Windows Analysis Report SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.12131

ID:	510686
Product:	CloudBasic
Start time:	04:49:29
Start date:	28.10.2021
Sample:	SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.12131
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	e53a16bea7918b1f7d4c0e659febc766
SHA1:	10d4d3d7fac35f6492cda2fb04aebf46903481f0
SHA256:	212cae7b05ecbc938b3a1fda4753d119f69360165955937b836fdbc7a6d514eb
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2b57d984458e21441755dcb7fd69ad7959479eb3_82810a17_06ac9ba8\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	CF7CD7EB4BAA98CDB4DFA099BE62AF48	C1CBF75E010B107E05B919F52BA64B3989A0E3DF	09C4023481DA95298694FEC463CF2FBDD12C106962E0A5D35DB3EEAE0D9ED4A4
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_5f8c232292098bd3183b3bd76fd57ba47bd4c4b_82810a17_056488dc\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	A4E2D7D8C3B761D8F55E4B27013DB19A	77FFCF59E0C5CC3DB91F3BB603F9B79FD20E7776	97D7E2678CD2EF7A49260D184CCCF3CA0A252D52FCCB9CD5BF8F47A86F8B9790
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_af1de8448413c76b457f536b7859b51ff1ab58_82810a17_0644a712\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	52C5577C1D0F67DE06749DC5CD2579A7	562EFF5560B3EC885F54484399F2A966DC789E2B	A90C59201AE0DDC5579D586AAB18CAAA937C7363D91A76DFE3BDC4459191925B
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c316961cf9547f4477c913cd7ccdecd11bd19_82810a17_1384863c\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	136E2022FE3668BE06BF4D9CA54E8C40	A44E90D03671726C3176577FAC94942601DF12D6	46FE6DB306F2A2E67744B49483DE10010A69AC166D4978F9A532702C0A745695
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3916.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 11:53:15 2021, 0x1205a4 type	BEC3FEE4BDB7C15EA5A63901CB714201	5CD6654B5950A02ABA79D6A78466D748E3069593	EB377D71C2B3470B08011992990098219B5FAE7077104F5819C3615B1FB7545D
C:\ProgramData\Microsoft\Windows\WER\Temp\WER41C1.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 11:53:20 2021, 0x1205a4 type	9166A0C57EA401C40279942ECBE4962B	79B6D015AF7E4022EC3E4DCD399794947461D3D2	0556A7F7D118E536AE09FAB5E501FE92988ACD20B968CC0CDF9B597CBB337ACD
C:\ProgramData\Microsoft\Windows\WER\Temp\WER524C.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	41685C54F4CDB54041A01238ED37A234	6D69DDB1AC93E29704C61D63334E15F800AFB298	39EDE2DC7B4F2602C4063FA459B5A5C2E258892F527E5A6ED96BEFB25F756CF0
C:\ProgramData\Microsoft\Windows\WER\Temp\WER575E.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	ACB43C10C671E9BE172B578068D0E298	CCE46738C7513524BB0C746C0D5F12D4ACBD380C	40F51E7D47C7C3B99C00453ED5CA3A3619E749BEB441299A505E7271469A22FF
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B55.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	9E19BA093FECC4B050823625C7FAF9B8	07C2AE77903973666D4452B613416C7AF1B44907	0E02ECD9D6168DAE822C1EB0C45D24B86974FFD5A721A17FC1BA9D86A9CDB3AD
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C2E.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 11:53:25 2021, 0x1205a4 type	F1B70EC3886F544E53F61634D143AAF5	82B02996B6927E98B3B7FA4D8221B4A3B4281922	197A27AEF881D9AA396CDD7CE67CF2393A83F93F719E52444A0E4B9996A14CD6
C:\ProgramData\Microsoft\Windows\WER\Temp\WER61FD.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	62DB1090DC907F046049B3D174C72850	B86FA95A97F742D777422258AE0DC34EE709AA84	0DAD5DE5E468354CF7FC4D1B56604E607AE3F22C969CEA8D91E6284A8DFA4AEB
C:\ProgramData\Microsoft\Windows\WER\Temp\WER716D.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	513A869F0DF8F62CD0DCAA506841CB38	79DB8DD1D5B2EC5A6626721F2524C0726234D07A	FFE0C86992CB2BCCE3EBFADC66D0949BF3F3A970AA1EE96CAFBF13D467863FE0
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7650.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	FFF9E77B6F3D1786A8A9DA10BAD0AF11	34A1EDD1AE0072362AE28415F12A7337149C04CA	216D954D69EB38411EA005440CEF5C372F556E6511CEB2652D32858D8FC7C8A9
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F66.tmp.dmp	Mini DuMP crash report, 14 streams, Thu Oct 28 11:53:33 2021, 0x1205a4 type	3252341FA4E6AAA340C86BE569B9B887	396413E0DF4DA5C36E2C8A2F27EB9B923BEBFD5D	4235090E7060960CAEEDA542366BE61213CBEA65231CA0010CA88B3DA96091EB
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9168.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	35FE3F27DCF32FE4EC829F835278479E	D89F2546047CDDC57935D5DD124C03DCA162FB7F	D412817C9BB092531DD5F4FE42AAF432F9AC71F9CDB5FBEAF0F740B040404182
C:\ProgramData\Microsoft\Windows\WER\Temp\WER97D2.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	727815519B03DAD3AF59D1F6118DB2A9	602837B2F4405F5ADB8C4CC82533B4BF068EB29D	FB3093C323633B6C1A0CE189BE47004145EFCF055F0CFC0F9F1E2F0E9832F311
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	B614A3B1ECD297D659BE03B0AB7C45B3	889FBB8C0D61ADE8295658FB48DF3E88513F028E	A9F980CEF056EC64C47CF7B8CE374F1551D1BA94A263ED1F72B604B209CC83A4
C:\Windows\appcompat\Programs\Amcache.hve.LOG1	MS Windows registry file, NT/2000 or above	298C01B000B90A25B63089430DFCCF86	AD0E9DD2A27ADCB4619FBED9AFA634A93FBFF4D6	368BFE7355199AC75CC44744FF406D8DCD3B48BF8424E55B76B6DC4ABBC230D3

AV Detection:

Found malware configuration

Source: 10.2.rundll32.exe.6f020000.2.unpack

Malware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["149.202.179.100:443", "66.147.235.11:6891", "81.0.236.89:13786"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "ranVAwtYINZG8jFJSjh5rR8jx3HIZIvSCern79nVFUhfeb2NvJlOKPsGO1osGE0VchV9bFDjym"]}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	Virustotal: Detection: 21%			Perma Link
Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	ReversingLabs: Detection: 31%

Machine Learning detection for sample

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 3.2.rundll32.exe.2ba4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.0.rundll32.exe.2bd0000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 10.2.rundll32.exe.44c4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.0.rundll32.exe.2bf4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.0.rundll32.exe.3fe4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.0.rundll32.exe.2a00000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 3.2.rundll32.exe.27b0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 12.2.rundll32.exe.2bd0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 13.0.rundll32.exe.2580000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 12.0.rundll32.exe.2dd4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.0.rundll32.exe.3fe4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.0.rundll32.exe.2580000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 11.2.rundll32.exe.2bf4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.0.rundll32.exe.2bf4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.0.rundll32.exe.44c4756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.0.rundll32.exe.4034756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.0.rundll32.exe.28e0000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 0.0.loaddll32.exe.5b0000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 12.2.rundll32.exe.2dd4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.0.loaddll32.exe.5b0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 13.0.rundll32.exe.4034756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.0.rundll32.exe.2dd4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.0.rundll32.exe.2580000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 0.0.loaddll32.exe.e04756.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.0.rundll32.exe.28e0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 10.2.rundll32.exe.2a00000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 11.2.rundll32.exe.28e0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 13.2.rundll32.exe.4034756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.0.rundll32.exe.44c4756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.0.loaddll32.exe.e04756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.0.rundll32.exe.2580000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 10.0.rundll32.exe.2a00000.3.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 9.2.rundll32.exe.2894756.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.0.rundll32.exe.2bd0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 9.2.rundll32.exe.2790000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 13.2.rundll32.exe.2580000.0.unpack	Avira: Label: TR/ATRAPS.Gen2

Compliance:

Uses 32bit PE files

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: rpidebbfll.pdb source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.452788302.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000009.00000003.690183508.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.452788302.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000009.00000003.690183508.000000004B280000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 149.202.179.100:443
Source: Malware configuration extractor	IPs: 66.147.235.11:6891
Source: Malware configuration extractor	IPs: 81.0.236.89:13786

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: HOSTROCKETUS HOSTROCKETUS
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 66.147.235.11 66.147.235.11
Source: Joe Sandbox View	IP Address: 149.202.179.100 149.202.179.100
Source: Joe Sandbox View	IP Address: 81.0.236.89 81.0.236.89

URLs found in memory or binary data

Source: Amcache.hve.21.dr

String found in binary or memory: http://upx.sf.net

Source: loaddll32.exe, 00000000.00000000.523818743.000000006F03F000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.475656275.000000006F03F000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.873978106.000000006F03F000.00000002.00020000.sdmp, rundll32.exe, 00000009.00000002.874891443.000000006F03F000.00000002.00020000.sdmp, rundll32.exe, 0000000A.00000002.758338318.000000006F03F000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000000.723066869.000000006F03F000.00000002.00020000.sdmp, rundll32.exe, 0000000C.00000000.712126341.000000006F03F000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000002.765202970.000000006F03F000.00000002.00020000.sdmp

String found in binary or memory: http://www.vomfass.deDVarFileInfo$

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 10.0.rundll32.exe.6f020000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rundll32.exe.6f020000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.rundll32.exe.6f020000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.rundll32.exe.6f020000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.6f020000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.732486689.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.723436557.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.756877122.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.712349151.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.765113573.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.874852641.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.475579943.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.722717692.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.697948285.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.716630933.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.523799622.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.758018244.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.759412743.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.715578502.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.709098090.000000006F021000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.873904073.000000006F021000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Binary or memory string: OriginalFilenameddlb.dll vs SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

One or more processes crash

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 664

Detected potential crypto function

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F030754		3_2_6F030754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F039348		3_2_6F039348
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F02A52C		3_2_6F02A52C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F031D58		3_2_6F031D58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F031460		3_2_6F031460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F02846C		3_2_6F02846C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F021494		3_2_6F021494

Contains functionality to call native functions

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F03223C NtDelayExecution,		3_2_6F03223C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F032840 NtAllocateVirtualMemory,		3_2_6F032840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F02BB88 NtClose,		3_2_6F02BB88

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Sample is known by Antivirus

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	Virustotal: Detection: 21%
Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll	ReversingLabs: Detection: 31%

PE file has an executable .text section and no other executable section

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',CheckTrust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllCanUnloadNow
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllGetClassObject
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DownloadFile
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',GetICifFileFromFile
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 664
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 664
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll,FFRgpmdlwwWde			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',CheckTrust			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllCanUnloadNow			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DllGetClassObject			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',DownloadFile			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',GetICifFileFromFile			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 664			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 664			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 664			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 664			Jump to behavior

Found detection on Joe Sandbox Cloud Basic with higher score

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.12131

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7112
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7124
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7088
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7100

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER3916.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal76.troj.evad.winDLL@33/18@0/4

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Submission file is bigger than most known malware samples

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static file information: File size 1093632 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: rpidebbfll.pdb source: SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll
Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.452788302.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000009.00000003.690183508.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.452788302.000000004B280000.00000004.00000001.sdmp, rundll32.exe, 00000009.00000003.690183508.000000004B280000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6F02F6CC push esi; mov dword ptr [esp], 00000000h

3_2_6F02F6CD

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 1224

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 805			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 419			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Contains functionality to query system information

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6F030754 GetTokenInformation,GetSystemInfo,GetTokenInformation,

3_2_6F030754

Contains medium sleeps (>= 30s)

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.21.dr	Binary or memory string: VMware
Source: Amcache.hve.21.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: VMware-42 35 34 13 2a 07 0a 9c-ee 7f dd c3 60 c7 b9 af
Source: Amcache.hve.21.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.21.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.21.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.21.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.21.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.21.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1x
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.21.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6F026D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_6F026D50

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 664

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6F033110 RtlAddVectoredExceptionHandler,

3_2_6F033110

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Drixed-FJXE53A16BEA791.13728.dll',#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 664			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 664			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7112 -s 664			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 664			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000000.518575050.00000000012C0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.468304481.0000000002B00000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872679055.00000000030A0000.00000002.00020000.sdmp, rundll32.exe, 00000009.00000002.872585364.0000000002D50000.00000002.00020000.sdmp, rundll32.exe, 0000000A.00000000.686591592.0000000002FE0000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000000.720244416.0000000002FF0000.00000002.00020000.sdmp, rundll32.exe, 0000000C.00000000.697340415.00000000031E0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000000.718748745.0000000002B50000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.518575050.00000000012C0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.468304481.0000000002B00000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872679055.00000000030A0000.00000002.00020000.sdmp, rundll32.exe, 00000009.00000002.872585364.0000000002D50000.00000002.00020000.sdmp, rundll32.exe, 0000000A.00000000.686591592.0000000002FE0000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000000.720244416.0000000002FF0000.00000002.00020000.sdmp, rundll32.exe, 0000000C.00000000.697340415.00000000031E0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000000.718748745.0000000002B50000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.518575050.00000000012C0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.468304481.0000000002B00000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872679055.00000000030A0000.00000002.00020000.sdmp, rundll32.exe, 00000009.00000002.872585364.0000000002D50000.00000002.00020000.sdmp, rundll32.exe, 0000000A.00000000.686591592.0000000002FE0000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000000.720244416.0000000002FF0000.00000002.00020000.sdmp, rundll32.exe, 0000000C.00000000.697340415.00000000031E0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000000.718748745.0000000002B50000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: loaddll32.exe, 00000000.00000000.518575050.00000000012C0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.468304481.0000000002B00000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872679055.00000000030A0000.00000002.00020000.sdmp, rundll32.exe, 00000009.00000002.872585364.0000000002D50000.00000002.00020000.sdmp, rundll32.exe, 0000000A.00000000.686591592.0000000002FE0000.00000002.00020000.sdmp, rundll32.exe, 0000000B.00000000.720244416.0000000002FF0000.00000002.00020000.sdmp, rundll32.exe, 0000000C.00000000.697340415.00000000031E0000.00000002.00020000.sdmp, rundll32.exe, 0000000D.00000000.718748745.0000000002B50000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_6F026D50

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query the account / user name

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6F026D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_6F026D50

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.21.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe