IOC Report
VF.dll

loading gif

Files

File Path
Type
Category
Malicious
VF.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_56181ede0d43edd16fd2f5c205ffd37b12c4b76_7522e4b5_08c1258f-65b5-469b-92ba-e8e4954194b9\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_56181ede0d43edd16fd2f5c205ffd37b12c4b76_7522e4b5_3a5b0d75-be14-4ffc-bfc4-c5eff016e690\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_56181ede0d43edd16fd2f5c205ffd37b12c4b76_7522e4b5_a1bd80b4-8075-4fe5-8fe0-998375c7d994\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d66a9d3f657c6446ca14a6fa8b15b6c6c8a244a9_7522e4b5_17378f54-db41-48b9-93aa-2ee9f3453ff8\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA274.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Jul 5 06:00:07 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2C2.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Jul 5 06:00:07 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA35F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA38E.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA38F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3AE.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD03.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Jul 5 06:00:09 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD61.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD82.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB938.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Jul 5 06:00:12 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9B6.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9D6.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 8 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\VF.dll,VF_CopyFile
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\VF.dll",#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\VF.dll,VF_GetFileMD5
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\VF.dll",VF_CopyFile
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\VF.dll",VF_GetFileMD5
 malicious
C:\Windows\System32\loaddll32.exe
loaddll32.exe "C:\Users\user\Desktop\VF.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\VF.dll",#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 600
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 592
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 596
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 600
There are 2 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
ProgramId
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
FileId
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
LowerCaseLongPath
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
LongPathHash
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Name
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
OriginalFileName
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Publisher
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Version
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
BinFileVersion
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
BinaryType
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
ProductName
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
ProductVersion
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
LinkDate
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
BinProductVersion
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
AppxPackageFullName
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
AppxPackageRelativeId
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Size
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Language
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
IsOsComponent
\REGISTRY\A\{48dff760-b0d1-ee74-77d0-4244af2f3afd}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Usn
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1000A000
unkown
page execute and read and write
 malicious
1000A000
unkown
page execute and read and write
 malicious
1000A000
unkown
page execute and read and write
 malicious
1000A000
unkown
page execute and read and write
 malicious
1000A000
unkown
page execute and read and write
 malicious
3390000
heap
page read and write
99D000
heap
page read and write
1001F000
unkown
page read and write
54F000
stack
page read and write
780000
heap
page read and write
31BA000
heap
page read and write
1001D000
unkown
page execute and read and write
3C0000
heap
page read and write
6FC000
stack
page read and write
347E000
stack
page read and write
41FE000
stack
page read and write
2C30000
heap
page read and write
2A10000
heap
page read and write
180000
heap
page read and write
28E0000
heap
page read and write
2800000
heap
page read and write
323B000
stack
page read and write
278E000
stack
page read and write
C20000
heap
page read and write
10020000
unkown
page readonly
1001D000
unkown
page execute and read and write
3170000
heap
page read and write
4B00000
heap
page read and write
30F0000
heap
page read and write
10020000
unkown
page readonly
1001E000
unkown
page execute and write copy
50E000
stack
page read and write
67C000
stack
page read and write
1001D000
unkown
page execute and read and write
B7F000
stack
page read and write
3400000
heap
page read and write
2CBB000
stack
page read and write
997000
heap
page read and write
170000
heap
page read and write
2BDF000
stack
page read and write
77E000
stack
page read and write
980000
heap
page read and write
2710000
heap
page read and write
570000
heap
page read and write
1001F000
unkown
page read and write
10000000
unkown
page readonly
63B000
stack
page read and write
3430000
heap
page read and write
4630000
remote allocation
page read and write
57A000
heap
page read and write
10001000
unkown
page execute and read and write
2BA0000
heap
page read and write
1001F000
unkown
page read and write
2DEE000
stack
page read and write
CB000
stack
page read and write
1001E000
unkown
page execute and write copy
327C000
stack
page read and write
4280000
heap
page read and write
28BF000
stack
page read and write
34BF000
stack
page read and write
4A8E000
stack
page read and write
10001000
unkown
page execute and read and write
10000000
unkown
page readonly
10000000
unkown
page readonly
423F000
stack
page read and write
35C000
stack
page read and write
2C7F000
stack
page read and write
275B000
stack
page read and write
2AC0000
heap
page read and write
1001E000
unkown
page execute and write copy
2D60000
heap
page read and write
10001000
unkown
page execute and read and write
1001F000
unkown
page read and write
2CAA000
heap
page read and write
2A00000
heap
page read and write
2790000
heap
page read and write
313F000
stack
page read and write
1001F000
unkown
page read and write
10020000
unkown
page readonly
32B0000
heap
page read and write
2700000
heap
page read and write
1001E000
unkown
page execute and write copy
98B000
heap
page read and write
3D0000
heap
page read and write
190000
heap
page read and write
270F000
stack
page read and write
73E000
stack
page read and write
10000000
unkown
page readonly
2A8E000
stack
page read and write
27A0000
heap
page read and write
4ACF000
stack
page read and write
1001E000
unkown
page execute and write copy
6AE000
stack
page read and write
10020000
unkown
page readonly
2CA0000
heap
page read and write
28EA000
heap
page read and write
2D70000
heap
page read and write
31B0000
heap
page read and write
98F000
heap
page read and write
1001D000
unkown
page execute and read and write
95F000
stack
page read and write
1001D000
unkown
page execute and read and write
279C000
stack
page read and write
10000000
unkown
page readonly
34FE000
stack
page read and write
10C000
stack
page read and write
2CFC000
stack
page read and write
10020000
unkown
page readonly
10001000
unkown
page execute and read and write
2C1E000
stack
page read and write
46C0000
heap
page read and write
4EE0000
heap
page read and write
353F000
stack
page read and write
10001000
unkown
page execute and read and write
3560000
heap
page read and write
356A000
heap
page read and write
There are 106 hidden memdumps, click here to show them.