analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sway.dll

Full analysis: https://app.any.run/tasks/18af6d2c-97e6-448a-8c50-a8f599485a70
Verdict: Malicious activity
Analysis date: March 31, 2020, 09:52:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5:

86A08A3D27E10E6DAAA094BFB51B327D

SHA1:

0220E7040BC4CB309D4AEBA7539A55127E4B5527

SHA256:

EC0667BB988900F5E17F159AEBFE8687BCAF8467B1201F728DF183BEE78BDAB5

SSDEEP:

768:lz2okehNaNJoLgsoU4ZAp9UEPbYn4Ecnd4hA+vNkqR1f1ZWoNK26M69LMCxdRSyo:taEUELnoUqDfvmbIiT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 1140)
      • rundll32.exe (PID: 2856)
      • rundll32.exe (PID: 2892)
      • rundll32.exe (PID: 2788)
      • rundll32.exe (PID: 3600)
      • rundll32.exe (PID: 3776)
      • rundll32.exe (PID: 2960)
      • rundll32.exe (PID: 3420)
      • rundll32.exe (PID: 4060)
      • rundll32.exe (PID: 304)
      • rundll32.exe (PID: 3100)
      • rundll32.exe (PID: 392)
      • rundll32.exe (PID: 3504)
      • rundll32.exe (PID: 2436)
      • rundll32.exe (PID: 1440)
      • rundll32.exe (PID: 1332)
      • rundll32.exe (PID: 2520)
      • rundll32.exe (PID: 3964)
      • rundll32.exe (PID: 2312)
      • rundll32.exe (PID: 2484)
      • rundll32.exe (PID: 2244)
      • rundll32.exe (PID: 3320)
      • rundll32.exe (PID: 1836)
      • rundll32.exe (PID: 4056)
      • rundll32.exe (PID: 3588)
      • rundll32.exe (PID: 2060)
      • rundll32.exe (PID: 944)
      • rundll32.exe (PID: 2432)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 3164)
      • rundll32.exe (PID: 3008)
      • rundll32.exe (PID: 2220)
      • rundll32.exe (PID: 3312)
      • rundll32.exe (PID: 2748)
      • rundll32.exe (PID: 4012)
      • rundll32.exe (PID: 2640)
      • rundll32.exe (PID: 3260)
      • rundll32.exe (PID: 1912)
      • rundll32.exe (PID: 2248)
      • rundll32.exe (PID: 3680)
      • rundll32.exe (PID: 1800)
      • rundll32.exe (PID: 3460)
      • rundll32.exe (PID: 2760)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 2696)
      • rundll32.exe (PID: 1348)
      • rundll32.exe (PID: 952)
      • rundll32.exe (PID: 3096)
      • rundll32.exe (PID: 2524)
      • rundll32.exe (PID: 872)
      • rundll32.exe (PID: 968)
      • rundll32.exe (PID: 3272)
      • rundll32.exe (PID: 576)
      • rundll32.exe (PID: 3928)
      • rundll32.exe (PID: 3516)
      • rundll32.exe (PID: 4504)
      • rundll32.exe (PID: 4536)
      • rundll32.exe (PID: 5644)
      • rundll32.exe (PID: 5580)
      • rundll32.exe (PID: 5060)
      • rundll32.exe (PID: 5408)
      • rundll32.exe (PID: 5652)
      • rundll32.exe (PID: 4632)
      • rundll32.exe (PID: 5748)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 5732)
      • rundll32.exe (PID: 4348)
      • rundll32.exe (PID: 5464)
      • rundll32.exe (PID: 5588)
      • rundll32.exe (PID: 6296)
      • rundll32.exe (PID: 6260)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 2976)
      • rundll32.exe (PID: 1140)
      • rundll32.exe (PID: 2892)
      • rundll32.exe (PID: 2856)
      • rundll32.exe (PID: 2788)
      • rundll32.exe (PID: 3600)
      • rundll32.exe (PID: 3776)
      • rundll32.exe (PID: 2960)
      • rundll32.exe (PID: 3420)
      • rundll32.exe (PID: 4060)
      • rundll32.exe (PID: 304)
      • rundll32.exe (PID: 3100)
      • rundll32.exe (PID: 3504)
      • rundll32.exe (PID: 392)
      • rundll32.exe (PID: 2436)
      • rundll32.exe (PID: 1440)
      • rundll32.exe (PID: 1332)
      • rundll32.exe (PID: 2484)
      • rundll32.exe (PID: 2520)
      • rundll32.exe (PID: 3964)
      • rundll32.exe (PID: 2244)
      • rundll32.exe (PID: 2312)
      • rundll32.exe (PID: 3320)
      • rundll32.exe (PID: 4056)
      • rundll32.exe (PID: 1836)
      • rundll32.exe (PID: 3588)
      • rundll32.exe (PID: 2060)
      • rundll32.exe (PID: 3164)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 2432)
      • rundll32.exe (PID: 944)
      • rundll32.exe (PID: 3488)
      • rundll32.exe (PID: 2220)
      • rundll32.exe (PID: 3008)
      • rundll32.exe (PID: 3312)
      • rundll32.exe (PID: 3264)
      • rundll32.exe (PID: 2908)
      • rundll32.exe (PID: 2748)
      • rundll32.exe (PID: 4012)
      • rundll32.exe (PID: 2640)
      • rundll32.exe (PID: 2248)
      • rundll32.exe (PID: 3260)
      • rundll32.exe (PID: 3492)
      • rundll32.exe (PID: 1912)
      • rundll32.exe (PID: 3680)
      • rundll32.exe (PID: 3460)
      • rundll32.exe (PID: 1800)
      • rundll32.exe (PID: 2760)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 2696)
      • rundll32.exe (PID: 3676)
      • rundll32.exe (PID: 1348)
      • rundll32.exe (PID: 3096)
      • rundll32.exe (PID: 3484)
      • rundll32.exe (PID: 952)
      • rundll32.exe (PID: 2880)
      • rundll32.exe (PID: 2524)
      • rundll32.exe (PID: 872)
      • rundll32.exe (PID: 324)
      • rundll32.exe (PID: 1232)
      • rundll32.exe (PID: 2644)
      • rundll32.exe (PID: 968)
      • rundll32.exe (PID: 3272)
      • rundll32.exe (PID: 3928)
      • rundll32.exe (PID: 576)
      • rundll32.exe (PID: 2720)
      • rundll32.exe (PID: 4504)
      • rundll32.exe (PID: 3516)
      • rundll32.exe (PID: 4536)
      • rundll32.exe (PID: 5644)
      • rundll32.exe (PID: 5580)
      • rundll32.exe (PID: 5408)
      • rundll32.exe (PID: 5060)
      • rundll32.exe (PID: 5652)
      • rundll32.exe (PID: 5856)
      • rundll32.exe (PID: 5404)
      • rundll32.exe (PID: 6024)
      • rundll32.exe (PID: 4828)
      • rundll32.exe (PID: 4632)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 5748)
      • rundll32.exe (PID: 5732)
      • rundll32.exe (PID: 4348)
      • rundll32.exe (PID: 5588)
      • rundll32.exe (PID: 5464)
      • rundll32.exe (PID: 4436)
      • rundll32.exe (PID: 5556)
      • rundll32.exe (PID: 6296)
      • rundll32.exe (PID: 6260)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 2976)
      • rundll32.exe (PID: 2892)
      • rundll32.exe (PID: 1140)
      • rundll32.exe (PID: 2788)
      • rundll32.exe (PID: 3600)
      • rundll32.exe (PID: 2856)
      • rundll32.exe (PID: 3776)
      • rundll32.exe (PID: 2960)
      • rundll32.exe (PID: 4060)
      • rundll32.exe (PID: 304)
      • rundll32.exe (PID: 3420)
      • rundll32.exe (PID: 3100)
      • rundll32.exe (PID: 392)
      • rundll32.exe (PID: 3504)
      • rundll32.exe (PID: 1440)
      • rundll32.exe (PID: 2436)
      • rundll32.exe (PID: 1332)
      • rundll32.exe (PID: 2520)
      • rundll32.exe (PID: 3964)
      • rundll32.exe (PID: 2484)
      • rundll32.exe (PID: 2312)
      • rundll32.exe (PID: 3320)
      • rundll32.exe (PID: 2244)
      • rundll32.exe (PID: 4056)
      • rundll32.exe (PID: 1836)
      • rundll32.exe (PID: 2060)
      • rundll32.exe (PID: 3588)
      • rundll32.exe (PID: 3164)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 2432)
      • rundll32.exe (PID: 944)
      • rundll32.exe (PID: 3488)
      • rundll32.exe (PID: 2220)
      • rundll32.exe (PID: 3008)
      • rundll32.exe (PID: 3312)
      • rundll32.exe (PID: 3264)
      • rundll32.exe (PID: 2908)
      • rundll32.exe (PID: 2748)
      • rundll32.exe (PID: 4012)
      • rundll32.exe (PID: 2640)
      • rundll32.exe (PID: 2248)
      • rundll32.exe (PID: 3260)
      • rundll32.exe (PID: 3492)
      • rundll32.exe (PID: 3680)
      • rundll32.exe (PID: 1912)
      • rundll32.exe (PID: 3460)
      • rundll32.exe (PID: 1800)
      • rundll32.exe (PID: 2760)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 1348)
      • rundll32.exe (PID: 3676)
      • rundll32.exe (PID: 2696)
      • rundll32.exe (PID: 3484)
      • rundll32.exe (PID: 3096)
      • rundll32.exe (PID: 952)
      • rundll32.exe (PID: 2880)
      • rundll32.exe (PID: 2524)
      • rundll32.exe (PID: 324)
      • rundll32.exe (PID: 872)
      • rundll32.exe (PID: 2644)
      • rundll32.exe (PID: 1232)
      • rundll32.exe (PID: 3272)
      • rundll32.exe (PID: 968)
      • rundll32.exe (PID: 576)
      • rundll32.exe (PID: 3928)
      • rundll32.exe (PID: 3516)
      • rundll32.exe (PID: 2720)
      • rundll32.exe (PID: 4536)
      • rundll32.exe (PID: 4504)
      • rundll32.exe (PID: 5644)
      • rundll32.exe (PID: 5580)
      • rundll32.exe (PID: 5408)
      • rundll32.exe (PID: 5060)
      • rundll32.exe (PID: 5404)
      • rundll32.exe (PID: 5652)
      • rundll32.exe (PID: 5856)
      • rundll32.exe (PID: 6024)
      • rundll32.exe (PID: 4632)
      • rundll32.exe (PID: 4828)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 5748)
      • rundll32.exe (PID: 5732)
      • rundll32.exe (PID: 4348)
      • rundll32.exe (PID: 5464)
      • rundll32.exe (PID: 5588)
      • rundll32.exe (PID: 5556)
      • rundll32.exe (PID: 4436)
      • rundll32.exe (PID: 6296)
      • rundll32.exe (PID: 6260)

    • Creates files in the user directory

      • rundll32.exe (PID: 2976)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 2976)

    • Application launched itself

      • rundll32.exe (PID: 2892)
      • rundll32.exe (PID: 2976)
      • rundll32.exe (PID: 2960)
      • rundll32.exe (PID: 4060)
      • rundll32.exe (PID: 304)
      • rundll32.exe (PID: 392)
      • rundll32.exe (PID: 3504)
      • rundll32.exe (PID: 1332)
      • rundll32.exe (PID: 2520)
      • rundll32.exe (PID: 3964)
      • rundll32.exe (PID: 2312)
      • rundll32.exe (PID: 3320)
      • rundll32.exe (PID: 2244)
      • rundll32.exe (PID: 1836)
      • rundll32.exe (PID: 4056)
      • rundll32.exe (PID: 2060)
      • rundll32.exe (PID: 3588)
      • rundll32.exe (PID: 3164)
      • rundll32.exe (PID: 2432)
      • rundll32.exe (PID: 944)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 3008)
      • rundll32.exe (PID: 2220)
      • rundll32.exe (PID: 3488)
      • rundll32.exe (PID: 3312)
      • rundll32.exe (PID: 2908)
      • rundll32.exe (PID: 3264)
      • rundll32.exe (PID: 2748)
      • rundll32.exe (PID: 4012)
      • rundll32.exe (PID: 2248)
      • rundll32.exe (PID: 2640)
      • rundll32.exe (PID: 3260)
      • rundll32.exe (PID: 3492)
      • rundll32.exe (PID: 1912)
      • rundll32.exe (PID: 3680)
      • rundll32.exe (PID: 1800)
      • rundll32.exe (PID: 2760)
      • rundll32.exe (PID: 3460)
      • rundll32.exe (PID: 2696)
      • rundll32.exe (PID: 1348)
      • rundll32.exe (PID: 3676)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 3484)
      • rundll32.exe (PID: 3096)
      • rundll32.exe (PID: 2880)
      • rundll32.exe (PID: 952)
      • rundll32.exe (PID: 2524)
      • rundll32.exe (PID: 872)
      • rundll32.exe (PID: 324)
      • rundll32.exe (PID: 2644)
      • rundll32.exe (PID: 1232)
      • rundll32.exe (PID: 3272)
      • rundll32.exe (PID: 968)
      • rundll32.exe (PID: 576)
      • rundll32.exe (PID: 3928)
      • rundll32.exe (PID: 2720)
      • rundll32.exe (PID: 3516)
      • rundll32.exe (PID: 4536)
      • rundll32.exe (PID: 4504)
      • rundll32.exe (PID: 5580)
      • rundll32.exe (PID: 5408)
      • rundll32.exe (PID: 5644)
      • rundll32.exe (PID: 5060)
      • rundll32.exe (PID: 5652)
      • rundll32.exe (PID: 5404)
      • rundll32.exe (PID: 5856)
      • rundll32.exe (PID: 6024)
      • rundll32.exe (PID: 4632)
      • rundll32.exe (PID: 4828)
      • rundll32.exe (PID: 5748)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 4348)
      • rundll32.exe (PID: 5732)
      • rundll32.exe (PID: 5588)
      • rundll32.exe (PID: 5464)
      • rundll32.exe (PID: 4436)
      • rundll32.exe (PID: 5556)
      • rundll32.exe (PID: 6260)
      • rundll32.exe (PID: 6296)

    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 2976)
      • rundll32.exe (PID: 1140)
      • rundll32.exe (PID: 2892)
      • rundll32.exe (PID: 2856)
      • rundll32.exe (PID: 2788)
      • rundll32.exe (PID: 3600)
      • rundll32.exe (PID: 3776)
      • rundll32.exe (PID: 2960)
      • rundll32.exe (PID: 3420)
      • rundll32.exe (PID: 4060)
      • rundll32.exe (PID: 304)
      • rundll32.exe (PID: 3100)
      • rundll32.exe (PID: 392)
      • rundll32.exe (PID: 3504)
      • rundll32.exe (PID: 2436)
      • rundll32.exe (PID: 1440)
      • rundll32.exe (PID: 1332)
      • rundll32.exe (PID: 2484)
      • rundll32.exe (PID: 2520)
      • rundll32.exe (PID: 3964)
      • rundll32.exe (PID: 2312)
      • rundll32.exe (PID: 2244)
      • rundll32.exe (PID: 3320)
      • rundll32.exe (PID: 1836)
      • rundll32.exe (PID: 4056)
      • rundll32.exe (PID: 2060)
      • rundll32.exe (PID: 3588)
      • rundll32.exe (PID: 3164)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 2432)
      • rundll32.exe (PID: 944)
      • rundll32.exe (PID: 2220)
      • rundll32.exe (PID: 3008)
      • rundll32.exe (PID: 3488)
      • rundll32.exe (PID: 3312)
      • rundll32.exe (PID: 2908)
      • rundll32.exe (PID: 3264)
      • rundll32.exe (PID: 4012)
      • rundll32.exe (PID: 2748)
      • rundll32.exe (PID: 2248)
      • rundll32.exe (PID: 3260)
      • rundll32.exe (PID: 2640)
      • rundll32.exe (PID: 3492)
      • rundll32.exe (PID: 3680)
      • rundll32.exe (PID: 1912)
      • rundll32.exe (PID: 3460)
      • rundll32.exe (PID: 1800)
      • rundll32.exe (PID: 2760)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 1348)
      • rundll32.exe (PID: 3676)
      • rundll32.exe (PID: 2696)
      • rundll32.exe (PID: 3484)
      • rundll32.exe (PID: 952)
      • rundll32.exe (PID: 3096)
      • rundll32.exe (PID: 2524)
      • rundll32.exe (PID: 2880)
      • rundll32.exe (PID: 324)
      • rundll32.exe (PID: 2644)
      • rundll32.exe (PID: 1232)
      • rundll32.exe (PID: 872)
      • rundll32.exe (PID: 968)
      • rundll32.exe (PID: 3272)
      • rundll32.exe (PID: 576)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 1140)
      • rundll32.exe (PID: 2892)
      • rundll32.exe (PID: 2856)
      • rundll32.exe (PID: 2788)
      • rundll32.exe (PID: 3600)
      • rundll32.exe (PID: 3776)
      • rundll32.exe (PID: 3420)
      • rundll32.exe (PID: 2960)
      • rundll32.exe (PID: 4060)
      • rundll32.exe (PID: 304)
      • rundll32.exe (PID: 3100)
      • rundll32.exe (PID: 392)
      • rundll32.exe (PID: 1332)
      • rundll32.exe (PID: 3504)
      • rundll32.exe (PID: 2436)
      • rundll32.exe (PID: 1440)
      • rundll32.exe (PID: 2484)
      • rundll32.exe (PID: 2520)
      • rundll32.exe (PID: 3964)
      • rundll32.exe (PID: 2312)
      • rundll32.exe (PID: 2244)
      • rundll32.exe (PID: 3320)
      • rundll32.exe (PID: 4056)
      • rundll32.exe (PID: 1836)
      • rundll32.exe (PID: 2060)
      • rundll32.exe (PID: 3588)
      • rundll32.exe (PID: 2796)
      • rundll32.exe (PID: 3164)
      • rundll32.exe (PID: 2220)
      • rundll32.exe (PID: 944)
      • rundll32.exe (PID: 2432)
      • rundll32.exe (PID: 3008)
      • rundll32.exe (PID: 3488)
      • rundll32.exe (PID: 3312)
      • rundll32.exe (PID: 2908)
      • rundll32.exe (PID: 3264)
      • rundll32.exe (PID: 4012)
      • rundll32.exe (PID: 2748)
      • rundll32.exe (PID: 3492)
      • rundll32.exe (PID: 2248)
      • rundll32.exe (PID: 3680)
      • rundll32.exe (PID: 2640)
      • rundll32.exe (PID: 3260)
      • rundll32.exe (PID: 1912)
      • rundll32.exe (PID: 3460)
      • rundll32.exe (PID: 1800)
      • rundll32.exe (PID: 1348)
      • rundll32.exe (PID: 2760)
      • rundll32.exe (PID: 3676)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 2696)
      • rundll32.exe (PID: 2880)
      • rundll32.exe (PID: 952)
      • rundll32.exe (PID: 3096)
      • rundll32.exe (PID: 3484)
      • rundll32.exe (PID: 2524)
      • rundll32.exe (PID: 324)
      • rundll32.exe (PID: 872)

  • INFO

    • Loads main object executable

      • rundll32.exe (PID: 2976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x2c9a
UninitializedDataSize: -
InitializedDataSize: 36864
CodeSize: 45568
LinkerVersion: 11
PEType: PE32
TimeStamp: 2019:05:14 01:50:12+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 13-May-2019 23:50:12
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 13-May-2019 23:50:12
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DLL
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000B0CC
0x0000B200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.54916
.rdata
0x0000D000
0x0000334F
0x00003400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.75482
.data
0x00011000
0x00002D64
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.45575
.rsrc
0x00014000
0x000001E0
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.71768
.reloc
0x00015000
0x00002A52
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
2.37296

Resources

Title
Entropy
Size
Codepage
Language
Type
2
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.DLL
SHELL32.dll
USER32.dll
WININET.dll

Exports

Title
Ordinal
Address
DllRegisterServer
1
0x00001530
netsvcs
2
0x000014D0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
254
Monitored processes
157
Malicious processes
89
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe rundll32.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs rundll32.exe no specs rundll32.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2976"C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\sway.dll", DllRegisterServerC:\Windows\System32\rundll32.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1140C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2892C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2856C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2788C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3600C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3776C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2960C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1544cmd /c ""C:\Users\admin\AppData\Local\Temp\69CE.tmp_isdel.bat" "C:\Windows\System32\cmd.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3420C:\Windows\system32\rundll32.exe "C:\Users\admin\AppData\Roaming\SvHost\Sway.dat",netsvcsC:\Windows\system32\rundll32.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
27 034
Read events
26 574
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
90
Unknown types
0

Dropped files

PID
Process
Filename
Type
2788rundll32.exeC:\Users\admin\AppData\Local\Temp\6B64.tmp_isdel.battext
MD5:BA07D09F317132A67486057B245D56C3
SHA256:FEDC3492FE47DFDB3D4191025153C7DA85991F55E9AC5664AE4AB28E9E98455C
2976rundll32.exeC:\Users\admin\AppData\Local\Temp\69CE.tmp_isdel.battext
MD5:087B52983DF4A1B09C9536FC7AD32A92
SHA256:E96E2793784C3FA1550BE11C0E4D9572D3E700DFC82C9D1AABAC5178CA96ABE8
3776rundll32.exeC:\Users\admin\AppData\Local\Temp\6C3F.tmp_isdel.battext
MD5:A0E5E9CA30A4025039472B1B445F5F62
SHA256:25E6E1EA6A2C0CAD642E6739495077228C877CB5230BFA91F4562133D1A6C59F
2892rundll32.exeC:\Users\admin\AppData\Local\Temp\6AA9.tmp_isdel.battext
MD5:73B017453867A5C79B2DE142D02186C7
SHA256:702262E1C90F421C5A9795FDBCE7F155559F9972F47702C812571A1359633F4F
4060rundll32.exeC:\Users\admin\AppData\Local\Temp\6EA0.tmp_isdel.battext
MD5:7481170BE5423A355AFFB78C4E0DC04B
SHA256:458AF859719E9A38E3C1F6F8904883DE7CBBC89A0DE6A49B42C4D30DEA9E4ED7
2960rundll32.exeC:\Users\admin\AppData\Local\Temp\6D87.tmp_isdel.battext
MD5:929576B62DED4FF79C0C438C742E2B76
SHA256:65B24C5B79421FE303675CC67EEBE6578227E8DEF8C2689446720C8C3B04595F
2976rundll32.exeC:\Users\admin\AppData\Local\Temp\6CFC.tmp_isdel.battext
MD5:374F6C403FEFD39C66A3622A0B7CFBE3
SHA256:8BAEC8156EF6F50AB404EC0128571E3A291DE10076523185892BEBC554912A14
2856rundll32.exeC:\Users\admin\AppData\Local\Temp\6B07.tmp_isdel.battext
MD5:EACB66398D4D6BB5F97AF22E7C31D7B8
SHA256:791F8A02DE2AA11B66F290A253D48E33F4A8AE2547DDAA51F2CE509689E09E58
2520rundll32.exeC:\Users\admin\AppData\Local\Temp\73D1.tmp_isdel.battext
MD5:2B286F2CCD9F58A7218E43EC6D4B67BB
SHA256:0700534A2D96D794BD29277EA53D50D7DD60A880C7C4E6865FA6ABCC4BD03881
1440rundll32.exeC:\Users\admin\AppData\Local\Temp\7279.tmp_isdel.battext
MD5:32467FCFED0540E83E191A1EACB11B73
SHA256:FE0E4DC29F7D5F49A3CB12F9EFD3063DE717CF0723453BD69333430CA11F5528
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
106
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3600
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
1140
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
2960
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
2892
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
2856
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
2788
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
3776
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
3100
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
4060
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown
3504
rundll32.exe
111.92.189.34:21
sariwon.co.kr
LG DACOM Corporation
KR
unknown

DNS requests

Domain
IP
Reputation
sariwon.co.kr
  • 111.92.189.34
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sway.dll