Source: 0.3.loaddll32.exe.baa1db.0.unpack | Avira: Label: TR/Patched.Ren.Gen |
Source: 6.3.rundll32.exe.315a1db.0.unpack | Avira: Label: TR/Patched.Ren.Gen |
Source: 2.3.rundll32.exe.446a1db.0.unpack | Avira: Label: TR/Patched.Ren.Gen |
Source: 3.3.rundll32.exe.27da1db.0.unpack | Avira: Label: TR/Patched.Ren.Gen |
Source: 4.3.rundll32.exe.284a1db.0.unpack | Avira: Label: TR/Patched.Ren.Gen |
Source: 5.3.rundll32.exe.29ca1db.0.unpack | Avira: Label: TR/Patched.Ren.Gen |
Source: Processwindo.DLL | Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL |
Source: | Binary string: c:\Post\806_Blood\Question\animal\four.pdb source: rundll32.exe, 00000002.00000002.546908161.000000006DDB8000.00000002.00020000.sdmp, rundll32.exe, 00000006.00000002.545590218.000000006DDB8000.00000002.00020000.sdmp, Processwindo.DLL |
Source: rundll32.exe, 00000002.00000003.495420595.0000000007360000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000002.528553318.0000000005B00000.00000004.00000040.sdmp, rundll32.exe, 00000004.00000002.542546600.0000000006F70000.00000004.00000040.sdmp, rundll32.exe, 00000005.00000002.536639176.0000000007440000.00000004.00000040.sdmp, rundll32.exe, 00000006.00000002.544385763.00000000078E0000.00000004.00000040.sdmp | String found in binary or memory: http://%s=%s&file://&os=%u.%u_%u_%u_x%uindex.html; |
Source: rundll32.exe | String found in binary or memory: https://bussipod.xyz |
Source: rundll32.exe, 00000002.00000003.495420595.0000000007360000.00000004.00000040.sdmp | String found in binary or memory: https://bussipod.xyz8 |
Source: Yara match | File source: 00000002.00000003.506028485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.495420595.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.505312952.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.482226881.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504200485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.483330440.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.484424201.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.492896787.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.501636521.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.478507309.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507395873.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.509298734.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.472579495.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.481041816.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.503569052.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000006.00000002.544385763.00000000078E0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.506726759.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.502575095.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504793852.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.479769678.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.477123674.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.493854181.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.486817454.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.475731055.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.498075018.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.489614241.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.528553318.0000000005B00000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.485563074.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.508698694.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507998418.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.536639176.0000000007440000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.546136992.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.491910868.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.490684908.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.488235780.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.474346920.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000004.00000002.542546600.0000000006F70000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5560, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5540, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5996, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 4308, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5984, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.506028485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.495420595.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.505312952.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.482226881.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504200485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.483330440.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.484424201.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.492896787.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.501636521.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.478507309.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507395873.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.509298734.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.472579495.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.481041816.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.503569052.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000006.00000002.544385763.00000000078E0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.506726759.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.502575095.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504793852.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.479769678.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.477123674.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.493854181.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.486817454.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.475731055.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.498075018.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.489614241.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.528553318.0000000005B00000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.485563074.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.508698694.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507998418.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.536639176.0000000007440000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.546136992.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.491910868.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.490684908.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.488235780.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.474346920.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000004.00000002.542546600.0000000006F70000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5560, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5540, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5996, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 4308, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5984, type: MEMORY |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD72411 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD721F0 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD9BCA0 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDAC5F4 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDB48D1 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA9813 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD997C0 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDB67FE |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA4B80 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDB5359 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDB4E15 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: String function: 6DDA8D18 appears 47 times |
Source: Processwindo.DLL | Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL |
Source: classification engine | Classification label: mal56.troj.winDLL@17/0@0/0 |
Source: C:\Windows\SysWOW64\rundll32.exe | Mutant created: \Sessions\1\BaseNamedObjects\Local\1978EE24-ED7A-8F95-C655-46BAE5CC03A0 |
Source: C:\Windows\System32\conhost.exe | Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1308:120:WilError_01 |
Source: Processwindo.DLL | Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
Source: C:\Windows\System32\loaddll32.exe | Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Formweather |
Source: Processwindo.DLL | Virustotal: Detection: 29% |
Source: Processwindo.DLL | ReversingLabs: Detection: 21% |
Source: unknown | Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\Processwindo.DLL' |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\Processwindo.DLL',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Formweather |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\Processwindo.DLL',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Piecehear |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Stickregion |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Would |
Source: unknown | Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /C timeout /t 5 && del 'C:\Users\user\Desktop\Processwindo.DLL' |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 5 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\Processwindo.DLL',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Formweather |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Piecehear |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Stickregion |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Processwindo.DLL,Would |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\Processwindo.DLL',#1 |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 5 |
Source: C:\Windows\SysWOW64\rundll32.exe | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32 |
Source: C:\Windows\SysWOW64\rundll32.exe | Automated click: OK |
Source: C:\Windows\SysWOW64\rundll32.exe | Automated click: OK |
Source: C:\Windows\SysWOW64\rundll32.exe | Automated click: OK |
Source: C:\Windows\SysWOW64\rundll32.exe | Automated click: OK |
Source: C:\Windows\SysWOW64\rundll32.exe | Automated click: OK |
Source: Processwindo.DLL | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT |
Source: Processwindo.DLL | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE |
Source: Processwindo.DLL | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC |
Source: Processwindo.DLL | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG |
Source: Processwindo.DLL | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG |
Source: Processwindo.DLL | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT |
Source: Processwindo.DLL | Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG |
Source: | Binary string: c:\Post\806_Blood\Question\animal\four.pdb source: rundll32.exe, 00000002.00000002.546908161.000000006DDB8000.00000002.00020000.sdmp, rundll32.exe, 00000006.00000002.545590218.000000006DDB8000.00000002.00020000.sdmp, Processwindo.DLL |
Source: Processwindo.DLL | Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata |
Source: Processwindo.DLL | Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc |
Source: Processwindo.DLL | Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc |
Source: Processwindo.DLL | Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata |
Source: Processwindo.DLL | Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD7132A GetModuleHandleW,LoadLibraryW,GetProcAddress, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD721DF push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA8D5D push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD80D55 push edi; iretd |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD80CDF push 00000065h; retf |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA54F2 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD80881 push ebx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDD0560 push eax; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDD04E1 push eax; ret |
Source: Yara match | File source: 00000002.00000003.506028485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.495420595.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.505312952.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.482226881.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504200485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.483330440.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.484424201.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.492896787.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.501636521.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.478507309.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507395873.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.509298734.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.472579495.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.481041816.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.503569052.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000006.00000002.544385763.00000000078E0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.506726759.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.502575095.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504793852.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.479769678.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.477123674.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.493854181.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.486817454.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.475731055.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.498075018.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.489614241.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.528553318.0000000005B00000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.485563074.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.508698694.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507998418.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.536639176.0000000007440000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.546136992.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.491910868.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.490684908.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.488235780.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.474346920.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000004.00000002.542546600.0000000006F70000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5560, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5540, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5996, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 4308, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5984, type: MEMORY |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: all processes | Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: C:\Windows\System32\conhost.exe | Last function: Thread delayed |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA4CBF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DD7132A GetModuleHandleW,LoadLibraryW,GetProcAddress, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDD1390 mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDD0EC6 push dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDD12BF mov eax, dword ptr fs:[00000030h] |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDB1CF3 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, |
Source: all processes | Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA5170 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA110C _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA4CBF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDA4724 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\Processwindo.DLL',#1 |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 5 |
Source: rundll32.exe, 00000002.00000002.533884058.0000000003030000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.533886102.0000000002DA0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.534193861.0000000002FD0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.533756047.0000000003540000.00000002.00000001.sdmp | Binary or memory string: Shell_TrayWnd |
Source: rundll32.exe, 00000002.00000002.533884058.0000000003030000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.533886102.0000000002DA0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.534193861.0000000002FD0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.533756047.0000000003540000.00000002.00000001.sdmp | Binary or memory string: Progman |
Source: rundll32.exe, 00000002.00000002.533884058.0000000003030000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.533886102.0000000002DA0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.534193861.0000000002FD0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.533756047.0000000003540000.00000002.00000001.sdmp | Binary or memory string: SProgram Managerl |
Source: rundll32.exe, 00000002.00000002.533884058.0000000003030000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.533886102.0000000002DA0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.534193861.0000000002FD0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.533756047.0000000003540000.00000002.00000001.sdmp | Binary or memory string: Shell_TrayWnd, |
Source: rundll32.exe, 00000002.00000002.533884058.0000000003030000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.533886102.0000000002DA0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.534193861.0000000002FD0000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.533756047.0000000003540000.00000002.00000001.sdmp | Binary or memory string: Progmanlock |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,_strcpy_s,__invoke_watson,__itoa_s, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLocaleInfoA, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLastError,_malloc,WideCharToMultiByte,__freea,GetLocaleInfoA, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_6DDAFB69 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, |
Source: C:\Windows\SysWOW64\rundll32.exe | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Source: Yara match | File source: 00000002.00000003.506028485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.495420595.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.505312952.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.482226881.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504200485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.483330440.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.484424201.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.492896787.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.501636521.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.478507309.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507395873.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.509298734.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.472579495.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.481041816.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.503569052.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000006.00000002.544385763.00000000078E0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.506726759.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.502575095.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504793852.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.479769678.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.477123674.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.493854181.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.486817454.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.475731055.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.498075018.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.489614241.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.528553318.0000000005B00000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.485563074.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.508698694.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507998418.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.536639176.0000000007440000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.546136992.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.491910868.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.490684908.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.488235780.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.474346920.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000004.00000002.542546600.0000000006F70000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5560, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5540, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5996, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 4308, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5984, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.506028485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.495420595.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.505312952.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.482226881.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504200485.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.483330440.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.484424201.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.492896787.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.501636521.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.478507309.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507395873.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.509298734.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.472579495.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.481041816.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.503569052.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000006.00000002.544385763.00000000078E0000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.506726759.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.502575095.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.504793852.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.479769678.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.477123674.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.493854181.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.486817454.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.475731055.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.498075018.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.489614241.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.528553318.0000000005B00000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.485563074.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.508698694.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.507998418.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000005.00000002.536639176.0000000007440000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000002.546136992.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.491910868.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.490684908.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.488235780.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000002.00000003.474346920.0000000007360000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000004.00000002.542546600.0000000006F70000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5560, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5540, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5996, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 4308, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 5984, type: MEMORY |
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.