Windows Analysis Report TYLNb8VvnmYA.dll

AV Detection:

Found malware configuration

Source: 0.0.loaddll32.exe.9e0000.6.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Source: TYLNb8VvnmYA.dll

Virustotal: Detection: 25%

Perma Link

Compliance:

Uses 32bit PE files

Source: TYLNb8VvnmYA.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TYLNb8VvnmYA.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.564262336.0000000002CDC000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.564338368.0000000002CA9000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564358097.0000000002CA9000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000016.00000003.564338368.0000000002CA9000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564358097.0000000002CA9000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.564520249.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564326548.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.585713559.000000000320C000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.586254473.000000000320C000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.578653087.00000000005E2000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000016.00000003.564520249.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564326548.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.585713559.000000000320C000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.586254473.000000000320C000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECE2FE7 FindFirstFileExW,		0_2_6ECE2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECE2FE7 FindFirstFileExW,		4_2_6ECE2FE7

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT
Source: Joe Sandbox View	ASN Name: RACKCORP-APRackCorpAU RACKCORP-APRackCorpAU

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 18

URLs found in memory or binary data

Source: WerFault.exe, 00000019.00000003.599154810.0000000004D72000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.600553614.0000000004D72000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WerFault.exe, 00000019.00000002.600418522.0000000003158000.00000004.00000020.sdmp	String found in binary or memory: http://crl.microsoft
Source: Amcache.hve.22.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 00000009.00000002.398712161.000001424C613000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000002.00000002.679231655.0000018D2F245000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000002.00000002.679231655.0000018D2F245000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000002.00000002.679231655.0000018D2F245000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000002.00000002.679102531.0000018D2F22A000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000002.00000002.679102531.0000018D2F22A000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000009.00000003.369044474.000001424C65D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.369049789.000001424C658000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.411168359.000001424C659000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.403271535.000001424C629000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.369049789.000001424C658000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.411168359.000001424C659000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000002.413717159.000001424C66A000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369025048.000001424C668000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.369069267.000001424C642000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369057963.000001424C641000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.409097273.000001424C64C000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369083115.000001424C645000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000003.369049789.000001424C658000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.411168359.000001424C659000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000002.403271535.000001424C629000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000009.00000003.334621644.000001424C634000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000002.412108697.000001424C660000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369041405.000001424C65F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000009.00000002.403271535.000001424C629000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.369049789.000001424C658000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.411168359.000001424C659000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369057963.000001424C641000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000009.00000003.369044474.000001424C65D000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.369049789.000001424C658000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.411168359.000001424C659000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.369049789.000001424C658000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.411168359.000001424C659000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.369083115.000001424C645000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000009.00000003.369038841.000001424C662000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.403271535.000001424C629000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.334621644.000001424C634000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.334621644.000001424C634000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369075670.000001424C63D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000002.407719066.000001424C640000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.403271535.000001424C629000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.334621644.000001424C634000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.334621644.000001424C634000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.334621644.000001424C634000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000003.334621644.000001424C634000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369075670.000001424C63D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000009.00000003.369069267.000001424C642000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369057963.000001424C641000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.409097273.000001424C64C000.00000004.00000001.sdmp, svchost.exe, 00000009.00000003.369083115.000001424C645000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: 7.2.rundll32.exe.c620f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.632468.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a63b78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.1110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.1110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.632468.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a63b78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.32a4168.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.c620f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.32a4168.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.bc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3273688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.bc0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3273688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.540649559.00000000010F0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.557294263.0000000001110000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.582540666.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.546594533.0000000000A10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.659478506.0000000000BC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.558410733.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.558256416.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.581726309.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.582467938.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.659377295.000000000061A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.601059851.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.528291798.0000000000C69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.601107965.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.557479491.000000000328A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.556361000.0000000000C4A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.559892277.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.556237004.0000000000B10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.581678982.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.559720602.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.540803207.000000000325A000.00000004.00000020.sdmp, type: MEMORY

System Summary:

Uses 32bit PE files

Source: TYLNb8VvnmYA.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5808 -ip 5808

Deletes files inside the Windows folder

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Gipupxhph\siawepkk.qzv:Zone.Identifier

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Gipupxhph\

Jump to behavior

Detected potential crypto function

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECCA6D0		0_2_6ECCA6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECCE6E0		0_2_6ECCE6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECC66E0		0_2_6ECC66E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECC5EA0		0_2_6ECC5EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECD0F10		0_2_6ECD0F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECC1C10		0_2_6ECC1C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECC75F4		0_2_6ECC75F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECC9D50		0_2_6ECC9D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECE0A61		0_2_6ECE0A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECCD380		0_2_6ECCD380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECC38C0		0_2_6ECC38C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECD01D0		0_2_6ECD01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECCA6D0		4_2_6ECCA6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECCE6E0		4_2_6ECCE6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECC66E0		4_2_6ECC66E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECC5EA0		4_2_6ECC5EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECD0F10		4_2_6ECD0F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECC1C10		4_2_6ECC1C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECC75F4		4_2_6ECC75F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECC9D50		4_2_6ECC9D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECE0A61		4_2_6ECE0A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECCD380		4_2_6ECCD380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECC38C0		4_2_6ECC38C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECD01D0		4_2_6ECD01D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110ED95		5_2_0110ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011106EF		5_2_011106EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01108518		5_2_01108518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01113306		5_2_01113306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F4716		5_2_010F4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110D10B		5_2_0110D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F5314		5_2_010F5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F8112		5_2_010F8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110710D		5_2_0110710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01103130		5_2_01103130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FB12E		5_2_010FB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110473A		5_2_0110473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F6125		5_2_010F6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F7739		5_2_010F7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FE336		5_2_010FE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110CF2C		5_2_0110CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F4F42		5_2_010F4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F635F		5_2_010F635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110C145		5_2_0110C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F8D59		5_2_010F8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0111314A		5_2_0111314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01112D4F		5_2_01112D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110C772		5_2_0110C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F196D		5_2_010F196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F996C		5_2_010F996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F5166		5_2_010F5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FDD66		5_2_010FDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F9565		5_2_010F9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01105B7C		5_2_01105B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110F561		5_2_0110F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01112560		5_2_01112560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F597D		5_2_010F597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F2B7C		5_2_010F2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F2176		5_2_010F2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F2575		5_2_010F2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F938F		5_2_010F938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F7D87		5_2_010F7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FF984		5_2_010FF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01111987		5_2_01111987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F33A9		5_2_010F33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110BFA1		5_2_0110BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011077A7		5_2_011077A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110E7DA		5_2_0110E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F2DC5		5_2_010F2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011089DA		5_2_011089DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011013DB		5_2_011013DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F5DC3		5_2_010F5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F39C3		5_2_010F39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01104DC5		5_2_01104DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01100FC5		5_2_01100FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FFBEF		5_2_010FFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FB7EC		5_2_010FB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011091F7		5_2_011091F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110D5FE		5_2_0110D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F6BFE		5_2_010F6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011135E3		5_2_011135E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F1DF9		5_2_010F1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FF20D		5_2_010FF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01101C12		5_2_01101C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01112C16		5_2_01112C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110BA18		5_2_0110BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01100A37		5_2_01100A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110CC3F		5_2_0110CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01100824		5_2_01100824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F3E3B		5_2_010F3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110645F		5_2_0110645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110604E		5_2_0110604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01111C71		5_2_01111C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110E478		5_2_0110E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01110C66		5_2_01110C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F3085		5_2_010F3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FC69B		5_2_010FC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FF699		5_2_010FF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FD899		5_2_010FD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F68AD		5_2_010F68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0110B0BA		5_2_0110B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FF4A5		5_2_010FF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01103ABE		5_2_01103ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011004A4		5_2_011004A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FAEB9		5_2_010FAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011056A9		5_2_011056A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01110AD3		5_2_01110AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01107EDD		5_2_01107EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F54C0		5_2_010F54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FA8E8		5_2_010FA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_011120F8		5_2_011120F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FE6FD		5_2_010FE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010FBEF5		5_2_010FBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112ED95		8_2_0112ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011306EF		8_2_011306EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01118112		8_2_01118112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01115314		8_2_01115314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01114716		8_2_01114716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01128518		8_2_01128518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01133306		8_2_01133306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112D10B		8_2_0112D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112710D		8_2_0112710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01123130		8_2_01123130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111E336		8_2_0111E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01117739		8_2_01117739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112473A		8_2_0112473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01116125		8_2_01116125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112CF2C		8_2_0112CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111B12E		8_2_0111B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01118D59		8_2_01118D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111635F		8_2_0111635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01114F42		8_2_01114F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112C145		8_2_0112C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0113314A		8_2_0113314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01132D4F		8_2_01132D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112C772		8_2_0112C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01112575		8_2_01112575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01112176		8_2_01112176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111597D		8_2_0111597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01112B7C		8_2_01112B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01125B7C		8_2_01125B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112F561		8_2_0112F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01132560		8_2_01132560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01119565		8_2_01119565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01115166		8_2_01115166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111DD66		8_2_0111DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111196D		8_2_0111196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111996C		8_2_0111996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01131987		8_2_01131987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111F984		8_2_0111F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01117D87		8_2_01117D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111938F		8_2_0111938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112BFA1		8_2_0112BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011277A7		8_2_011277A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011133A9		8_2_011133A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112E7DA		8_2_0112E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011289DA		8_2_011289DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011213DB		8_2_011213DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01115DC3		8_2_01115DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011139C3		8_2_011139C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01112DC5		8_2_01112DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01124DC5		8_2_01124DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01120FC5		8_2_01120FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011291F7		8_2_011291F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01111DF9		8_2_01111DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112D5FE		8_2_0112D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01116BFE		8_2_01116BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011335E3		8_2_011335E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111B7EC		8_2_0111B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111FBEF		8_2_0111FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01121C12		8_2_01121C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01132C16		8_2_01132C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112BA18		8_2_0112BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111F20D		8_2_0111F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01120A37		8_2_01120A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01113E3B		8_2_01113E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112CC3F		8_2_0112CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01120824		8_2_01120824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112645F		8_2_0112645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112604E		8_2_0112604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01131C71		8_2_01131C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112E478		8_2_0112E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01130C66		8_2_01130C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111F699		8_2_0111F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111D899		8_2_0111D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111C69B		8_2_0111C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01113085		8_2_01113085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0112B0BA		8_2_0112B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111AEB9		8_2_0111AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01123ABE		8_2_01123ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111F4A5		8_2_0111F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011204A4		8_2_011204A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011256A9		8_2_011256A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011168AD		8_2_011168AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01130AD3		8_2_01130AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01127EDD		8_2_01127EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011154C0		8_2_011154C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111BEF5		8_2_0111BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_011320F8		8_2_011320F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111E6FD		8_2_0111E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111A8E8		8_2_0111A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE06EF		13_2_00BE06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDED95		13_2_00BDED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD3ABE		13_2_00BD3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCAEB9		13_2_00BCAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDB0BA		13_2_00BDB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC68AD		13_2_00BC68AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD56A9		13_2_00BD56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD04A4		13_2_00BD04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCF4A5		13_2_00BCF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCF699		13_2_00BCF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCD899		13_2_00BCD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCC69B		13_2_00BCC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC3085		13_2_00BC3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCE6FD		13_2_00BCE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE20F8		13_2_00BE20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCBEF5		13_2_00BCBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCA8E8		13_2_00BCA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD7EDD		13_2_00BD7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE0AD3		13_2_00BE0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC54C0		13_2_00BC54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDCC3F		13_2_00BDCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC3E3B		13_2_00BC3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD0A37		13_2_00BD0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD0824		13_2_00BD0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDBA18		13_2_00BDBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE2C16		13_2_00BE2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD1C12		13_2_00BD1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCF20D		13_2_00BCF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDE478		13_2_00BDE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE1C71		13_2_00BE1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE0C66		13_2_00BE0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD645F		13_2_00BD645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD604E		13_2_00BD604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC33A9		13_2_00BC33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD77A7		13_2_00BD77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDBFA1		13_2_00BDBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC938F		13_2_00BC938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCF984		13_2_00BCF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE1987		13_2_00BE1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC7D87		13_2_00BC7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC6BFE		13_2_00BC6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDD5FE		13_2_00BDD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC1DF9		13_2_00BC1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD91F7		13_2_00BD91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCB7EC		13_2_00BCB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCFBEF		13_2_00BCFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE35E3		13_2_00BE35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD13DB		13_2_00BD13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDE7DA		13_2_00BDE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD89DA		13_2_00BD89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD4DC5		13_2_00BD4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD0FC5		13_2_00BD0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC2DC5		13_2_00BC2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC5DC3		13_2_00BC5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC39C3		13_2_00BC39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC7739		13_2_00BC7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD473A		13_2_00BD473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCE336		13_2_00BCE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD3130		13_2_00BD3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDCF2C		13_2_00BDCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCB12E		13_2_00BCB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC6125		13_2_00BC6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD8518		13_2_00BD8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC5314		13_2_00BC5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC4716		13_2_00BC4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC8112		13_2_00BC8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD710D		13_2_00BD710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDD10B		13_2_00BDD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE3306		13_2_00BE3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC2B7C		13_2_00BC2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD5B7C		13_2_00BD5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC597D		13_2_00BC597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC2575		13_2_00BC2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC2176		13_2_00BC2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDC772		13_2_00BDC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC996C		13_2_00BC996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC196D		13_2_00BC196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC9565		13_2_00BC9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC5166		13_2_00BC5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BCDD66		13_2_00BCDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDF561		13_2_00BDF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE2560		13_2_00BE2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC635F		13_2_00BC635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC8D59		13_2_00BC8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE2D4F		13_2_00BE2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BE314A		13_2_00BE314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BDC145		13_2_00BDC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC4F42		13_2_00BC4F42

Found potential string decryption / allocating functions

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6ECC1C10 appears 97 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6ECDD350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6ECC1C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6ECDD350 appears 33 times

Abnormal high CPU Usage

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Sample is known by Antivirus

Source: TYLNb8VvnmYA.dll

Virustotal: Detection: 25%

PE file has an executable .text section and no other executable section

Source: TYLNb8VvnmYA.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,bhramccfbdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gipupxhph\siawepkk.qzv",iJIySwmeuqOefH
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5808 -ip 5808
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 304
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5808 -ip 5808
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 324
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Gipupxhph\siawepkk.qzv",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,axamexdrqyrgb			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,bhramccfbdd			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gipupxhph\siawepkk.qzv",iJIySwmeuqOefH			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Gipupxhph\siawepkk.qzv",Control_RunDLL			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5808 -ip 5808			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5808 -ip 5808			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 324			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Creates temporary files

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB9F.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal84.troj.evad.winDLL@43/16@0/29

Reads ini files

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TYLNb8VvnmYA.dll,Control_RunDLL

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3644:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6424:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2532:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5808

Reads the hosts file

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TYLNb8VvnmYA.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: TYLNb8VvnmYA.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.564262336.0000000002CDC000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.564338368.0000000002CA9000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564358097.0000000002CA9000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000016.00000003.564338368.0000000002CA9000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564358097.0000000002CA9000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.564520249.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564326548.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.585713559.000000000320C000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.586254473.000000000320C000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.566851416.0000000004E91000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.590940435.00000000050B1000.00000004.00000001.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000016.00000002.578653087.00000000005E2000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000016.00000003.564520249.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.564326548.0000000002C9D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.585713559.000000000320C000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.586254473.000000000320C000.00000004.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECE9153 push ecx; ret		0_2_6ECE9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECE9153 push ecx; ret		4_2_6ECE9166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F150F push ds; ret		5_2_010F1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_010F151C push ds; ret		5_2_010F1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111151C push ds; ret		8_2_01111527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_0111150F push ds; ret		8_2_01111527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC151C push ds; ret		13_2_00BC1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BC150F push ds; ret		13_2_00BC1527

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECCE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6ECCE4E0

Persistence and Installation Behavior:

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Gipupxhph\siawepkk.qzv

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Gipupxhph\siawepkk.qzv:Zone.Identifier read attributes | delete

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Found large amount of non-executed APIs

Source: C:\Windows\System32\loaddll32.exe	API coverage: 6.9 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 7.6 %

Queries a list of all running processes

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECE2FE7 FindFirstFileExW,		0_2_6ECE2FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECE2FE7 FindFirstFileExW,		4_2_6ECE2FE7

Checks the free space of harddrives

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: Amcache.hve.22.dr	Binary or memory string: VMware
Source: Amcache.hve.22.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000019.00000003.597789583.0000000004D37000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: Amcache.hve.22.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.22.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.22.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.22.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.22.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 00000019.00000003.599090824.0000000004D5D000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000002.600542842.0000000004D5F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.22.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.22.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.22.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.22.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.22.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: WerFault.exe, 00000019.00000002.600515890.0000000004D38000.00000004.00000001.sdmp, WerFault.exe, 00000019.00000003.599177113.0000000004D38000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000002.00000002.679402834.0000018D2F268000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.678647533.00000193C6A29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.22.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECDD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6ECDD1CC

Contains functionality to dynamically determine API calls

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECCE4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6ECCE4E0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECC1290 GetProcessHeap,HeapAlloc,HeapFree,

0_2_6ECC1290

Contains functionality to read the PEB

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECDC050 mov eax, dword ptr fs:[00000030h]		0_2_6ECDC050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECDBFE0 mov esi, dword ptr fs:[00000030h]		0_2_6ECDBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECDBFE0 mov eax, dword ptr fs:[00000030h]		0_2_6ECDBFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECE12CB mov ecx, dword ptr fs:[00000030h]		0_2_6ECE12CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECE298C mov eax, dword ptr fs:[00000030h]		0_2_6ECE298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDC050 mov eax, dword ptr fs:[00000030h]		4_2_6ECDC050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDBFE0 mov esi, dword ptr fs:[00000030h]		4_2_6ECDBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDBFE0 mov eax, dword ptr fs:[00000030h]		4_2_6ECDBFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECE12CB mov ecx, dword ptr fs:[00000030h]		4_2_6ECE12CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECE298C mov eax, dword ptr fs:[00000030h]		4_2_6ECE298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_01104315 mov eax, dword ptr fs:[00000030h]		5_2_01104315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_01124315 mov eax, dword ptr fs:[00000030h]		8_2_01124315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_00BD4315 mov eax, dword ptr fs:[00000030h]		13_2_00BD4315

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECDCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6ECDCB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECDD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6ECDD1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6ECE29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6ECE29E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDCB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_6ECDCB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECDD1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6ECDD1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6ECE29E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6ECE29E6

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TYLNb8VvnmYA.dll",#1			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5808 -ip 5808			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 304			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5808 -ip 5808			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 324			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: loaddll32.exe, 00000000.00000000.560057714.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.558542817.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.581833872.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.582621925.0000000001120000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.679386808.00000000031A0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.560057714.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.558542817.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.581833872.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.582621925.0000000001120000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.679386808.00000000031A0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.560057714.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.558542817.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.581833872.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.582621925.0000000001120000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.679386808.00000000031A0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.560057714.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.558542817.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.581833872.0000000001120000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.582621925.0000000001120000.00000002.00020000.sdmp, rundll32.exe, 0000001D.00000002.679386808.00000000031A0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECDCC44 cpuid

0_2_6ECDCC44

Contains functionality to query local / system time

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6ECDCE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6ECDCE15

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.LOG1.22.dr, Amcache.hve.22.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.22.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 0000000B.00000002.678404306.00000262C083D000.00000004.00000001.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000B.00000002.678609431.00000262C0902000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.678341900.00000262C0829000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.LOG1.22.dr, Amcache.hve.22.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: 7.2.rundll32.exe.c620f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.632468.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a63b78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.1110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.1110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.a10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.632468.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.a63b78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.32a4168.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.c620f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.32a4168.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.bc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3273688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.rundll32.exe.bc0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3273688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.9e0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.a63b78.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.540649559.00000000010F0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.557294263.0000000001110000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.582540666.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.546594533.0000000000A10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.659478506.0000000000BC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.558410733.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.558256416.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.581726309.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.582467938.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.659377295.000000000061A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.601059851.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.528291798.0000000000C69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.601107965.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.557479491.000000000328A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.556361000.0000000000C4A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.559892277.0000000000A5C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.556237004.0000000000B10000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.581678982.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.559720602.00000000009E0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.540803207.000000000325A000.00000004.00000020.sdmp, type: MEMORY