Windows Analysis Report mal2.exe

AV Detection:

Found malware configuration

Source: 4.2.rundll32.exe.33f3568.1.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Source: mal2.dll

ReversingLabs: Detection: 24%

Compliance:

Uses 32bit PE files

Source: mal2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: mal2.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000014.00000003.594790225.00000000005D3000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594905984.00000000005D3000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594721838.0000000004257000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000014.00000003.594862234.00000000005D9000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594794787.00000000005D9000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000014.00000003.594862234.00000000005D9000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594794787.00000000005D9000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000014.00000003.594790225.00000000005D3000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594905984.00000000005D3000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000014.00000002.605555284.0000000000162000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9F2FE7 FindFirstFileExW,		0_2_6E9F2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F2FE7 FindFirstFileExW,		3_2_6E9F2FE7

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 19

URLs found in memory or binary data

Source: svchost.exe, 00000005.00000002.627977305.0000017C92263000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.645558527.0000000004D80000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.647849827.0000000004D82000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WerFault.exe, 00000018.00000002.647603781.0000000003238000.00000004.00000020.sdmp	String found in binary or memory: http://crl.microsoft
Source: svchost.exe, 00000005.00000002.627977305.0000017C92263000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: Amcache.hve.20.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 0000000A.00000002.445658680.000001F6D4413000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000008.00000002.785008131.0000020F91447000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000008.00000002.785008131.0000020F91447000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000008.00000002.785008131.0000020F91447000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com/
Source: svchost.exe, 00000008.00000002.785008131.0000020F91447000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000008.00000002.784824630.0000020F91429000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000008.00000002.784824630.0000020F91429000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420087744.000001F6D444D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.420113403.000001F6D4442000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.456157837.000001F6D4444000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420122458.000001F6D4443000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.420113403.000001F6D4442000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.456157837.000001F6D4444000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420122458.000001F6D4443000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000002.463794574.000001F6D446B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420041356.000001F6D4469000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000002.445658680.000001F6D4413000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.420113403.000001F6D4442000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.456157837.000001F6D4444000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420122458.000001F6D4443000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000A.00000002.458236717.000001F6D4450000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420079711.000001F6D444F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000A.00000003.420098538.000001F6D4449000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420113403.000001F6D4442000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.457191441.000001F6D444A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
Source: svchost.exe, 0000000A.00000003.420087744.000001F6D444D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.420098538.000001F6D4449000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.457191441.000001F6D444A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.420098538.000001F6D4449000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.457191441.000001F6D444A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.420109133.000001F6D4447000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000A.00000003.420073505.000001F6D4452000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000A.00000003.420113403.000001F6D4442000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.456157837.000001F6D4444000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.420122458.000001F6D4443000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
Source: svchost.exe, 0000000A.00000002.455572728.000001F6D4441000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000A.00000002.450549356.000001F6D4429000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000A.00000003.371729055.000001F6D4434000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.454601455.000001F6D443D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000A.00000002.454601455.000001F6D443D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 4.2.rundll32.exe.33f3568.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34a3590.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2fd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e43620.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e43620.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2c60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.743608.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d13590.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.743608.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2810000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.33f3568.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.3d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3310000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2b90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34a3590.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d13590.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.582902080.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.648394572.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.583952569.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.582956002.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.584098715.000000000348A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.516939177.0000000002A69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.583809959.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.609571158.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.584033877.0000000003310000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.608882072.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.529764323.00000000033DA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.529712729.0000000002FD0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.689618667.0000000002E43000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.648560636.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.608527561.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.689328913.0000000002B90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.610069085.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591122734.0000000002C60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.533471939.0000000002810000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591237102.0000000002CFA000.00000004.00000020.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: mal2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 7004 -ip 7004

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Uikrpc\tumwlrzamddm.oli:Zone.Identifier

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Uikrpc\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EED95		0_2_003EED95
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003ECC3F		0_2_003ECC3F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D3E3B		0_2_003D3E3B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E0A37		0_2_003E0A37
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E0824		0_2_003E0824
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EBA18		0_2_003EBA18
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F2C16		0_2_003F2C16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E1C12		0_2_003E1C12
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DF20D		0_2_003DF20D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EE478		0_2_003EE478
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F1C71		0_2_003F1C71
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F0C66		0_2_003F0C66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E645F		0_2_003E645F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E604E		0_2_003E604E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E3ABE		0_2_003E3ABE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EB0BA		0_2_003EB0BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DAEB9		0_2_003DAEB9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D68AD		0_2_003D68AD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E56A9		0_2_003E56A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DF4A5		0_2_003DF4A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E04A4		0_2_003E04A4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DF699		0_2_003DF699
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DD899		0_2_003DD899
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DC69B		0_2_003DC69B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D3085		0_2_003D3085
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DE6FD		0_2_003DE6FD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F20F8		0_2_003F20F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DBEF5		0_2_003DBEF5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F06EF		0_2_003F06EF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DA8E8		0_2_003DA8E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E7EDD		0_2_003E7EDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F0AD3		0_2_003F0AD3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D54C0		0_2_003D54C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D7739		0_2_003D7739
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E473A		0_2_003E473A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DE336		0_2_003DE336
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E3130		0_2_003E3130
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003ECF2C		0_2_003ECF2C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DB12E		0_2_003DB12E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D6125		0_2_003D6125
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E8518		0_2_003E8518
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D5314		0_2_003D5314
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D4716		0_2_003D4716
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D8112		0_2_003D8112
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E710D		0_2_003E710D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003ED10B		0_2_003ED10B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F3306		0_2_003F3306
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D597D		0_2_003D597D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D2B7C		0_2_003D2B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E5B7C		0_2_003E5B7C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D2575		0_2_003D2575
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D2176		0_2_003D2176
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EC772		0_2_003EC772
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D196D		0_2_003D196D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D996C		0_2_003D996C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D9565		0_2_003D9565
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D5166		0_2_003D5166
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DDD66		0_2_003DDD66
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EF561		0_2_003EF561
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F2560		0_2_003F2560
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D635F		0_2_003D635F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D8D59		0_2_003D8D59
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F2D4F		0_2_003F2D4F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F314A		0_2_003F314A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EC145		0_2_003EC145
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D4F42		0_2_003D4F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D33A9		0_2_003D33A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E77A7		0_2_003E77A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EBFA1		0_2_003EBFA1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E6B91		0_2_003E6B91
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D938F		0_2_003D938F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F1987		0_2_003F1987
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DF984		0_2_003DF984
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D7D87		0_2_003D7D87
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003ED5FE		0_2_003ED5FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D6BFE		0_2_003D6BFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D1DF9		0_2_003D1DF9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E91F7		0_2_003E91F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DB7EC		0_2_003DB7EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003DFBEF		0_2_003DFBEF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003F35E3		0_2_003F35E3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003EE7DA		0_2_003EE7DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E89DA		0_2_003E89DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E13DB		0_2_003E13DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D2DC5		0_2_003D2DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E4DC5		0_2_003E4DC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E0FC5		0_2_003E0FC5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D5DC3		0_2_003D5DC3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D39C3		0_2_003D39C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9D5EA0		0_2_6E9D5EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9DA6D0		0_2_6E9DA6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9DE6E0		0_2_6E9DE6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9D66E0		0_2_6E9D66E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9E0F10		0_2_6E9E0F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9D1C10		0_2_6E9D1C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9D75F4		0_2_6E9D75F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9D9D50		0_2_6E9D9D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9F0A61		0_2_6E9F0A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9DD380		0_2_6E9DD380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9D38C0		0_2_6E9D38C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9E01D0		0_2_6E9E01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028256A9		3_2_028256A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281AEB9		3_2_0281AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028306EF		3_2_028306EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282BA18		3_2_0282BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282604E		3_2_0282604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282ED95		3_2_0282ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028289DA		3_2_028289DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282E7DA		3_2_0282E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02829902		3_2_02829902
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02818112		3_2_02818112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02815314		3_2_02815314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02823130		3_2_02823130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02818D59		3_2_02818D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281196D		3_2_0281196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02812B7C		3_2_02812B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02813085		3_2_02813085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281F699		3_2_0281F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281D899		3_2_0281D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281C69B		3_2_0281C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281F4A5		3_2_0281F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028204A4		3_2_028204A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028168AD		3_2_028168AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02823ABE		3_2_02823ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028154C0		3_2_028154C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02830AD3		3_2_02830AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02827EDD		3_2_02827EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281A8E8		3_2_0281A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281BEF5		3_2_0281BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028320F8		3_2_028320F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281E6FD		3_2_0281E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281F20D		3_2_0281F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02821C12		3_2_02821C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02832C16		3_2_02832C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02820824		3_2_02820824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02820A37		3_2_02820A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282CC3F		3_2_0282CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02830C66		3_2_02830C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02831C71		3_2_02831C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282E478		3_2_0282E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02831987		3_2_02831987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281F984		3_2_0281F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02817D87		3_2_02817D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281938F		3_2_0281938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02826B91		3_2_02826B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282BFA1		3_2_0282BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028277A7		3_2_028277A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028133A9		3_2_028133A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02813FAF		3_2_02813FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028139C3		3_2_028139C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02815DC3		3_2_02815DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02812DC5		3_2_02812DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02820FC5		3_2_02820FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02824DC5		3_2_02824DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281A3D4		3_2_0281A3D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028213DB		3_2_028213DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028335E3		3_2_028335E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_028147E4		3_2_028147E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281B7EC		3_2_0281B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281FBEF		3_2_0281FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02811DF9		3_2_02811DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282D5FE		3_2_0282D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02816BFE		3_2_02816BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02833306		3_2_02833306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282D10B		3_2_0282D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02825109		3_2_02825109
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282670F		3_2_0282670F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282710D		3_2_0282710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02828518		3_2_02828518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02816125		3_2_02816125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282CF2C		3_2_0282CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281B12E		3_2_0281B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281E336		3_2_0281E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282473A		3_2_0282473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02817739		3_2_02817739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02814F42		3_2_02814F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282C145		3_2_0282C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0283314A		3_2_0283314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02832D4F		3_2_02832D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281635F		3_2_0281635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282F561		3_2_0282F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02832560		3_2_02832560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02819565		3_2_02819565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281DD66		3_2_0281DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02815166		3_2_02815166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282C772		3_2_0282C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02812575		3_2_02812575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02812176		3_2_02812176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281597D		3_2_0281597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02825B7C		3_2_02825B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D5EA0		3_2_6E9D5EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DA6D0		3_2_6E9DA6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DE6E0		3_2_6E9DE6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D66E0		3_2_6E9D66E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E0F10		3_2_6E9E0F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D1C10		3_2_6E9D1C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D75F4		3_2_6E9D75F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D9D50		3_2_6E9D9D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F0A61		3_2_6E9F0A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9DD380		3_2_6E9DD380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9D38C0		3_2_6E9D38C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9E01D0		3_2_6E9E01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF06EF		4_2_02FF06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEED95		4_2_02FEED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDE6FD		4_2_02FDE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF20F8		4_2_02FF20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDBEF5		4_2_02FDBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDA8E8		4_2_02FDA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE7EDD		4_2_02FE7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF0AD3		4_2_02FF0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD54C0		4_2_02FD54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE3ABE		4_2_02FE3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDAEB9		4_2_02FDAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD68AD		4_2_02FD68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE56A9		4_2_02FE56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDF4A5		4_2_02FDF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE04A4		4_2_02FE04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDF699		4_2_02FDF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDD899		4_2_02FDD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDC69B		4_2_02FDC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD3085		4_2_02FD3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEE478		4_2_02FEE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF1C71		4_2_02FF1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF0C66		4_2_02FF0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE604E		4_2_02FE604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FECC3F		4_2_02FECC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE0A37		4_2_02FE0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE0824		4_2_02FE0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEBA18		4_2_02FEBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF2C16		4_2_02FF2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE1C12		4_2_02FE1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDF20D		4_2_02FDF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FED5FE		4_2_02FED5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD6BFE		4_2_02FD6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD1DF9		4_2_02FD1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDB7EC		4_2_02FDB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDFBEF		4_2_02FDFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD47E4		4_2_02FD47E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF35E3		4_2_02FF35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE89DA		4_2_02FE89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEE7DA		4_2_02FEE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE13DB		4_2_02FE13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDA3D4		4_2_02FDA3D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD2DC5		4_2_02FD2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE0FC5		4_2_02FE0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD39C3		4_2_02FD39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD5DC3		4_2_02FD5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD3FAF		4_2_02FD3FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD33A9		4_2_02FD33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE77A7		4_2_02FE77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEBFA1		4_2_02FEBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE6B91		4_2_02FE6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD938F		4_2_02FD938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF1987		4_2_02FF1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDF984		4_2_02FDF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD7D87		4_2_02FD7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD597D		4_2_02FD597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD2B7C		4_2_02FD2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE5B7C		4_2_02FE5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD2575		4_2_02FD2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD2176		4_2_02FD2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEC772		4_2_02FEC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD196D		4_2_02FD196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD9565		4_2_02FD9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDDD66		4_2_02FDDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD5166		4_2_02FD5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEF561		4_2_02FEF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF2560		4_2_02FF2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD635F		4_2_02FD635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD8D59		4_2_02FD8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF2D4F		4_2_02FF2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF314A		4_2_02FF314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEC145		4_2_02FEC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD4F42		4_2_02FD4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE473A		4_2_02FE473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD7739		4_2_02FD7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDE336		4_2_02FDE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE3130		4_2_02FE3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FECF2C		4_2_02FECF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FDB12E		4_2_02FDB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD6125		4_2_02FD6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE8518		4_2_02FE8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD5314		4_2_02FD5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD8112		4_2_02FD8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE670F		4_2_02FE670F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE710D		4_2_02FE710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FED10B		4_2_02FED10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE5109		4_2_02FE5109
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FF3306		4_2_02FF3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE9902		4_2_02FE9902
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332ED95		6_2_0332ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033306EF		6_2_033306EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03323130		6_2_03323130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331E336		6_2_0331E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332473A		6_2_0332473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03317739		6_2_03317739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03316125		6_2_03316125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332CF2C		6_2_0332CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331B12E		6_2_0331B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03318112		6_2_03318112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03315314		6_2_03315314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03328518		6_2_03328518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03329902		6_2_03329902
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03333306		6_2_03333306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332D10B		6_2_0332D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03325109		6_2_03325109
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332670F		6_2_0332670F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332710D		6_2_0332710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332C772		6_2_0332C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03312575		6_2_03312575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03312176		6_2_03312176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331597D		6_2_0331597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03312B7C		6_2_03312B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03325B7C		6_2_03325B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332F561		6_2_0332F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03332560		6_2_03332560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03319565		6_2_03319565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331DD66		6_2_0331DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03315166		6_2_03315166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331196D		6_2_0331196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03318D59		6_2_03318D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331635F		6_2_0331635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03314F42		6_2_03314F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332C145		6_2_0332C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0333314A		6_2_0333314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03332D4F		6_2_03332D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332BFA1		6_2_0332BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033277A7		6_2_033277A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033133A9		6_2_033133A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03313FAF		6_2_03313FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03326B91		6_2_03326B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03331987		6_2_03331987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331F984		6_2_0331F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03317D87		6_2_03317D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331938F		6_2_0331938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03311DF9		6_2_03311DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332D5FE		6_2_0332D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03316BFE		6_2_03316BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033335E3		6_2_033335E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033147E4		6_2_033147E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331B7EC		6_2_0331B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331FBEF		6_2_0331FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331A3D4		6_2_0331A3D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033289DA		6_2_033289DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332E7DA		6_2_0332E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033213DB		6_2_033213DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033139C3		6_2_033139C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03315DC3		6_2_03315DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03312DC5		6_2_03312DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03320FC5		6_2_03320FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03320A37		6_2_03320A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332CC3F		6_2_0332CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03320824		6_2_03320824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03321C12		6_2_03321C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03332C16		6_2_03332C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332BA18		6_2_0332BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331F20D		6_2_0331F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03331C71		6_2_03331C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332E478		6_2_0332E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03330C66		6_2_03330C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332604E		6_2_0332604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331AEB9		6_2_0331AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03323ABE		6_2_03323ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331F4A5		6_2_0331F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033204A4		6_2_033204A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033256A9		6_2_033256A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033168AD		6_2_033168AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331F699		6_2_0331F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331D899		6_2_0331D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331C69B		6_2_0331C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03313085		6_2_03313085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331BEF5		6_2_0331BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033320F8		6_2_033320F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331E6FD		6_2_0331E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331A8E8		6_2_0331A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03330AD3		6_2_03330AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03327EDD		6_2_03327EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_033154C0		6_2_033154C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C806EF		7_2_02C806EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7ED95		7_2_02C7ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C654C0		7_2_02C654C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C77EDD		7_2_02C77EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C80AD3		7_2_02C80AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6A8E8		7_2_02C6A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C820F8		7_2_02C820F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6BEF5		7_2_02C6BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6E6FD		7_2_02C6E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C63085		7_2_02C63085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6C69B		7_2_02C6C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6F699		7_2_02C6F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6D899		7_2_02C6D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6F4A5		7_2_02C6F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C704A4		7_2_02C704A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C668AD		7_2_02C668AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C756A9		7_2_02C756A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C73ABE		7_2_02C73ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6AEB9		7_2_02C6AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7604E		7_2_02C7604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C80C66		7_2_02C80C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C81C71		7_2_02C81C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7E478		7_2_02C7E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6F20D		7_2_02C6F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C71C12		7_2_02C71C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C82C16		7_2_02C82C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7BA18		7_2_02C7BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C70824		7_2_02C70824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C70A37		7_2_02C70A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7CC3F		7_2_02C7CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C70FC5		7_2_02C70FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C62DC5		7_2_02C62DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C639C3		7_2_02C639C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C65DC3		7_2_02C65DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6A3D4		7_2_02C6A3D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C713DB		7_2_02C713DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C789DA		7_2_02C789DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7E7DA		7_2_02C7E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C647E4		7_2_02C647E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6FBEF		7_2_02C6FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6B7EC		7_2_02C6B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C835E3		7_2_02C835E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C66BFE		7_2_02C66BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7D5FE		7_2_02C7D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C61DF9		7_2_02C61DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C67D87		7_2_02C67D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6F984		7_2_02C6F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6938F		7_2_02C6938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C81987		7_2_02C81987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C76B91		7_2_02C76B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C777A7		7_2_02C777A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7BFA1		7_2_02C7BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C63FAF		7_2_02C63FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C633A9		7_2_02C633A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7C145		7_2_02C7C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C8314A		7_2_02C8314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C64F42		7_2_02C64F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C82D4F		7_2_02C82D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6635F		7_2_02C6635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C68D59		7_2_02C68D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6DD66		7_2_02C6DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C65166		7_2_02C65166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C69565		7_2_02C69565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7F561		7_2_02C7F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C82560		7_2_02C82560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6196D		7_2_02C6196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C62176		7_2_02C62176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C62575		7_2_02C62575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7C772		7_2_02C7C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C62B7C		7_2_02C62B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6597D		7_2_02C6597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C75B7C		7_2_02C75B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C79902		7_2_02C79902
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7670F		7_2_02C7670F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7710D		7_2_02C7710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7D10B		7_2_02C7D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C83306		7_2_02C83306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C75109		7_2_02C75109
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C65314		7_2_02C65314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C68112		7_2_02C68112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C78518		7_2_02C78518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C66125		7_2_02C66125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6B12E		7_2_02C6B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7CF2C		7_2_02C7CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6E336		7_2_02C6E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C73130		7_2_02C73130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7473A		7_2_02C7473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C67739		7_2_02C67739

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E9D1C10 appears 97 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E9ED350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E9D1C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E9ED350 appears 33 times

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Sample is known by Antivirus

Source: mal2.dll

ReversingLabs: Detection: 24%

PE file has an executable .text section and no other executable section

Source: mal2.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\mal2.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Uikrpc\tumwlrzamddm.oli",YjMy
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 7004 -ip 7004
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 308
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 7004 -ip 7004
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 316
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Uikrpc\tumwlrzamddm.oli",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,axamexdrqyrgb			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,bhramccfbdd			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Uikrpc\tumwlrzamddm.oli",YjMy			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal2.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Uikrpc\tumwlrzamddm.oli",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 7004 -ip 7004			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 308			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 7004 -ip 7004			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 316			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Creates temporary files

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF332.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal84.troj.evad.winDLL@44/21@0/30

Reads ini files

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal2.dll,Control_RunDLL

Found detection on Joe Sandbox Cloud Basic with higher score

Source: mal2.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5480:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4152:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7120:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7004

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: mal2.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: mal2.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000014.00000003.594790225.00000000005D3000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594905984.00000000005D3000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594721838.0000000004257000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000014.00000003.594862234.00000000005D9000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594794787.00000000005D9000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000014.00000003.594862234.00000000005D9000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594794787.00000000005D9000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000014.00000003.594790225.00000000005D3000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.594905984.00000000005D3000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000014.00000003.596491240.00000000045E1000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.625997812.0000000005561000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000014.00000002.605555284.0000000000162000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D151C push ds; ret		0_2_003D1527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003D150F push ds; ret		0_2_003D1527
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9F9153 push ecx; ret		0_2_6E9F9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02826496 push ecx; retf		3_2_02826497
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281150F push ds; ret		3_2_02811527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0281151C push ds; ret		3_2_02811527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0282B16F push ss; retf		3_2_0282B182
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F9153 push ecx; ret		3_2_6E9F9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE6496 push ecx; retf		4_2_02FE6497
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FEB16F push ss; retf		4_2_02FEB182
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD151C push ds; ret		4_2_02FD1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FD150F push ds; ret		4_2_02FD1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331151C push ds; ret		6_2_03311527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0331150F push ds; ret		6_2_03311527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0332B16F push ss; retf		6_2_0332B182
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03326496 push ecx; retf		6_2_03326497
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C76496 push ecx; retf		7_2_02C76497
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C7B16F push ss; retf		7_2_02C7B182
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6150F push ds; ret		7_2_02C61527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C6151C push ds; ret		7_2_02C61527

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9DE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E9DE4E0

Persistence and Installation Behavior:

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Uikrpc\tumwlrzamddm.oli

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Uikrpc\tumwlrzamddm.oli:Zone.Identifier read attributes | delete

Jump to behavior

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 2168	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4720	Thread sleep time: -30000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Found large amount of non-executed APIs

Source: C:\Windows\System32\loaddll32.exe	API coverage: 6.9 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 9.3 %

Queries a list of all running processes

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9F2FE7 FindFirstFileExW,		0_2_6E9F2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F2FE7 FindFirstFileExW,		3_2_6E9F2FE7

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.20.dr	Binary or memory string: VMware
Source: Amcache.hve.20.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.20.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.20.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.20.dr	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000005.00000002.627977305.0000017C92263000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: Amcache.hve.20.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.20.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.20.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.20.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.20.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.20.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000005.00000002.627940866.0000017C92256000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.626695848.0000017C8CC29000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.647786579.0000000004D50000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000003.645558527.0000000004D80000.00000004.00000001.sdmp, WerFault.exe, 00000018.00000002.647849827.0000000004D82000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.20.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.20.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.20.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.20.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.20.dr	Binary or memory string: VMware-42 35 44 6e 75 85 11 47-bd a2 bb ed 21 43 9f 89
Source: svchost.exe, 00000008.00000002.785008131.0000020F91447000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.785032852.00000183EA629000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.20.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9ED1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6E9ED1CC

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9DE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E9DE4E0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9D1290 GetProcessHeap,HeapAlloc,HeapFree,

0_2_6E9D1290

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_003E4315 mov eax, dword ptr fs:[00000030h]		0_2_003E4315
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9EC050 mov eax, dword ptr fs:[00000030h]		0_2_6E9EC050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9EBFE0 mov esi, dword ptr fs:[00000030h]		0_2_6E9EBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9EBFE0 mov eax, dword ptr fs:[00000030h]		0_2_6E9EBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9F12CB mov ecx, dword ptr fs:[00000030h]		0_2_6E9F12CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9F298C mov eax, dword ptr fs:[00000030h]		0_2_6E9F298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02824315 mov eax, dword ptr fs:[00000030h]		3_2_02824315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9EC050 mov eax, dword ptr fs:[00000030h]		3_2_6E9EC050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9EBFE0 mov esi, dword ptr fs:[00000030h]		3_2_6E9EBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9EBFE0 mov eax, dword ptr fs:[00000030h]		3_2_6E9EBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F12CB mov ecx, dword ptr fs:[00000030h]		3_2_6E9F12CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F298C mov eax, dword ptr fs:[00000030h]		3_2_6E9F298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE4315 mov eax, dword ptr fs:[00000030h]		4_2_02FE4315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03324315 mov eax, dword ptr fs:[00000030h]		6_2_03324315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_02C74315 mov eax, dword ptr fs:[00000030h]		7_2_02C74315

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_003DE259 LdrInitializeThunk,

0_2_003DE259

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9ECB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6E9ECB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9ED1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E9ED1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9F29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6E9F29E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9ECB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_6E9ECB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9ED1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6E9ED1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E9F29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_6E9F29E6

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal2.dll",#1			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 7004 -ip 7004			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 308			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 7004 -ip 7004			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 316			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000000.587470412.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.609050621.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.610170018.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.583006509.0000000000F60000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.787416473.0000000002DB0000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: loaddll32.exe, 00000000.00000000.587470412.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.609050621.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.610170018.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.583006509.0000000000F60000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.787416473.0000000002DB0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.587470412.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.609050621.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.610170018.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.583006509.0000000000F60000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.787416473.0000000002DB0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.587470412.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.609050621.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.610170018.0000000000F60000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.583006509.0000000000F60000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.787416473.0000000002DB0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9ECC44 cpuid

0_2_6E9ECC44

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9ECE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6E9ECE15

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.20.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000000C.00000002.784851404.000001B3C2A40000.00000004.00000001.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000C.00000002.785074018.000001B3C2B02000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 4.2.rundll32.exe.33f3568.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34a3590.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2fd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e43620.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e43620.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2c60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.743608.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d13590.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.743608.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2810000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.33f3568.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.2fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.3d0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.3d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3310000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.743608.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2b90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34a3590.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2d13590.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.582902080.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.648394572.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.583952569.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.582956002.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.584098715.000000000348A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.516939177.0000000002A69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.583809959.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.609571158.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.584033877.0000000003310000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.608882072.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.529764323.00000000033DA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.529712729.0000000002FD0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.689618667.0000000002E43000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.648560636.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.608527561.00000000003D0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.689328913.0000000002B90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.610069085.000000000073C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591122734.0000000002C60000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.533471939.0000000002810000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591237102.0000000002CFA000.00000004.00000020.sdmp, type: MEMORY