File name: | halawxtz64.dll |
Full analysis: | https://app.any.run/tasks/ae25640c-718d-4c30-9d0f-a83497c67e86 |
Verdict: | Malicious activity |
Analysis date: | August 13, 2019, 14:06:26 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
MD5: | A58D1BC502D10400CB97896E81BED088 |
SHA1: | B97A56C7BB099C4B147F03E35A8B6D49084241D8 |
SHA256: | AF1FE16F656A3509805379CD91AD074C4711A31C4D2C7C2780DD3197F6B2234C |
SSDEEP: | 12288:+ONvKFINaNPQWZpCAp9RlA9TCr1o4Eg/e1vuAAt3y:+OpK6NaNQupCAp9fA9Tgeg/e1mAwy |
.exe | | | Win32 EXE PECompact compressed (generic) (70.7) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (11.2) |
.exe | | | Win32 Executable (generic) (7.6) |
.exe | | | Win16/32 Executable Delphi generic (3.5) |
.exe | | | Generic Win/DOS Executable (3.4) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 5 |
ImageVersion: | - |
OSVersion: | 5 |
EntryPoint: | 0xd67f8 |
UninitializedDataSize: | - |
InitializedDataSize: | 117760 |
CodeSize: | 871424 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
TimeStamp: | 2019:07:19 14:07:38+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 19-Jul-2019 12:07:38 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 10 |
Time date stamp: | 19-Jul-2019 12:07:38 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000D4020 | 0x000D4200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.47665 |
.itext | 0x000D6000 | 0x00000950 | 0x00000A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.95523 |
.data | 0x000D7000 | 0x00003A60 | 0x00003C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.27998 |
.bss | 0x000DB000 | 0x00005DD8 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x000E1000 | 0x00001116 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.85016 |
.didata | 0x000E3000 | 0x000001EA | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.35631 |
.edata | 0x000E4000 | 0x000000A1 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.04721 |
.rdata | 0x000E5000 | 0x00000044 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.16606 |
.reloc | 0x000E6000 | 0x000149C8 | 0x00014A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.70069 |
.rsrc | 0x000FB000 | 0x00002E00 | 0x00002E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.85415 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.17015 | 752 | UNKNOWN | English - United States | RT_MANIFEST |
4085 | 3.189 | 880 | UNKNOWN | UNKNOWN | RT_STRING |
4086 | 3.42742 | 660 | UNKNOWN | UNKNOWN | RT_STRING |
4087 | 3.2383 | 1308 | UNKNOWN | UNKNOWN | RT_STRING |
4088 | 3.29018 | 936 | UNKNOWN | UNKNOWN | RT_STRING |
4089 | 3.34605 | 1068 | UNKNOWN | UNKNOWN | RT_STRING |
4090 | 3.33048 | 528 | UNKNOWN | UNKNOWN | RT_STRING |
4091 | 3.3597 | 188 | UNKNOWN | UNKNOWN | RT_STRING |
4092 | 3.4421 | 256 | UNKNOWN | UNKNOWN | RT_STRING |
4093 | 3.29873 | 824 | UNKNOWN | UNKNOWN | RT_STRING |
advapi32.dll |
kernel32.dll |
kernel32.dll (delay-loaded) |
netapi32.dll |
oleaut32.dll |
user32.dll |
version.dll |
Title | Ordinal | Address |
---|---|---|
dbkFCallWrapperAddr | 1 | 0x000DE630 |
__dbk_fcall_wrapper | 2 | 0x0001018C |
TMethodImplementationIntercept | 3 | 0x0005C580 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2156 | "C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\halawxtz64.dll.exe", dbkFCallWrapperAddr | C:\Windows\System32\rundll32.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
628 | C:\Windows\system32\WerFault.exe -u -p 2156 -s 232 | C:\Windows\system32\WerFault.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
628 | WerFault.exe | C:\Users\admin\AppData\Local\Temp\WER3D69.tmp.mdmp | — | |
MD5:— | SHA256:— | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Temp\WER3CDB.tmp.hdmp | dmp | |
MD5:D3B1D7F180055694124556A321FCF843 | SHA256:06DF2712ED6B9C5B2576568A83AAA5612D4D55C6E909745DBA9E507F8D0140E0 | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_hal_c5aa2ab01f1c364f9726d15efcb9d424bd9c2_cab_024c3dd3\WER3CAB.tmp.appcompat.txt | xml | |
MD5:9DA48200216365B3D6EA1E07E9E1ED27 | SHA256:4D0A0E95A0DA9941DF9E613ED7FD23C0F681A2E410D0BF54E24AAAB7993F6296 | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_hal_c5aa2ab01f1c364f9726d15efcb9d424bd9c2_cab_024c3dd3\WERAFFB.tmp.WERInternalMetadata.xml | xml | |
MD5:6BCE39174CD93BCFA780DF8AC78DAD4E | SHA256:A5F9E89E265FE96D91390914D11276DA9503F457726A0E2BD5161913244546E4 | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Temp\WERAFFB.tmp.WERInternalMetadata.xml | xml | |
MD5:6BCE39174CD93BCFA780DF8AC78DAD4E | SHA256:A5F9E89E265FE96D91390914D11276DA9503F457726A0E2BD5161913244546E4 | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\rundll32.exe.2156.dmp | dmp | |
MD5:9F9A76CBBEBE41CA7AA408B3C710F3E2 | SHA256:B0E22A37D3B4C8421467FE6AFDC571FC46A663709218D3C2B9F5B9B4FADE32C3 | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_hal_c5aa2ab01f1c364f9726d15efcb9d424bd9c2_cab_024c3dd3\WER3D69.tmp.mdmp | dmp | |
MD5:F19F0E0DB65B7D18CCD54028EE99A6C3 | SHA256:AF8D908D2648C6944E9B0931D5D89A75FBB4F5155509286168412B948A04DBEB | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_hal_c5aa2ab01f1c364f9726d15efcb9d424bd9c2_cab_024c3dd3\WER3CDB.tmp.hdmp | dmp | |
MD5:D3B1D7F180055694124556A321FCF843 | SHA256:06DF2712ED6B9C5B2576568A83AAA5612D4D55C6E909745DBA9E507F8D0140E0 | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_hal_c5aa2ab01f1c364f9726d15efcb9d424bd9c2_cab_024c3dd3\Report.wer | binary | |
MD5:76BDADB40FB39421655524223DDDD018 | SHA256:267DA1C490EBD4149260BF70690D4C48D0A0110FC22DE009AD6D15141779501E | |||
628 | WerFault.exe | C:\Users\admin\AppData\Local\Temp\WER3CAB.tmp.appcompat.txt | xml | |
MD5:9DA48200216365B3D6EA1E07E9E1ED27 | SHA256:4D0A0E95A0DA9941DF9E613ED7FD23C0F681A2E410D0BF54E24AAAB7993F6296 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
628 | WerFault.exe | 20.44.86.127:80 | watson.microsoft.com | — | US | suspicious |
Domain | IP | Reputation |
---|---|---|
watson.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
628 | WerFault.exe | Potential Corporate Privacy Violation | ET POLICY Application Crash Report Sent to Microsoft |
628 | WerFault.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |