Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

42.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.877053274611739
Filename:	42.exe
Filesize:	1112064
MD5:	cb5a596f6ae023f22312ac155b442817
SHA1:	3bbc4dcd644056c062dc4f3e9bdb0ac93dd372ab
SHA256:	03665ef38e9753bab4a9f071bfd6fb52426fa14dbe9d55f019b7cead8bcbacfb
SHA512:	6ef7537f5173fe1f501f0a273534f6ba2f840a8e85242420e58d55962598d88d12db545baaa4d8fdc062286fcfae28b8a7aafb43b3d9bed517e8d46424bb01c6
SSDEEP:	24576:5AHnh+eWsN3skA4RV1Hom2KXMmHa9Ts7q0U/mV3Uv/35:Ah+ZkldoPK8Ya9o7ruVZ
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	Access Token Manipulation Security Software Discovery
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts
Contains functionality to launch a process as a different user	System Summary
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation Access Token Manipulation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Archive Collected Data Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API Access Token Manipulation
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Access Token Manipulation System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary	System Information Discovery
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Discovery
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\acceptancy

ASCII text, with very long lines (28756), with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\acceptancy
Category:	dropped
Dump:	acceptancy.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\42.exe
Type:	ASCII text, with very long lines (28756), with no line terminators
Entropy:	3.5949968959848553
Encrypted:	false
Ssdeep:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+Iw6lr4vfF3if6gyTz:miTZ+2QoioGRk6ZklputwjpjBkCiw2Rq
Size:	28756
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\acrorrheuma

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\acrorrheuma
Category:	dropped
Dump:	acrorrheuma.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\42.exe
Type:	data
Entropy:	6.686899323146974
Encrypted:	false
Ssdeep:	6144:QWAr8Isdxa9A6DM6g93KtaPTVMWpM6LNf09f94boaBzF:QWAr8IsCA6DDg93KabVMkM+NW4MahF
Size:	240128
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\aut2C63.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut2C63.tmp
Category:	dropped
Dump:	aut2C63.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\42.exe
Type:	data
Entropy:	7.9441528543347
Encrypted:	false
Ssdeep:	3072:0G7yIy/9z8E04M6bzviijHdC0wtYTXaj1GBROtGbyexmoX8yHdJMu3kQmgf0rnp:Xy/f04MPA3wtscGgG+en8yHbM67fAnp
Size:	156726
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\aut2CC2.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut2CC2.tmp
Category:	dropped
Dump:	aut2CC2.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\42.exe
Type:	data
Entropy:	7.597962402410301
Encrypted:	false
Ssdeep:	192:65jwEiqQ9pW+hCZcbZ/wzJkecGgL98GtYkJ8hjhqGwMwb81fSzx:I6qy2ZcbZ/YeecGgL20Gqx
Size:	9870
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\42.exe

"C:\Users\user\Desktop\42.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7412
Target ID:	0
Parent PID:	2580
Name:	42.exe
Path:	C:\Users\user\Desktop\42.exe
Commandline:	"C:\Users\user\Desktop\42.exe"
Size:	1112064
MD5:	CB5A596F6AE023F22312AC155B442817
Time:	03:37:51
Date:	03/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf20000
Modulesize:	1138688
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\42.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7428
Target ID:	1
Parent PID:	7412
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\42.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	03:37:52
Date:	03/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x500000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://r3.o.lencr.org0

unknown

Details

Name:	http://r3.o.lencr.org0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.4081312596.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://funworld.co.id

unknown

https://account.dyn.com/

unknown

http://x1.c.lencr.org/0

unknown

Details

Name:	http://x1.c.lencr.org/0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/0

unknown

Details

Name:	http://x1.i.lencr.org/0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://mail.funworld.co.id

unknown

http://r3.i.lencr.org/0

unknown

Details

Name:	http://r3.i.lencr.org/0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.4081312596.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

funworld.co.id

180.235.148.163

Details

Name:	funworld.co.id
IP:	180.235.148.163
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

mail.funworld.co.id

unknown

Details

Name:	mail.funworld.co.id
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

180.235.148.163

funworld.co.id

Indonesia

Details

IP:	180.235.148.163
TargetID:	1
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Indonesia
Countrycode:	IDN
ASN number:	45731
ASN name:	ARDH-AS-IDARDHGLOBALINDONESIAPTID
Private:	false
Domain:	funworld.co.id

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Memdumps

Base Address

Regiontype

Protect

Malicious

28E9000

trusted library allocation

page read and write

2871000

trusted library allocation

page read and write

28BE000

trusted library allocation

page read and write

1DB0000

direct allocation

page read and write

402000

system

page execute and read and write

2720000

heap

page execute and read and write

38DC000

trusted library allocation

page read and write

3B40000

direct allocation

page read and write

3CE0000

direct allocation

page read and write

3E0D000

direct allocation

page read and write

117F000

heap

page read and write

4D11000

trusted library allocation

page read and write

D26000

heap

page read and write

6470000

heap

page read and write

3B40000

direct allocation

page read and write

4D30000

heap

page read and write

DDB000

stack

page read and write

282E000

stack

page read and write

DA0000

trusted library allocation

page read and write

4FBC000

stack

page read and write

53E0000

trusted library allocation

page read and write

606F000

stack

page read and write

DFC000

stack

page read and write

128F000

heap

page read and write

59A000

stack

page read and write

DBF000

stack

page read and write

53F7000

trusted library allocation

page read and write

3CE0000

direct allocation

page read and write

C40000

heap

page read and write

A55000

heap

page read and write

E80000

heap

page read and write

115B000

heap

page read and write

5460000

trusted library allocation

page read and write

FD5000

unkown

page readonly

8F9000

stack

page read and write

3B40000

direct allocation

page read and write

4EA0000

trusted library allocation

page read and write

C22000

trusted library allocation

page read and write

CB6000

heap

page read and write

12A0000

heap

page read and write

E00000

heap

page read and write

BA0000

heap

page read and write

61EE000

stack

page read and write

FDF000

unkown

page read and write

642E000

stack

page read and write

BF4000

trusted library allocation

page read and write

37F4000

heap

page read and write

C0D000

trusted library allocation

page execute and read and write

1DA0000

direct allocation

page execute and read and write

11AD000

heap

page read and write

D90000

trusted library allocation

page execute and read and write

5FED000

stack

page read and write

3E09000

direct allocation

page read and write

11CD000

heap

page read and write

4D22000

trusted library allocation

page read and write

12CE000

heap

page read and write

3E0D000

direct allocation

page read and write

602E000

stack

page read and write

11AD000

heap

page read and write

4EB4000

heap

page read and write

5D00000

trusted library allocation

page read and write

3E0D000

direct allocation

page read and write

3C63000

direct allocation

page read and write

12D1000

heap

page read and write

28E5000

trusted library allocation

page read and write

D0B000

heap

page read and write

5410000

trusted library allocation

page execute and read and write

5EAD000

stack

page read and write

4CFE000

trusted library allocation

page read and write

5CAE000

stack

page read and write

2830000

trusted library allocation

page read and write

3C63000

direct allocation

page read and write

4D0E000

trusted library allocation

page read and write

3E7E000

direct allocation

page read and write

4E6C000

stack

page read and write

1234000

heap

page read and write

4EA8000

trusted library allocation

page read and write

C78000

heap

page read and write

4D16000

trusted library allocation

page read and write

DC0000

heap

page read and write

2710000

trusted library allocation

page read and write

4CFB000

trusted library allocation

page read and write

6480000

trusted library allocation

page execute and read and write

117F000

heap

page read and write

3E0D000

direct allocation

page read and write

BF0000

trusted library allocation

page read and write

BC0000

heap

page read and write

FD5000

unkown

page readonly

1153000

heap

page read and write

3CE0000

direct allocation

page read and write

C1A000

trusted library allocation

page execute and read and write

62EE000

stack

page read and write

5400000

trusted library allocation

page read and write

CC3000

heap

page read and write

4EB0000

heap

page read and write

C25000

trusted library allocation

page execute and read and write

E50000

heap

page read and write

632E000

stack

page read and write

6450000

heap

page read and write

C10000

trusted library allocation

page read and write

4CF0000

trusted library allocation

page read and write

4E70000

heap

page execute and read and write

3C63000

direct allocation

page read and write

C5E000

heap

page read and write

12D1000

heap

page read and write

FE3000

unkown

page write copy

A1E000

stack

page read and write

1143000

heap

page read and write

5CEE000

stack

page read and write

12AE000

heap

page read and write

3E7E000

direct allocation

page read and write

DCF000

stack

page read and write

1D1F000

stack

page read and write

CD1000

heap

page read and write

7F080000

trusted library allocation

page execute and read and write

3E7E000

direct allocation

page read and write

D8E000

stack

page read and write

1152000

heap

page read and write

53F0000

trusted library allocation

page read and write

3B40000

direct allocation

page read and write

1128000

heap

page read and write

4D1D000

trusted library allocation

page read and write

118F000

heap

page read and write

28D7000

trusted library allocation

page read and write

115A000

heap

page read and write

C75000

heap

page read and write

4D02000

trusted library allocation

page read and write

400000

system

page execute and read and write

C12000

trusted library allocation

page read and write

129F000

heap

page read and write

11AD000

heap

page read and write

28FC000

trusted library allocation

page read and write

BF3000

trusted library allocation

page execute and read and write

28F1000

trusted library allocation

page read and write

3899000

trusted library allocation

page read and write

1E60000

heap

page read and write

F20000

unkown

page readonly

12D1000

heap

page read and write

BE0000

trusted library allocation

page read and write

5CF0000

trusted library allocation

page execute and read and write

124A000

heap

page read and write

ECE000

stack

page read and write

C00000

trusted library allocation

page read and write

5B94000

heap

page read and write

5B75000

heap

page read and write

2860000

heap

page read and write

11AD000

heap

page read and write

118F000

heap

page read and write

3C63000

direct allocation

page read and write

2678000

trusted library allocation

page read and write

37F0000

heap

page read and write

C6A000

heap

page read and write

11AD000

heap

page read and write

1160000

heap

page read and write

28FE000

trusted library allocation

page read and write

900000

heap

page read and write

12BC000

heap

page read and write

3871000

trusted library allocation

page read and write

FAF000

unkown

page readonly

11AD000

heap

page read and write

1120000

heap

page read and write

3B40000

direct allocation

page read and write

191E000

stack

page read and write

3C63000

direct allocation

page read and write

C48000

heap

page read and write

2900000

trusted library allocation

page read and write

FDF000

unkown

page write copy

79A000

stack

page read and write

11AD000

heap

page read and write

1160000

heap

page read and write

3E0D000

direct allocation

page read and write

3E09000

direct allocation

page read and write

1282000

heap

page read and write

5EEE000

stack

page read and write

3E0D000

direct allocation

page read and write

3CE0000

direct allocation

page read and write

3C63000

direct allocation

page read and write

5D0B000

trusted library allocation

page read and write

545D000

stack

page read and write

1160000

heap

page read and write

F10000

heap

page read and write

129F000

heap

page read and write

12D1000

heap

page read and write

128F000

heap

page read and write

FE8000

unkown

page readonly

3E7E000

direct allocation

page read and write

C2B000

trusted library allocation

page execute and read and write

28BC000

trusted library allocation

page read and write

3E7E000

direct allocation

page read and write

11AD000

heap

page read and write

D40000

trusted library allocation

page read and write

1185000

heap

page read and write

DB0000

trusted library allocation

page read and write

F21000

unkown

page execute read

C27000

trusted library allocation

page execute and read and write

12D1000

heap

page read and write

FE8000

unkown

page readonly

BFD000

trusted library allocation

page execute and read and write

B5E000

stack

page read and write

F21000

unkown

page execute read

3B40000

direct allocation

page read and write

11AE000

heap

page read and write

3E7E000

direct allocation

page read and write

3E09000

direct allocation

page read and write

5B20000

heap

page read and write

3E09000

direct allocation

page read and write

E4E000

stack

page read and write

A20000

heap

page read and write

C16000

trusted library allocation

page execute and read and write

A50000

heap

page read and write

F20000

unkown

page readonly

49AD000

stack

page read and write

3CE0000

direct allocation

page read and write

48AC000

stack

page read and write

1152000

heap

page read and write

D22000

heap

page read and write

12B0000

heap

page read and write

66D0000

heap

page read and write

3CE0000

direct allocation

page read and write

6460000

trusted library allocation

page read and write

FAF000

unkown

page readonly

D3B000

heap

page read and write

3E09000

direct allocation

page read and write

5406000

trusted library allocation

page read and write

C7E000

heap

page read and write

53EC000

trusted library allocation

page read and write

3E09000

direct allocation

page read and write

There are 217 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
42.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report42.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
42.exe