File name: | 0fddbdad539feeb904e7fdfa0a1172bbdb64d74b5406c76a36ec30a1496ac463 |
Full analysis: | https://app.any.run/tasks/c4650f9a-255a-47a4-8064-83e89b5c5b33 |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 09:55:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
MD5: | BBE1F27389E3ABE94176A71F1B9D6E45 |
SHA1: | 1A956BF0C7B84B70EC33EA829A3161287F8287AC |
SHA256: | 0FDDBDAD539FEEB904E7FDFA0A1172BBDB64D74B5406C76A36EC30A1496AC463 |
SSDEEP: | 49152:fytvjkR51HGhujN60iVU/o3O8dTMDoCAV:fovjWJ606Ug3O8d |
.exe | | | Win32 EXE PECompact compressed (generic) (70.7) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (11.2) |
.exe | | | Win32 Executable (generic) (7.6) |
.exe | | | Win16/32 Executable Delphi generic (3.5) |
.exe | | | Generic Win/DOS Executable (3.4) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2019:09:30 20:41:35+02:00 |
PEType: | PE32 |
LinkerVersion: | 2.25 |
CodeSize: | 1887232 |
InitializedDataSize: | 256512 |
UninitializedDataSize: | - |
EntryPoint: | 0x1ce7ac |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 30-Sep-2019 18:41:35 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 10 |
Time date stamp: | 30-Sep-2019 18:41:35 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x001CB020 | 0x001CB200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.53588 |
.itext | 0x001CD000 | 0x00001814 | 0x00001A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.09901 |
.data | 0x001CF000 | 0x00016FB0 | 0x00017000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.70059 |
.bss | 0x001E6000 | 0x00007ED8 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x001EE000 | 0x00002600 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.1929 |
.didata | 0x001F1000 | 0x000001D4 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.22228 |
.edata | 0x001F2000 | 0x000000AB | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.08727 |
.rdata | 0x001F3000 | 0x00000044 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.16606 |
.reloc | 0x001F4000 | 0x00020998 | 0x00020A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.6995 |
.rsrc | 0x00215000 | 0x00004400 | 0x00004400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.24477 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
4079 | 3.34782 | 976 | UNKNOWN | UNKNOWN | RT_STRING |
4080 | 3.3442 | 644 | UNKNOWN | UNKNOWN | RT_STRING |
4081 | 2.5 | 64 | UNKNOWN | UNKNOWN | RT_STRING |
4082 | 2.5 | 64 | UNKNOWN | UNKNOWN | RT_STRING |
4083 | 2.5 | 64 | UNKNOWN | UNKNOWN | RT_STRING |
4084 | 3.3035 | 680 | UNKNOWN | UNKNOWN | RT_STRING |
4085 | 3.33735 | 972 | UNKNOWN | UNKNOWN | RT_STRING |
4086 | 3.52387 | 920 | UNKNOWN | UNKNOWN | RT_STRING |
4087 | 3.23072 | 1176 | UNKNOWN | UNKNOWN | RT_STRING |
4088 | 3.30539 | 912 | UNKNOWN | UNKNOWN | RT_STRING |
advapi32.dll |
esent.dll |
gdi32.dll |
kernel32.dll |
kernel32.dll (delay-loaded) |
msvcrt.dll |
netapi32.dll |
ntdll.dll |
ole32.dll |
oleaut32.dll |
Title | Ordinal | Address |
---|---|---|
dbkFCallWrapperAddr | 1 | 0x001E9634 |
__dbk_fcall_wrapper | 2 | 0x0000F018 |
TMethodImplementationIntercept | 3 | 0x00056070 |
MainProc | 4 | 0x001C3A8C |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1772 | "C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\0fddbdad539feeb904e7fdfa0a1172bbdb64d74b5406c76a36ec30a1496ac463.exe", dbkFCallWrapperAddr | C:\Windows\System32\rundll32.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3868 | C:\Windows\system32\WerFault.exe -u -p 1772 -s 340 | C:\Windows\system32\WerFault.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3868 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_0fd_47e0b9b15d57c3879b4022273f8134b2f436d5_0f25ccef\Report.wer | binary | |
MD5:5DFC8AA391A6E4E6726D81ACE346212F | SHA256:8A8558194C317B7E71C7C232CB3A8CD6486C04E544F7C043DECC40AACAB65A1F | |||
3868 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\rundll32.exe.1772.dmp | dmp | |
MD5:1CE0D708970C67F7D509BB7519345A23 | SHA256:D82ABB6FE19428FDD4BC7723FFAC87FC08EA2572E092894D4F577611CF079635 |