                                                                                              • [IMP] VS2010 SP1 build 40219
                                                                                                                              • [RES] VS2012 build 50727

                                                                                                                              Data Directories

                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x2770a0x5b.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x277d80x59.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x2c0000x3a0.rsrc
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x2d0000x1220
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x100180x38.text
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x250000x4c.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                              Sections

                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                              .text0x10000x23c9e0x23e00False0.753620426829data7.52981613282IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                              .rdata0x250000x2d410x2c00False0.749112215909data7.3747682631IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .crt0x280000x333c0x1800False0.8125MMDF mailbox7.51564718747IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                              .rsrc0x2c0000x3a00x400False0.4248046875data3.06187161643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .reloc0x2d0000x2680x400False0.5439453125data4.2612921869IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                              Resources

                                                                                                                              NameRVASizeTypeLanguageCountry
                                                                                                                              RT_VERSION0x2c0600x33cdata

                                                                                                                              Imports

                                                                                                                              DLLImport
                                                                                                                              CLUSAPI.dllClusterEnum
                                                                                                                              USER32.dllTranslateMessage
                                                                                                                              KERNEL32.dllLoadLibraryW, GetProfileSectionW, GetProfileSectionA, OpenSemaphoreW, CreateFileW, OutputDebugStringA, CloseHandle
                                                                                                                              ole32.dllCreatePointerMoniker, CreateStreamOnHGlobal
                                                                                                                              ADVAPI32.dllRegOverridePredefKey
                                                                                                                              RASAPI32.dllRasGetConnectionStatistics

                                                                                                                              Version Infos

                                                                                                                              DescriptionData
                                                                                                                              LegalCopyrightCopyright 2018
                                                                                                                              InternalNamex2otfb
                                                                                                                              FileVersion7.2.5422.00
                                                                                                                              Full Version7.2.5_000-b00
                                                                                                                              CompanyNameOracle Corporation
                                                                                                                              ProductNameXhot(BM) Ltloehey YO 8
                                                                                                                              ProductVersion7.2.5422.00
                                                                                                                              FileDescriptionJava(TM) Platform SE binary
                                                                                                                              OriginalFilenamex2otfb.dll
                                                                                                                              Translation0x0000 0x04b0

                                                                                                                              Network Behavior

                                                                                                                              Network Port Distribution

                                                                                                                              UDP Packets

                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                              May 13, 2021 07:22:01.525288105 CEST5170353192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:01.574105978 CEST53517038.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:02.332768917 CEST6524853192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:02.410459995 CEST53652488.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:02.503997087 CEST5372353192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:02.598244905 CEST53537238.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:02.626971960 CEST6464653192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:02.678428888 CEST53646468.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:04.091280937 CEST6529853192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:04.141988993 CEST53652988.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:04.989748955 CEST5912353192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:05.038693905 CEST53591238.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:05.420166016 CEST5453153192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:05.481297970 CEST53545318.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:06.078555107 CEST4971453192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:06.130292892 CEST53497148.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:07.381356001 CEST5802853192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:07.432168007 CEST53580288.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:08.506211996 CEST5309753192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:08.554920912 CEST53530978.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:10.303385973 CEST4925753192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:10.352160931 CEST53492578.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:11.479302883 CEST6238953192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:11.530837059 CEST53623898.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:12.911638975 CEST4991053192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:12.963419914 CEST53499108.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:15.010085106 CEST5585453192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:15.061657906 CEST53558548.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:16.061284065 CEST6454953192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:16.121398926 CEST53645498.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:17.505708933 CEST6315353192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:17.554438114 CEST53631538.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:18.685547113 CEST5299153192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:18.737236023 CEST53529918.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:19.774173975 CEST5370053192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:19.824434042 CEST53537008.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:21.502928019 CEST5172653192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:21.552848101 CEST53517268.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:22.587744951 CEST5679453192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:22.644980907 CEST53567948.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:28.033847094 CEST5653453192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:28.086976051 CEST53565348.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:29.432365894 CEST5662753192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:29.480974913 CEST53566278.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:30.860198021 CEST5662153192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:30.912672997 CEST53566218.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:31.937776089 CEST6311653192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:31.992371082 CEST53631168.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:36.290436029 CEST6407853192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:36.357527971 CEST53640788.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:39.837080956 CEST6480153192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:39.894289970 CEST53648018.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:52.133411884 CEST6172153192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:52.183665991 CEST53617218.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:22:57.849221945 CEST5125553192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:22:57.897911072 CEST53512558.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:09.838609934 CEST6152253192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:09.898767948 CEST53615228.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:12.031999111 CEST5233753192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:12.092295885 CEST53523378.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:31.551399946 CEST5504653192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:31.665498018 CEST53550468.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:32.383167982 CEST4961253192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:32.555310011 CEST53496128.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:33.105720043 CEST4928553192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:33.163122892 CEST53492858.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:33.506737947 CEST5060153192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:33.566456079 CEST53506018.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:33.755166054 CEST6087553192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:33.812186003 CEST53608758.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:34.351803064 CEST5644853192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:34.410011053 CEST53564488.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:34.958182096 CEST5917253192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:35.015239000 CEST53591728.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:35.473227024 CEST6242053192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:35.530994892 CEST53624208.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:36.269795895 CEST6057953192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:36.326869011 CEST53605798.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:37.383033037 CEST5018353192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:37.443382025 CEST53501838.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:37.875566959 CEST6153153192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:37.932677984 CEST53615318.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:52.797332048 CEST4922853192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:52.871773958 CEST53492288.8.8.8192.168.2.4
                                                                                                                              May 13, 2021 07:23:53.993453026 CEST5979453192.168.2.48.8.8.8
                                                                                                                              May 13, 2021 07:23:54.050307035 CEST53597948.8.8.8192.168.2.4

                                                                                                                              Code Manipulations

                                                                                                                              Statistics

                                                                                                                              CPU Usage

                                                                                                                              Click to jump to process

                                                                                                                              Memory Usage

                                                                                                                              Click to jump to process

                                                                                                                              High Level Behavior Distribution

                                                                                                                              Click to dive into process behavior distribution

                                                                                                                              Behavior

                                                                                                                              Click to jump to process

                                                                                                                              System Behavior

                                                                                                                              General

                                                                                                                              Start time:07:22:09
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\System32\loaddll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:loaddll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll'
                                                                                                                              Imagebase:0x11b0000
                                                                                                                              File size:116736 bytes
                                                                                                                              MD5 hash:542795ADF7CC08EFCF675D65310596E8
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:07:22:09
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x11d0000
                                                                                                                              File size:232960 bytes
                                                                                                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:07:22:09
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:rundll32.exe 'C:\Users\user\Desktop\7587f225_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x8f0000
                                                                                                                              File size:61952 bytes
                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Yara matches:
                                                                                                                              • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.739761197.0000000010001000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:07:22:41
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 764
                                                                                                                              Imagebase:0xaf0000
                                                                                                                              File size:434592 bytes
                                                                                                                              MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              Disassembly

                                                                                                                              Code Analysis

                                                                                                                              Reset < >

                                                                                                                                Executed Functions

                                                                                                                                Non-executed Functions

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000000.00000002.643725963.0000000010021000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000000.00000002.643699943.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643705521.0000000010001000.00000020.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643733888.0000000010025000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643740994.0000000010028000.00000008.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643747501.000000001002C000.00000002.00020000.sdmp Download File
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: 4$@[gK$A$V$a$i$l$l$o$so$t$u$>'
                                                                                                                                • API String ID: 0-251563595
                                                                                                                                • Opcode ID: 8c6a0cb916d1975cbaee22f14d8319245bb82350f48865ce1f001bcab666d540
                                                                                                                                • Instruction ID: 3b069d31ac40e3f58d4bb2845281c26e8a5aaa3ce7ed3e664e92a20dc35ebd8c
                                                                                                                                • Opcode Fuzzy Hash: 8c6a0cb916d1975cbaee22f14d8319245bb82350f48865ce1f001bcab666d540
                                                                                                                                • Instruction Fuzzy Hash: C5F1F675A093908FE320CF69C880B8BFBE1BFD9754F19895DE88897351D774A806CB52
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                APIs
                                                                                                                                • TranslateMessage.USER32 ref: 10001677
                                                                                                                                • RegOverridePredefKey.ADVAPI32 ref: 1000169B
                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000000.00000002.643705521.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000000.00000002.643699943.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643725963.0000000010021000.00000020.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643733888.0000000010025000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643740994.0000000010028000.00000008.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.643747501.000000001002C000.00000002.00020000.sdmp Download File
                                                                                                                                Similarity
                                                                                                                                • API ID: MessageOverridePredefTranslate
                                                                                                                                • String ID: "
                                                                                                                                • API String ID: 2922720901-123907689
                                                                                                                                • Opcode ID: 91911445310d9fc16460e7054386fe924f303fd29511699d931b9511f568b215
                                                                                                                                • Instruction ID: f2f0c8b1251b093e8e159d7477b4886ac4e2ab534cee34cc20257ad2b3dbde62
                                                                                                                                • Opcode Fuzzy Hash: 91911445310d9fc16460e7054386fe924f303fd29511699d931b9511f568b215
                                                                                                                                • Instruction Fuzzy Hash: DB4132B49093409FD350DF28C99425BBBF1EF8A354F549A6DE9D98B3A4D3329840CB87
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Executed Functions

                                                                                                                                C-Code - Quality: 42%
                                                                                                                                			E030F1723(long __ebx, long __edi, void* __esi, intOrPtr _a4) {
                                                                                                                                				char _v20;
                                                                                                                                				intOrPtr _v24;
                                                                                                                                				intOrPtr _v28;
                                                                                                                                				intOrPtr _v32;
                                                                                                                                				intOrPtr _v36;
                                                                                                                                				intOrPtr _v40;
                                                                                                                                				char _v44;
                                                                                                                                				intOrPtr _v48;
                                                                                                                                				intOrPtr _v52;
                                                                                                                                				intOrPtr _v56;
                                                                                                                                				intOrPtr _v60;
                                                                                                                                				intOrPtr _v64;
                                                                                                                                				void* _v68;
                                                                                                                                				char* _v72;
                                                                                                                                				int _v76;
                                                                                                                                				long _v80;
                                                                                                                                				long _v84;
                                                                                                                                				DWORD* _v88;
                                                                                                                                				intOrPtr _v92;
                                                                                                                                				int _v96;
                                                                                                                                				intOrPtr* _v100;
                                                                                                                                				intOrPtr _v104;
                                                                                                                                				intOrPtr _v108;
                                                                                                                                				intOrPtr _v112;
                                                                                                                                				intOrPtr _v116;
                                                                                                                                				intOrPtr _v120;
                                                                                                                                				intOrPtr _v124;
                                                                                                                                				signed int _v128;
                                                                                                                                				char _v132;
                                                                                                                                				intOrPtr _v136;
                                                                                                                                				int _v140;
                                                                                                                                				intOrPtr _v144;
                                                                                                                                				intOrPtr _v148;
                                                                                                                                				intOrPtr _v152;
                                                                                                                                				void* _v156;
                                                                                                                                				char* _v160;
                                                                                                                                				intOrPtr _v164;
                                                                                                                                				intOrPtr _v168;
                                                                                                                                				intOrPtr _v172;
                                                                                                                                				char* _v176;
                                                                                                                                				intOrPtr _v180;
                                                                                                                                				intOrPtr _v184;
                                                                                                                                				char _v188;
                                                                                                                                				intOrPtr _t140;
                                                                                                                                				int _t146;
                                                                                                                                				int _t154;
                                                                                                                                				int _t158;
                                                                                                                                				int _t180;
                                                                                                                                				intOrPtr _t221;
                                                                                                                                				void* _t231;
                                                                                                                                				intOrPtr _t234;
                                                                                                                                				intOrPtr _t239;
                                                                                                                                				void* _t241;
                                                                                                                                				intOrPtr _t245;
                                                                                                                                				unsigned int _t248;
                                                                                                                                				intOrPtr _t256;
                                                                                                                                				DWORD* _t269;
                                                                                                                                				void* _t273;
                                                                                                                                				intOrPtr* _t276;
                                                                                                                                				intOrPtr* _t277;
                                                                                                                                
                                                                                                                                				_t140 = _a4;
                                                                                                                                				_v20 = 0;
                                                                                                                                				_t241 =  *((intOrPtr*)(_t140 + 0x44));
                                                                                                                                				 *0x30f4418 = 1;
                                                                                                                                				asm("movaps xmm0, [0x30f3010]");
                                                                                                                                				asm("movups [0x30f4428], xmm0");
                                                                                                                                				_v48 = _t140;
                                                                                                                                				_v52 =  *((intOrPtr*)(_t140 + 0x24));
                                                                                                                                				_v56 =  *((intOrPtr*)(_v48 + 0x38));
                                                                                                                                				_v188 = _t241;
                                                                                                                                				_v184 =  *((intOrPtr*)(_t140 + 0x64));
                                                                                                                                				_v180 = 4;
                                                                                                                                				_v176 =  &_v20;
                                                                                                                                				_v60 =  *((intOrPtr*)(_v48 + 0x20));
                                                                                                                                				_v64 = 4;
                                                                                                                                				_v68 = _t241;
                                                                                                                                				_v72 =  &_v20;
                                                                                                                                				_t146 = VirtualProtect(__esi, __edi, __ebx, _t269); // executed
                                                                                                                                				_v76 = _t146;
                                                                                                                                				_v188 = _v68;
                                                                                                                                				_v184 = 0;
                                                                                                                                				_v180 =  *((intOrPtr*)(_v48 + 0x64));
                                                                                                                                				_v80 = 0x400;
                                                                                                                                				_v84 = 2;
                                                                                                                                				_v88 =  &_v20;
                                                                                                                                				_v92 = 0;
                                                                                                                                				E030F1000();
                                                                                                                                				E030F2780(_v68,  *((intOrPtr*)(_v48 + 4)), _v56);
                                                                                                                                				E030F1000( *((intOrPtr*)(_v48 + 4)), 0, _v56);
                                                                                                                                				_t154 = VirtualProtect(_v68, 0x400, 2, _v88); // executed
                                                                                                                                				_t276 = _t273 - 0x8c;
                                                                                                                                				_t231 = _v68;
                                                                                                                                				_t256 =  *((intOrPtr*)(_t231 + 0x3c));
                                                                                                                                				_v96 = _t154;
                                                                                                                                				_v100 = _v68 + 0x3c;
                                                                                                                                				_v104 = _t231;
                                                                                                                                				_v108 = _t256;
                                                                                                                                				if(_t256 != 0) {
                                                                                                                                					_v104 = _v68 + (_v108 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                				}
                                                                                                                                				_v112 = _v104;
                                                                                                                                				if(_v60 != 0) {
                                                                                                                                					_v120 = _v112 + 0x18 + ( *(_v112 + 0x14) & 0x0000ffff);
                                                                                                                                					_v116 = 0;
                                                                                                                                					do {
                                                                                                                                						_t221 = _v120;
                                                                                                                                						_t248 =  *(_t221 + 0x24);
                                                                                                                                						_v124 = _v116;
                                                                                                                                						_v128 = _t248 >> 0x1f;
                                                                                                                                						_v132 = _v68 +  *((intOrPtr*)(_t221 + 0xc));
                                                                                                                                						_v188 = _v132;
                                                                                                                                						_v184 =  *((intOrPtr*)(_t221 + 8));
                                                                                                                                						_v180 =  *((intOrPtr*)(0x30f4418 + ((_t248 >> 0x0000001e & 0x00000001) << 4) + (_v128 << 3) + ((_t248 >> 0x0000001d & 0x00000001) << 2)));
                                                                                                                                						_v176 =  &_v20;
                                                                                                                                						_v136 = _t221;
                                                                                                                                						_t180 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                                                						_t276 = _t276 - 0x10;
                                                                                                                                						_t239 = _v124 + 1;
                                                                                                                                						_v140 = _t180;
                                                                                                                                						_v120 = _v136 + 0x28;
                                                                                                                                						_v116 = _t239;
                                                                                                                                					} while (_t239 != _v60);
                                                                                                                                				}
                                                                                                                                				 *_t276 = _v68;
                                                                                                                                				_v144 = _v68 +  *((intOrPtr*)(_v48 + 0x34));
                                                                                                                                				_t158 = DisableThreadLibraryCalls(??);
                                                                                                                                				_t277 = _t276 - 4;
                                                                                                                                				_t234 =  *_v100;
                                                                                                                                				_v148 = _t158;
                                                                                                                                				_v152 = _t234;
                                                                                                                                				_v156 = _v68;
                                                                                                                                				if(_t234 != 0) {
                                                                                                                                					_v156 = _v68 + (_v152 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                				}
                                                                                                                                				_t245 = _v48;
                                                                                                                                				_v44 =  *((intOrPtr*)(_t245 + 0x60));
                                                                                                                                				_v40 =  *((intOrPtr*)(_t245 + 0x4c));
                                                                                                                                				_v36 =  *((intOrPtr*)(_t245 + 0x2c));
                                                                                                                                				_v32 =  *((intOrPtr*)(_t245 + 0x54));
                                                                                                                                				_v28 =  *((intOrPtr*)(_t245 + 0x14));
                                                                                                                                				_v24 = _v144;
                                                                                                                                				 *_t277 = _t245;
                                                                                                                                				_v188 = 0;
                                                                                                                                				_v184 = 0x70;
                                                                                                                                				_v160 =  &_v44;
                                                                                                                                				_v164 = 0;
                                                                                                                                				_v168 = 0x70;
                                                                                                                                				_v172 =  *((intOrPtr*)(_v156 + 0x28));
                                                                                                                                				E030F1000();
                                                                                                                                				if(_v172 != 0) {
                                                                                                                                					_t276 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                                                					goto __eax;
                                                                                                                                				}
                                                                                                                                				return 1;
                                                                                                                                			}































































                                                                                                                                0x030f172f
                                                                                                                                0x030f173d
                                                                                                                                0x030f1744
                                                                                                                                0x030f1747
                                                                                                                                0x030f1751
                                                                                                                                0x030f1758
                                                                                                                                0x030f1762
                                                                                                                                0x030f1768
                                                                                                                                0x030f1771
                                                                                                                                0x030f177a
                                                                                                                                0x030f177d
                                                                                                                                0x030f1781
                                                                                                                                0x030f1789
                                                                                                                                0x030f1790
                                                                                                                                0x030f1793
                                                                                                                                0x030f1796
                                                                                                                                0x030f1799
                                                                                                                                0x030f179c
                                                                                                                                0x030f17b6
                                                                                                                                0x030f17bc
                                                                                                                                0x030f17bf
                                                                                                                                0x030f17c7
                                                                                                                                0x030f17cb
                                                                                                                                0x030f17ce
                                                                                                                                0x030f17d1
                                                                                                                                0x030f17d4
                                                                                                                                0x030f17d7
                                                                                                                                0x030f17f3
                                                                                                                                0x030f1810
                                                                                                                                0x030f1835
                                                                                                                                0x030f1837
                                                                                                                                0x030f1840
                                                                                                                                0x030f1843
                                                                                                                                0x030f184d
                                                                                                                                0x030f1850
                                                                                                                                0x030f1853
                                                                                                                                0x030f1856
                                                                                                                                0x030f1859
                                                                                                                                0x030f1899
                                                                                                                                0x030f1899
                                                                                                                                0x030f18bf
                                                                                                                                0x030f18c2
                                                                                                                                0x030f19d3
                                                                                                                                0x030f19d6
                                                                                                                                0x030f18cd
                                                                                                                                0x030f18d0
                                                                                                                                0x030f18dc
                                                                                                                                0x030f18e4
                                                                                                                                0x030f18f2
                                                                                                                                0x030f18fb
                                                                                                                                0x030f191b
                                                                                                                                0x030f191e
                                                                                                                                0x030f1922
                                                                                                                                0x030f1926
                                                                                                                                0x030f192d
                                                                                                                                0x030f1933
                                                                                                                                0x030f1935
                                                                                                                                0x030f1944
                                                                                                                                0x030f194c
                                                                                                                                0x030f1952
                                                                                                                                0x030f1955
                                                                                                                                0x030f1955
                                                                                                                                0x030f18cd
                                                                                                                                0x030f196c
                                                                                                                                0x030f1974
                                                                                                                                0x030f197a
                                                                                                                                0x030f197c
                                                                                                                                0x030f1982
                                                                                                                                0x030f198e
                                                                                                                                0x030f1994
                                                                                                                                0x030f199a
                                                                                                                                0x030f19a0
                                                                                                                                0x030f19ba
                                                                                                                                0x030f19ba
                                                                                                                                0x030f19f1
                                                                                                                                0x030f19f7
                                                                                                                                0x030f19fd
                                                                                                                                0x030f1a03
                                                                                                                                0x030f1a09
                                                                                                                                0x030f1a0f
                                                                                                                                0x030f1a18
                                                                                                                                0x030f1a1b
                                                                                                                                0x030f1a1e
                                                                                                                                0x030f1a26
                                                                                                                                0x030f1a2e
                                                                                                                                0x030f1a34
                                                                                                                                0x030f1a3a
                                                                                                                                0x030f1a40
                                                                                                                                0x030f1a46
                                                                                                                                0x030f1a54
                                                                                                                                0x030f18ac
                                                                                                                                0x030f18b2
                                                                                                                                0x030f18b2
                                                                                                                                0x030f1881

                                                                                                                                APIs
                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.739349940.00000000030F0000.00000040.00000001.sdmp, Offset: 030F0000, based on PE: true
                                                                                                                                Similarity
                                                                                                                                • API ID: ProtectVirtual
                                                                                                                                • String ID: p
                                                                                                                                • API String ID: 544645111-2181537457
                                                                                                                                • Opcode ID: 599833a8c5f867a888e92e48ad0f7b5bbf33b04704fc9ecb09e2529bcc565cbb
                                                                                                                                • Instruction ID: 34c3539770d7451e4a5b42b69bfdc3c25ade88e7d643df9776bc391fbadeca0f
                                                                                                                                • Opcode Fuzzy Hash: 599833a8c5f867a888e92e48ad0f7b5bbf33b04704fc9ecb09e2529bcc565cbb
                                                                                                                                • Instruction Fuzzy Hash: 8791AAB4E05218CFDB04DF99C980AAEFBF1BF88300F15856AD949AB751D334A985CF91
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                APIs
                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.739349940.00000000030F0000.00000040.00000001.sdmp, Offset: 030F0000, based on PE: true
                                                                                                                                Similarity
                                                                                                                                • API ID: ProtectVirtual
                                                                                                                                • String ID: p
                                                                                                                                • API String ID: 544645111-2181537457
                                                                                                                                • Opcode ID: 4ba2f9c387c3cc5e89441ddde925c711263329044f217f669d8cf000f3aea238
                                                                                                                                • Instruction ID: 259f21a7a104ba41390169f8531d1538aca391a3c7e36f02ca5d13b37fb1856a
                                                                                                                                • Opcode Fuzzy Hash: 4ba2f9c387c3cc5e89441ddde925c711263329044f217f669d8cf000f3aea238
                                                                                                                                • Instruction Fuzzy Hash: 1741A0B5E01229CFCB24CF69C98069DFBF1BF48304F2581AAD948A7301D735A982CF90
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                APIs
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.739349940.00000000030F0000.00000040.00000001.sdmp, Offset: 030F0000, based on PE: true
                                                                                                                                Similarity
                                                                                                                                • API ID: AllocVirtual
                                                                                                                                • String ID:
                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                • Opcode ID: ab2b4fd6e867e821eee542bf605fabefccaabaf14357b7e1eaecf1aa4d29e554
                                                                                                                                • Instruction ID: ebc83be2b173cc44869b7061b62e0b397791b308979e7614dd6da10137322fc4
                                                                                                                                • Opcode Fuzzy Hash: ab2b4fd6e867e821eee542bf605fabefccaabaf14357b7e1eaecf1aa4d29e554
                                                                                                                                • Instruction Fuzzy Hash: B141F2B5E0121A9FDB08CFA8D490AAEBBF0FF88314F15852DE548AB340D375A845CB84
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Non-executed Functions

                                                                                                                                C-Code - Quality: 100%
                                                                                                                                			E10006D50() {
                                                                                                                                
                                                                                                                                				 *0x1001d280 = GetUserNameW;
                                                                                                                                				 *0x1001D284 = MessageBoxW;
                                                                                                                                				 *0x1001D288 = GetLastError;
                                                                                                                                				 *0x1001D28C = CreateFileA;
                                                                                                                                				 *0x1001D290 = DebugBreak;
                                                                                                                                				 *0x1001D294 = FlushFileBuffers;
                                                                                                                                				 *0x1001D298 = FreeEnvironmentStringsA;
                                                                                                                                				 *0x1001D29C = GetConsoleOutputCP;
                                                                                                                                				 *0x1001D2A0 = GetEnvironmentStrings;
                                                                                                                                				 *0x1001D2A4 = GetLocaleInfoA;
                                                                                                                                				 *0x1001D2A8 = GetStartupInfoA;
                                                                                                                                				 *0x1001D2AC = GetStringTypeA;
                                                                                                                                				 *0x1001D2B0 = HeapValidate;
                                                                                                                                				 *0x1001D2B4 = IsBadReadPtr;
                                                                                                                                				 *0x1001D2B8 = LCMapStringA;
                                                                                                                                				 *0x1001D2BC = LoadLibraryA;
                                                                                                                                				 *0x1001D2C0 = OutputDebugStringA;
                                                                                                                                				return 0x1001d280;
                                                                                                                                			}



                                                                                                                                0x10006d61
                                                                                                                                0x10006d69
                                                                                                                                0x10006d6c
                                                                                                                                0x10006d7b
                                                                                                                                0x10006d7e
                                                                                                                                0x10006d8d
                                                                                                                                0x10006d90
                                                                                                                                0x10006d9f
                                                                                                                                0x10006da2
                                                                                                                                0x10006db1
                                                                                                                                0x10006db4
                                                                                                                                0x10006dc3
                                                                                                                                0x10006dc6
                                                                                                                                0x10006dd5
                                                                                                                                0x10006dd8
                                                                                                                                0x10006de7
                                                                                                                                0x10006dea
                                                                                                                                0x10006ded

                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.739761197.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.739749417.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.739818581.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.739830091.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.739840625.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID:
                                                                                                                                • API String ID:
                                                                                                                                • Opcode ID: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction ID: 9a9f90be372116ce35b3bf57ca6adafecb814b37ff7dc50591bd4b03753dcc6b
                                                                                                                                • Opcode Fuzzy Hash: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction Fuzzy Hash: 99110FB8A05620CFD34ACF09D5D49117BF2BB8E360312C19AD8098B376D734D985CF54
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                C-Code - Quality: 83%
                                                                                                                                			E1000C218(void* __ecx, void* __edx) {
                                                                                                                                				char _v28;
                                                                                                                                				char _v33;
                                                                                                                                				char _v38;
                                                                                                                                				char _v43;
                                                                                                                                				void* _t24;
                                                                                                                                				char* _t25;
                                                                                                                                				char _t32;
                                                                                                                                				void* _t33;
                                                                                                                                				void* _t34;
                                                                                                                                				signed int _t38;
                                                                                                                                				char* _t40;
                                                                                                                                
                                                                                                                                				_t40 = (_t38 & 0xfffffff0) - 0x2c;
                                                                                                                                				asm("movq xmm0, [edx]");
                                                                                                                                				_t32 = 0;
                                                                                                                                				 *_t40 = 0x7b;
                                                                                                                                				asm("movq [esp+0x1], xmm0");
                                                                                                                                				_v43 = 0x2d;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t32 + 0xa)) =  *((intOrPtr*)(_t32 + __edx + 8));
                                                                                                                                					_t32 = _t32 + 1;
                                                                                                                                				} while (_t32 < 4);
                                                                                                                                				_v38 = 0x2d;
                                                                                                                                				_t33 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t33 + 0xf)) =  *((intOrPtr*)(_t33 + __edx + 0xc));
                                                                                                                                					_t33 = _t33 + 1;
                                                                                                                                				} while (_t33 < 4);
                                                                                                                                				_v33 = 0x2d;
                                                                                                                                				_t34 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t34 + 0x14)) =  *((intOrPtr*)(_t34 + __edx + 0x10));
                                                                                                                                					_t34 = _t34 + 1;
                                                                                                                                				} while (_t34 < 4);
                                                                                                                                				_v28 = 0x2d;
                                                                                                                                				_t24 = 0;
                                                                                                                                				do {
                                                                                                                                					asm("movd xmm0, dword [eax+edx+0x14]");
                                                                                                                                					asm("movd [esp+eax+0x19], xmm0");
                                                                                                                                					_t24 = _t24 + 4;
                                                                                                                                				} while (_t24 < 0xc);
                                                                                                                                				_t25 = _t40;
                                                                                                                                				 *((char*)(_t25 + 0x25)) = 0x7d;
                                                                                                                                				 *((char*)(_t25 + 0x26)) = 0;
                                                                                                                                				E1000DFBC(__ecx, _t25, 0);
                                                                                                                                				return __ecx;
                                                                                                                                			}














                                                                                                                                0x1000c21f
                                                                                                                                0x1000c224
                                                                                                                                0x1000c228
                                                                                                                                0x1000c22a
                                                                                                                                0x1000c22e
                                                                                                                                0x1000c234
                                                                                                                                0x1000c239
                                                                                                                                0x1000c23d
                                                                                                                                0x1000c241
                                                                                                                                0x1000c242
                                                                                                                                0x1000c249
                                                                                                                                0x1000c24e
                                                                                                                                0x1000c250
                                                                                                                                0x1000c254
                                                                                                                                0x1000c258
                                                                                                                                0x1000c259
                                                                                                                                0x1000c260
                                                                                                                                0x1000c265
                                                                                                                                0x1000c267
                                                                                                                                0x1000c26b
                                                                                                                                0x1000c26f
                                                                                                                                0x1000c270
                                                                                                                                0x1000c275
                                                                                                                                0x1000c27a
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c282
                                                                                                                                0x1000c288
                                                                                                                                0x1000c28b
                                                                                                                                0x1000c292
                                                                                                                                0x1000c295
                                                                                                                                0x1000c29b
                                                                                                                                0x1000c2a0
                                                                                                                                0x1000c2ae

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.739761197.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.739749417.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.739818581.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.739830091.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.739840625.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: -$-$-$-
                                                                                                                                • API String ID: 0-1033403326
                                                                                                                                • Opcode ID: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction ID: 6420cdf91b2b9fc5655fa5f82b4c53aa5eb92ddd4154ae73ebf41adf494228f8
                                                                                                                                • Opcode Fuzzy Hash: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction Fuzzy Hash: C811252091C3C04CE749DB7C548462BFFD08F9A208F1886BEE4DA86B53E525D49683B7
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%