=
flash

triage_dropped_file.dll

Status: finished
Submission Time: 23.12.2021 15:41:11
Malicious
Trojan
Evader
Dridex

Comments

Tags

  • 22201
  • dll
  • dridex

Details

  • Analysis ID:
    544521
  • API (Web) ID:
    912043
  • Analysis Started:
    23.12.2021 15:41:11
  • Analysis Finished:
    23.12.2021 15:57:49
  • MD5:
    e95ef0e572a9b18fdb848cfe2c56d3e5
  • SHA1:
    dec119bc3ac328ce0f914731182d2109381d6d0a
  • SHA256:
    7c86d999e3b4df3541fda635146705484b6216ae82cf614a3b576441e4092246
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
76/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Run with higher sleep bypass

malicious
76/100

malicious
8/43

IPs

IP Country Detection
185.4.135.27
Greece
85.10.248.28
Germany
80.211.3.13
Italy
Click to see the 1 hidden entries
144.91.122.102
Germany

URLs

Name Detection
http://upx.sf.net
http://www.baxleystamps.comDVarFileInfo$

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_3e2aba14ae6839fafa2e423496d524d852da7165_82810a17_0cfc6ceb\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5675.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Dec 23 23:42:12 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EB3.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 3 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WER60D7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
#
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
MS Windows registry file, NT/2000 or above
#