Edit tour

Windows Analysis Report
winmm.dll.dll

Overview

General Information

Sample name:	winmm.dll.dll (renamed file extension from exe to dll)
Original sample name:	winmm.dll.exe
Analysis ID:	1541761
MD5:	25fef25074dd0749c978bf01a36965f4
SHA1:	67910025c3b84a8324d3ea5e1afd93fd1cd00b41
SHA256:	31ceb9014f0e7ba8529c6dfa625abf48a0c39120bf976094b6c33363cdfb0a01
Tags:	exeuser-JayBass
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Entry point lies outside standard sections

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7344 cmdline: loaddll64.exe "C:\Users\user\Desktop\winmm.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7396 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7420 cmdline: rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7404 cmdline: rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,CloseDriver MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7484 cmdline: rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DefDriverProc MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7512 cmdline: rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DriverCallback MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: winmm.dll.dll	ReversingLabs: Detection: 45%
Source: winmm.dll.dll	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: loaddll64.exe, 00000000.00000002.1833928465.00007FFDFB4BE000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1781676239.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1746984857.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1773298345.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1806702558.00007FFDFB4BE000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: rundll32.exe, rundll32.exe, 00000004.00000002.1746984857.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1773298345.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1806702558.00007FFDFB4BE000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:

Source: winmm.dll.dll

Static PE information: Number of sections : 12 > 10

Source: winmm.dll.dll

Static PE information: Section: ZLIB complexity 1.0000853825136613

Source: classification engine

Classification label: mal72.evad.winDLL@12/1@0/0

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\Public\Documents\Techsmith_Camtasia_2024_Jasi2169.lic

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,CloseDriver

Source: winmm.dll.dll	ReversingLabs: Detection: 45%
Source: winmm.dll.dll	Virustotal: Detection: 43%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\winmm.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,CloseDriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DefDriverProc
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DriverCallback
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,CloseDriver	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DefDriverProc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DriverCallback	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winmm.dll.dll	Jump to behavior

Source: winmm.dll.dll

Static PE information: More than 196 > 100 exports found

Source: winmm.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: winmm.dll.dll

Static file information: File size 3716608 > 1048576

Source: winmm.dll.dll

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x368200

Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: loaddll64.exe, 00000000.00000002.1833928465.00007FFDFB4BE000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1781676239.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1746984857.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1773298345.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1806702558.00007FFDFB4BE000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: rundll32.exe, rundll32.exe, 00000004.00000002.1746984857.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.1773298345.00007FFDFB29E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.1806702558.00007FFDFB4BE000.00000040.00000001.01000000.00000003.sdmp

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name:
Source: winmm.dll.dll	Static PE information: section name: .themida
Source: winmm.dll.dll	Static PE information: section name: .boot

Source: winmm.dll.dll	Static PE information: section name: entropy: 7.981634718449392
Source: winmm.dll.dll	Static PE information: section name: entropy: 7.712416177556449

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\loaddll64.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Windows\System32\loaddll64.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: loaddll64.exe, 00000000.00000002.1833695800.000002A97F8BD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__{

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\System32\loaddll64.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationProcess: Indirect: 0xEF	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationProcess: Indirect: 0x7FFDFB6AD0A1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtSetInformationThread: Indirect: 0x70	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	321 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	22 Virtualization/Sandbox Evasion	LSASS Memory	22 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Rundll32	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Obfuscated Files or Information	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
winmm.dll.dll	46%	ReversingLabs	Win64.PUA.Vigua
winmm.dll.dll	44%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541761
Start date and time:	2024-10-25 05:41:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	winmm.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	winmm.dll.exe
Detection:	MAL
Classification:	mal72.evad.winDLL@12/1@0/0
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Stop behavior analysis, all processes terminated

Warnings

Execution Graph export aborted for target loaddll64.exe, PID 7344 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7404 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7420 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\Public\Documents\Techsmith_Camtasia_2024_Jasi2169.lic

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	117
Entropy (8bit):	5.166807135163305
Encrypted:	false
SSDEEP:	3:p0xexgOF8GWnzBgS36RZ0pnSdu9:pKgFYcKz
MD5:	C295FEBB81A9D6DF33C3C884B7162A9F
SHA1:	1FF0C4CC98881A1360ED84162413EDC836860F78
SHA-256:	27CCCC26780CB481031FB2D31166E0F1B19A9526081D71C478CC9CD1CF7709A8
SHA-512:	FA50EDA4345FE66D2A13DAD6B6914A2F937852445D4CED374611883691DD698ACD9D6CBBC872478B638466EE3E66E1392C9CDEA37F55FC4F7D5A02807337D4D0
Malicious:	false
Reputation:	low
Preview:	PROGRAM: TECHSMITH CAMTASIA..KEY: JASI-2169-JASI-2169..LICENSE: VERIFIED..RESPONSE: aR5qdt66JHN8e3cpLBoM27pocwzDnTc..

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.964111045243251
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	winmm.dll.dll
File size:	3'716'608 bytes
MD5:	25fef25074dd0749c978bf01a36965f4
SHA1:	67910025c3b84a8324d3ea5e1afd93fd1cd00b41
SHA256:	31ceb9014f0e7ba8529c6dfa625abf48a0c39120bf976094b6c33363cdfb0a01
SHA512:	29ea7d313597324fc32d9a0beea28f0fc7a1b0befdf8e5493637b411b6062f07b61568733ea2b1adf028b6eba830ab7de6aae0df89df05639f4bd5eb63a1305a
SSDEEP:	98304:VkdcixpTI1NMpnARKIJPKKz0m/uwPsMq943J5sCpP:Z2+1NMpARKuPVzpY943J5n
TLSH:	B80633F244F6AD7AD51023B0FDE88FC8324E629A9D7EB75889991B1F1D113086B186D3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................N.......N.......N........K.......K...............K......N.......N................J.......J.......J_......J.....

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x18062c058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x670A312A [Sat Oct 12 08:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	59b55678fa1594b54b3939b607a2dcb0

Entrypoint Preview

Instruction
call 00007F89B47393C7h
inc ecx
push edx
dec ecx
mov edx, esp
inc ecx
push edx
dec ecx
mov esi, dword ptr [edx+10h]
dec ecx
mov edi, dword ptr [edx+20h]
cld
mov dl, 80h
mov al, byte ptr [esi]
dec eax
inc esi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F89B4739226h
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F89B47392A0h
xor eax, eax
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007F89B4739348h
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
je 00007F89B473924Bh
push edi
mov eax, eax
dec eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
jmp 00007F89B47391CAh
mov eax, 00000001h
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F89B4739249h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jc 00007F89B4739228h
sub eax, ebx
mov ebx, 00000001h
jne 00007F89B4739270h
mov ecx, 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4c000	0x1455	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4e05c	0x88	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4f000	0x1d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x61f970	0x255c	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2c240	0x16e00	4007b8f47711eddb95246050e997f033	False	1.0000853825136613	data	7.981634718449392	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x2e000	0x2f17	0x1000	05a9ecec25a43055f58a9dc8c48f3dab	False	0.947509765625	data	7.712416177556449	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x31000	0x128ba	0x7600	66f4b7d127f4a61389e0e7a675711a05	False	0.985103283898305	data	7.928906236261539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x44000	0x2ab8	0x400	f44c495988cf7cdafd481de11068281f	False	0.91015625	data	7.049437736197027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x47000	0x2544	0x1600	13e2cf3fcadb3bde4865b6642ac4da52	False	0.9517045454545454	data	7.630760993826833	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x4a000	0x1e0	0x200	40667d94ca6f4a87260b802a1115fc65	False	0.798828125	data	6.044669778551108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x4b000	0x960	0x600	5ffb6031326062539d9957cd71952780	False	0.8268229166666666	data	7.413929876408778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.edata	0x4c000	0x1600	0x1600	a4c527d8e319d2f6a51e61c5b117d68b	False	0.3781960227272727	data	5.196842561195773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x4e000	0x1000	0x200	feea374249c57b6405e49847cf35c492	False	0.232421875	data	1.7412450910417339	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4f000	0x1000	0x200	79b17b9dc2f482ebe4af8945ddf02bdd	False	0.52734375	data	4.720822661998389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x50000	0x5dc000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x62c000	0x368200	0x368200	6cc4148a2db5ea917d16e0f23c914a42	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4f058	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	MessageBoxW
SHELL32.dll	SHGetKnownFolderPath

Exports

Name	Ordinal	Address
CloseDriver	1	0x180003ef0
DefDriverProc	2	0x180003f10
DriverCallback	3	0x180003f30
DrvGetModuleHandle	4	0x180003f50
GetDriverModuleHandle	5	0x180003f70
GetFileVersionInfoA	6	0x180003cc0
GetFileVersionInfoByHandle	7	0x180003cd0
GetFileVersionInfoExW	8	0x180003cf0
GetFileVersionInfoSizeA	9	0x180003d10
GetFileVersionInfoSizeExW	10	0x180003d30
GetFileVersionInfoSizeW	11	0x180003d50
GetFileVersionInfoW	12	0x180003d70
OpenDriver	13	0x180003f90
PlaySound	14	0x180003fb0
PlaySoundA	15	0x180003fd0
PlaySoundW	16	0x180003ff0
SendDriverMessage	17	0x180004010
VerFindFileA	18	0x180003d90
VerFindFileW	19	0x180003db0
VerInstallFileA	20	0x180003dd0
VerInstallFileW	21	0x180003df0
VerLanguageNameA	22	0x180003e10
VerLanguageNameW	23	0x180003e30
VerQueryValueA	24	0x180003e50
VerQueryValueIndexA	25	0x180003e90
VerQueryValueIndexW	26	0x180003eb0
VerQueryValueW	27	0x180003e70
WOWAppExit	28	0x180004030
auxGetDevCapsA	29	0x180004050
auxGetDevCapsW	30	0x180004070
auxGetNumDevs	31	0x180004090
auxGetVolume	32	0x1800040b0
auxOutMessage	33	0x1800040d0
auxSetVolume	34	0x1800040f0
joyConfigChanged	35	0x180004110
joyGetDevCapsA	36	0x180004130
joyGetDevCapsW	37	0x180004150
joyGetNumDevs	38	0x180004170
joyGetPos	39	0x180004190
joyGetPosEx	40	0x1800041b0
joyGetThreshold	41	0x1800041d0
joyReleaseCapture	42	0x1800041f0
joySetCapture	43	0x180004210
joySetThreshold	44	0x180004230
mciDriverNotify	45	0x180004250
mciDriverYield	46	0x180004270
mciExecute	47	0x180003ed0
mciFreeCommandResource	48	0x180004290
mciGetCreatorTask	49	0x1800042b0
mciGetDeviceIDA	50	0x1800042d0
mciGetDeviceIDFromElementIDA	51	0x1800042f0
mciGetDeviceIDFromElementIDW	52	0x180004310
mciGetDeviceIDW	53	0x180004330
mciGetDriverData	54	0x180004350
mciGetErrorStringA	55	0x180004370
mciGetErrorStringW	56	0x180004390
mciGetYieldProc	57	0x1800043b0
mciLoadCommandResource	58	0x1800043d0
mciSendCommandA	59	0x1800043f0
mciSendCommandW	60	0x180004410
mciSendStringA	61	0x180004430
mciSendStringW	62	0x180004450
mciSetDriverData	63	0x180004470
mciSetYieldProc	64	0x180004490
midiConnect	65	0x1800044b0
midiDisconnect	66	0x1800044d0
midiInAddBuffer	67	0x1800044f0
midiInClose	68	0x180004510
midiInGetDevCapsA	69	0x180004530
midiInGetDevCapsW	70	0x180004550
midiInGetErrorTextA	71	0x180004570
midiInGetErrorTextW	72	0x180004590
midiInGetID	73	0x1800045b0
midiInGetNumDevs	74	0x1800045d0
midiInMessage	75	0x1800045f0
midiInOpen	76	0x180004610
midiInPrepareHeader	77	0x180004630
midiInReset	78	0x180004650
midiInStart	79	0x180004670
midiInStop	80	0x180004690
midiInUnprepareHeader	81	0x1800046b0
midiOutCacheDrumPatches	82	0x1800046d0
midiOutCachePatches	83	0x1800046f0
midiOutClose	84	0x180004710
midiOutGetDevCapsA	85	0x180004730
midiOutGetDevCapsW	86	0x180004750
midiOutGetErrorTextA	87	0x180004770
midiOutGetErrorTextW	88	0x180004790
midiOutGetID	89	0x1800047b0
midiOutGetNumDevs	90	0x1800047d0
midiOutGetVolume	91	0x1800047f0
midiOutLongMsg	92	0x180004810
midiOutMessage	93	0x180004830
midiOutOpen	94	0x180004850
midiOutPrepareHeader	95	0x180004870
midiOutReset	96	0x180004890
midiOutSetVolume	97	0x1800048b0
midiOutShortMsg	98	0x1800048d0
midiOutUnprepareHeader	99	0x1800048f0
midiStreamClose	100	0x180004910
midiStreamOpen	101	0x180004930
midiStreamOut	102	0x180004950
midiStreamPause	103	0x180004970
midiStreamPosition	104	0x180004990
midiStreamProperty	105	0x1800049b0
midiStreamRestart	106	0x1800049d0
midiStreamStop	107	0x1800049f0
mixerClose	108	0x180004a10
mixerGetControlDetailsA	109	0x180004a30
mixerGetControlDetailsW	110	0x180004a50
mixerGetDevCapsA	111	0x180004a70
mixerGetDevCapsW	112	0x180004a90
mixerGetID	113	0x180004ab0
mixerGetLineControlsA	114	0x180004ad0
mixerGetLineControlsW	115	0x180004af0
mixerGetLineInfoA	116	0x180004b10
mixerGetLineInfoW	117	0x180004b30
mixerGetNumDevs	118	0x180004b50
mixerMessage	119	0x180004b70
mixerOpen	120	0x180004b90
mixerSetControlDetails	121	0x180004bb0
mmDrvInstall	122	0x180004bd0
mmGetCurrentTask	123	0x180004bf0
mmTaskBlock	124	0x180004c10
mmTaskCreate	125	0x180004c30
mmTaskSignal	126	0x180004c50
mmTaskYield	127	0x180004c70
mmioAdvance	128	0x180004c90
mmioAscend	129	0x180004cb0
mmioClose	130	0x180004cd0
mmioCreateChunk	131	0x180004cf0
mmioDescend	132	0x180004d10
mmioFlush	133	0x180004d30
mmioGetInfo	134	0x180004d50
mmioInstallIOProcA	135	0x180004d70
mmioInstallIOProcW	136	0x180004d90
mmioOpenA	137	0x180004db0
mmioOpenW	138	0x180004dd0
mmioRead	139	0x180004df0
mmioRenameA	140	0x180004e10
mmioRenameW	141	0x180004e30
mmioSeek	142	0x180004e50
mmioSendMessage	143	0x180004e70
mmioSetBuffer	144	0x180004e90
mmioSetInfo	145	0x180004eb0
mmioStringToFOURCCA	146	0x180004ed0
mmioStringToFOURCCW	147	0x180004ef0
mmioWrite	148	0x180004f10
mmsystemGetVersion	149	0x180004f30
sndPlaySoundA	150	0x180004f50
sndPlaySoundW	151	0x180004f70
timeBeginPeriod	152	0x180004f90
timeEndPeriod	153	0x180004fb0
timeGetDevCaps	154	0x180004fd0
timeGetSystemTime	155	0x180004ff0
timeGetTime	156	0x180005010
timeKillEvent	157	0x180005030
timeSetEvent	158	0x180005050
waveInAddBuffer	159	0x180005070
waveInClose	160	0x180005090
waveInGetDevCapsA	161	0x1800050b0
waveInGetDevCapsW	162	0x1800050d0
waveInGetErrorTextA	163	0x1800050f0
waveInGetErrorTextW	164	0x180005110
waveInGetID	165	0x180005130
waveInGetNumDevs	166	0x180005150
waveInGetPosition	167	0x180005170
waveInMessage	168	0x180005190
waveInOpen	169	0x1800051b0
waveInPrepareHeader	170	0x1800051d0
waveInReset	171	0x1800051f0
waveInStart	172	0x180005210
waveInStop	173	0x180005230
waveInUnprepareHeader	174	0x180005250
waveOutBreakLoop	175	0x180005270
waveOutClose	176	0x180005290
waveOutGetDevCapsA	177	0x1800052b0
waveOutGetDevCapsW	178	0x1800052d0
waveOutGetErrorTextA	179	0x1800052f0
waveOutGetErrorTextW	180	0x180005310
waveOutGetID	181	0x180005330
waveOutGetNumDevs	182	0x180005350
waveOutGetPitch	183	0x180005370
waveOutGetPlaybackRate	184	0x180005390
waveOutGetPosition	185	0x1800053b0
waveOutGetVolume	186	0x1800053d0
waveOutMessage	187	0x1800053f0
waveOutOpen	188	0x180005410
waveOutPause	189	0x180005430
waveOutPrepareHeader	190	0x180005450
waveOutReset	191	0x180005470
waveOutRestart	192	0x180005490
waveOutSetPitch	193	0x1800054b0
waveOutSetPlaybackRate	194	0x1800054d0
waveOutSetVolume	195	0x1800054f0
waveOutUnprepareHeader	196	0x180005510
waveOutWrite	197	0x180005530

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

• loaddll64.exe
• conhost.exe
• cmd.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

Memory Usage

• loaddll64.exe
• conhost.exe
• cmd.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

System Behavior

Analysis Process: loaddll64.exePID: 7344, Parent PID: 2580

Function Logs

General

Target ID:	0
Start time:	23:42:04
Start date:	24/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\winmm.dll.dll"
Imagebase:	0x7ff6df120000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Created

Show Windows behavior

Thread Activities

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7352, Parent PID: 7344

Function Logs

General

Target ID:	1
Start time:	23:42:04
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

File Attributes Queried

Volume Information Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Thread Activities

Thread Created

Thread Delayed

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

Window Created

Window UI Enumerated

Message Posted to Windows UI

Window UIs Event Hook Set

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7396, Parent PID: 7344

Function Logs

General

Target ID:	2
Start time:	23:42:04
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1
Imagebase:	0x7ff6b8330000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

File Opened

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Created

Process Information Set

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7404, Parent PID: 7344

Function Logs

General

Target ID:	3
Start time:	23:42:04
Start date:	24/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,CloseDriver
Imagebase:	0x7ff7f1fd0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

File Opened

File Created

File Written

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Value Queried

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Thread Activities

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

Show Windows behavior

System Activities

System Information Queried

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

Window UI Enumerated

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7420, Parent PID: 7396

Function Logs

General

Target ID:	4
Start time:	23:42:04
Start date:	24/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\winmm.dll.dll",#1
Imagebase:	0x7ff7f1fd0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

File Opened

File Read

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Value Queried

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Thread Activities

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

Show Windows behavior

System Activities

System Information Queried

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7484, Parent PID: 7344

Function Logs

General

Target ID:	5
Start time:	23:42:07
Start date:	24/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DefDriverProc
Imagebase:	0x7ff7f1fd0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

File Opened

File Read

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Value Queried

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Thread Activities

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

Show Windows behavior

System Activities

System Information Queried

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7512, Parent PID: 7344

Function Logs

General

Target ID:	6
Start time:	23:42:10
Start date:	24/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\winmm.dll.dll,DriverCallback
Imagebase:	0x7ff7f1fd0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

File Opened

File Read

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Value Queried

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report winmm.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Documents\Techsmith_Camtasia_2024_Jasi2169.lic

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll64.exePID: 7344, Parent PID: 2580

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Volume Information Queried

Windows Analysis Report
winmm.dll.dll