IOC Report
pebbles.dat.dll

loading gif

Files

File Path
Type
Category
Malicious
pebbles.dat.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\Desktop\pebbles.dat.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Windows\System32\loaddll32.exe
loaddll32.exe "C:\Users\user\Desktop\pebbles.dat.dll"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pebbles.dat.dll",#1
 malicious
C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\Users\user\Desktop\pebbles.dat.dll
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\pebbles.dat.dll",#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\pebbles.dat.dll,DllRegisterServer
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\pebbles.dat.dll,DllUnregisterServer
 malicious
C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
 malicious
C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
 malicious
C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\pebbles.dat.dll,bewailable
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 1 hidden processes, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
dbdf127f
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
ee40c231
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
ec01e24d
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
54bd8528
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
29b5caa2
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
9109adc7
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
56fca554
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
a4967d89
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
dbdf127f
HKEY_CURRENT_USER\Software\Microsoft\Rqqahuvpx
dbdf127f

Memdumps

Base Address
Regiontype
Protect
Malicious
4A40000
trusted library allocation
page read and write
 malicious
3160000
trusted library allocation
page execute and read and write
 malicious
32E0000
trusted library allocation
page read and write
 malicious
29B0000
system
page execute and read and write
 malicious
2C60000
system
page execute and read and write
 malicious
3140000
trusted library allocation
page read and write
 malicious
2D40000
system
page execute and read and write
 malicious
4A60000
trusted library allocation
page execute and read and write
 malicious
2D40000
system
page execute and read and write
 malicious
2C60000
system
page execute and read and write
 malicious
3460000
trusted library allocation
page execute and read and write
 malicious
2FA8000
trusted library allocation
page read and write
1E5A5000000
heap
page read and write
2C130602000
heap
page read and write
2FC8000
trusted library allocation
page read and write
2D10000
unkown
page readonly
11E0000
heap
page read and write
2C130689000
heap
page read and write
940000
heap
page read and write
31E0000
heap
page read and write
2E091429000
heap
page read and write
518C000
trusted library allocation
page read and write
1E5A4F00000
heap
page read and write
2C1304B0000
heap
page read and write
3051000
trusted library allocation
page read and write
2701405C000
heap
page read and write
4E20000
trusted library allocation
page read and write
6D930000
unkown
page readonly
2FC8000
trusted library allocation
page read and write
2FC8000
trusted library allocation
page read and write
310F000
unkown
page read and write
D14000
heap
page read and write
72B6000
trusted library allocation
page read and write
2D20000
unkown
page readonly
F9641FF000
stack
page read and write
4AD3000
heap
page read and write
1E91A857000
heap
page read and write
1E91A900000
heap
page read and write
730000
heap
page read and write
1E5A5043000
heap
page read and write
2701402A000
heap
page read and write
3490000
trusted library allocation
page read and write
2C50000
unkown
page read and write
6AB2000
trusted library allocation
page read and write
32DE000
stack
page read and write
2C40000
unkown
page readonly
2FA8000
trusted library allocation
page read and write
2D10000
unkown
page readonly
1E91A889000
heap
page read and write
4ED0000
heap
page read and write
364217C000
stack
page read and write
19078A6E000
heap
page read and write
A63A07D000
stack
page read and write
2FAA000
trusted library allocation
page read and write
2FC8000
trusted library allocation
page read and write
2FA8000
trusted library allocation
page read and write
A20000
heap
page read and write
F9644FF000
stack
page read and write
29ED000
stack
page read and write