Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

pmm.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.874523099115981
Filename:	pmm.exe
Filesize:	1125376
MD5:	19c4258489c94b50d7f6041e2ca575f1
SHA1:	712c83d1cf46aeae6ffba68fe0bc1ec373532f2f
SHA256:	f482d607663a330b6a2393c8c9850bba8eddc53a4f80012c17dfcc416df05880
SHA512:	b5107250620af675bb73c64f94790b5312dc0ce77007eac915017b5675d515d97238b1a9b5984e134b84bc00be0805778e72b255f60fab5ed15dcc146b023b87
SSDEEP:	24576:0tb20pkaCqT5TBWgNQ7aiyEnGlxD0S3XEF6A:dVg5tQ7aiyEaDo5
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Disable or Modify Tools
Binary is likely a compiled AutoIt script file	System Summary
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	Access Token Manipulation
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging	Disable or Modify Tools
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Disable or Modify Tools
Contains functionality to launch a process as a different user	System Summary
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation Access Token Manipulation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Disable or Modify Tools
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evaded block containing many API calls	Malware Analysis System Evasion	Access Token Manipulation Disable or Modify Tools
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API Access Token Manipulation
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Access Token Manipulation Disable or Modify Tools System Shutdown/Reboot
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Disable or Modify Tools
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
.NET source code contains calls to encryption/decryption functions	System Summary	Deobfuscate/Decode Files or Information Archive Collected Data
Contains functionality for error logging	System Summary	Access Token Manipulation Disable or Modify Tools
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query system information	Malware Analysis System Evasion	System Information Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Disable or Modify Tools
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Discovery
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion	Disable or Modify Tools
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation Disable or Modify Tools
Tries to load missing DLLs	System Summary	DLL Side-Loading Disable or Modify Tools
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary	Disable or Modify Tools

C:\Users\user\AppData\Local\Temp\autC741.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\autC741.tmp
Category:	dropped
Dump:	autC741.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\pmm.exe
Type:	data
Entropy:	7.924944721463325
Encrypted:	false
Ssdeep:	3072:h7OOW1eZiGz1bN92ds8o+0Ee9Thsjvns02hBiBdkTpl1iQAttFP74b35T:QOW1eHZbNH5Xl9TGjns02wdkTb1fuvcF
Size:	157114
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\vehiculation

data

modified

Details

File:	C:\Users\user\AppData\Local\Temp\vehiculation
Category:	modified
Dump:	vehiculation.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\pmm.exe
Type:	data
Entropy:	6.751817285562325
Encrypted:	false
Ssdeep:	6144:MvBvzpdGTP1yqqvXwOVkNKk89mdmdQqFaeV:Mvdpdo1YvXwOVkNKk89GS5V
Size:	240128
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\pmm.exe

"C:\Users\user\Desktop\pmm.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7496
Target ID:	0
Parent PID:	4056
Name:	pmm.exe
Path:	C:\Users\user\Desktop\pmm.exe
Commandline:	"C:\Users\user\Desktop\pmm.exe"
Size:	1125376
MD5:	19C4258489C94B50D7F6041E2CA575F1
Time:	04:37:19
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x1b0000
Modulesize:	1150976
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\pmm.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7568
Target ID:	2
Parent PID:	7496
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\pmm.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	04:37:20
Date:	21/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xdf0000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://pgsu.co.id

unknown

Details

Name:	http://pgsu.co.id
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3800700734.00000000031CE000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://r10.o.lencr.org0#

unknown

Details

Name:	http://r10.o.lencr.org0#
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3800700734.00000000031CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3802352397.0000000006500000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3800271147.000000000146A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3802352397.0000000006527000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\pmm.exe
Source:	pmm.exe, 00000000.00000002.1360848326.0000000002270000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3799892999.0000000000402000.00000040.80000000.00040000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://mail.pgsu.co.id

unknown

Details

Name:	http://mail.pgsu.co.id
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3800700734.00000000031CE000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.c.lencr.org/0

unknown

Details

Name:	http://x1.c.lencr.org/0
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3800700734.00000000031CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3802352397.0000000006500000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3800271147.000000000146A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3800130186.00000000013C7000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/0

unknown

Details

Name:	http://x1.i.lencr.org/0
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3800700734.00000000031CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3802352397.0000000006500000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3800271147.000000000146A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3800130186.00000000013C7000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://r10.i.lencr.org/0

unknown

Details

Name:	http://r10.i.lencr.org/0
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3800700734.00000000031CE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3802352397.0000000006500000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3800271147.000000000146A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3802352397.0000000006527000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

pgsu.co.id

107.178.108.41

Details

Name:	pgsu.co.id
IP:	107.178.108.41
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

mail.pgsu.co.id

unknown

Details

Name:	mail.pgsu.co.id
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

107.178.108.41

pgsu.co.id

United States

Details

IP:	107.178.108.41
TargetID:	2
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	53755
ASN name:	IOFLOODUS
Private:	false
Domain:	pgsu.co.id

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Memdumps

Base Address

Regiontype

Protect

Malicious

402000

system

page execute and read and write

31CE000

trusted library allocation

page read and write

3181000

trusted library allocation

page read and write

2270000

direct allocation

page read and write

31F9000

trusted library allocation

page read and write

15C0000

heap

page read and write

400000

system

page execute and read and write

180E000

heap

page read and write

1760000

heap

page read and write

5D20000

trusted library allocation

page read and write

425E000

direct allocation

page read and write

5CE8000

trusted library allocation

page read and write

55CE000

trusted library allocation

page read and write

11F0000

heap

page read and write

13BC000

stack

page read and write

D89000

stack

page read and write

6D1F000

stack

page read and write

41E9000

direct allocation

page read and write

599E000

unkown

page read and write

1625000

heap

page read and write

1799000

heap

page read and write

5D27000

trusted library allocation

page read and write

26A000

unkown

page read and write

6EA0000

trusted library allocation

page execute and read and write

158D000

stack

page read and write

180D000

heap

page execute and read and write

108A000

stack

page read and write

3160000

trusted library allocation

page read and write

16F0000

trusted library allocation

page read and write

663E000

stack

page read and write

1189000

stack

page read and write

22C4000

heap

page read and write

13C5000

heap

page read and write

16E0000

trusted library allocation

page read and write

31CC000

trusted library allocation

page read and write

161B000

heap

page read and write

40C0000

direct allocation

page read and write

1710000

trusted library allocation

page read and write

41E9000

direct allocation

page read and write

41A9000

trusted library allocation

page read and write

138D000

trusted library allocation

page execute and read and write

4043000

direct allocation

page read and write

7F160000

trusted library allocation

page execute and read and write

1398000

heap

page read and write

2340000

heap

page read and write

3100000

trusted library allocation

page execute and read and write

16F7000

trusted library allocation

page execute and read and write

3010000

heap

page read and write

3F20000

direct allocation

page read and write

41E9000

direct allocation

page read and write

3F20000

direct allocation

page read and write

5D1C000

trusted library allocation

page read and write

12D5000

heap

page read and write

1404000

heap

page read and write

155E000

stack

page read and write

4043000

direct allocation

page read and write

16D0000

trusted library allocation

page read and write

1622000

heap

page read and write

41ED000

direct allocation

page read and write

1654000

heap

page read and write

4043000

direct allocation

page read and write

40C0000

direct allocation

page read and write

41EC000

trusted library allocation

page read and write

14D0000

heap

page read and write

41ED000

direct allocation

page read and write

589C000

stack

page read and write

40C0000

direct allocation

page read and write

175E000

stack

page read and write

300E000

stack

page read and write

1B1000

unkown

page execute read

3F20000

direct allocation

page read and write

160B000

heap

page read and write

161F000

stack

page read and write

12D0000

heap

page read and write

1625000

heap

page read and write

4043000

direct allocation

page read and write

1320000

heap

page read and write

691E000

stack

page read and write

6E5E000

stack

page read and write

425E000

direct allocation

page read and write

180E000

heap

page read and write

3211000

trusted library allocation

page read and write

4043000

direct allocation

page read and write

6640000

trusted library allocation

page read and write

55E6000

trusted library allocation

page read and write

1B1000

unkown

page execute read

16E6000

trusted library allocation

page execute and read and write

25E000

unkown

page readonly

13BA000

heap

page read and write

16F2000

trusted library allocation

page read and write

41E9000

direct allocation

page read and write

3120000

heap

page read and write

3F20000

direct allocation

page read and write

1B0000

unkown

page readonly

131E000

stack

page read and write

274000

unkown

page readonly

4043000

direct allocation

page read and write

31E9000

trusted library allocation

page read and write

425E000

direct allocation

page read and write

41ED000

direct allocation

page read and write

26F000

unkown

page write copy

6E90000

trusted library allocation

page read and write

55E1000

trusted library allocation

page read and write

425E000

direct allocation

page read and write

55F2000

trusted library allocation

page read and write

3150000

trusted library allocation

page read and write

6536000

heap

page read and write

16BD000

heap

page read and write

23D000

unkown

page readonly

26A000

unkown

page write copy

1811000

heap

page read and write

1811000

heap

page read and write

151E000

stack

page read and write

55CB000

trusted library allocation

page read and write

4181000

trusted library allocation

page read and write

6500000

heap

page read and write

16EA000

trusted library allocation

page execute and read and write

146A000

heap

page read and write

5794000

heap

page read and write

527D000

stack

page read and write

40C0000

direct allocation

page read and write

55D2000

trusted library allocation

page read and write

30FC000

stack

page read and write

575C000

stack

page read and write

1DDE000

stack

page read and write

5D30000

trusted library allocation

page read and write

1652000

heap

page read and write

25E000

unkown

page readonly

13DB000

stack

page read and write

180E000

heap

page read and write

3201000

trusted library allocation

page read and write

16F5000

trusted library allocation

page execute and read and write

6EB0000

heap

page read and write

6C1E000

stack

page read and write

15EE000

heap

page read and write

704ED000

unkown

page read and write

21DF000

stack

page read and write

3028000

trusted library allocation

page read and write

5D36000

trusted library allocation

page read and write

68DD000

stack

page read and write

3110000

trusted library allocation

page read and write

6565000

heap

page read and write

DF0000

heap

page read and write

23D000

unkown

page readonly

165E000

stack

page read and write

145B000

heap

page read and write

6D5E000

stack

page read and write

5790000

heap

page read and write

55DE000

trusted library allocation

page read and write

6555000

heap

page read and write

1B0000

unkown

page readonly

41ED000

direct allocation

page read and write

31F5000

trusted library allocation

page read and write

55C0000

trusted library allocation

page read and write

1350000

heap

page read and write

1383000

trusted library allocation

page execute and read and write

16E2000

trusted library allocation

page read and write

40C0000

direct allocation

page read and write

6730000

trusted library allocation

page read and write

3F20000

direct allocation

page read and write

1390000

heap

page read and write

15DE000

stack

page read and write

41E9000

direct allocation

page read and write

704D0000

unkown

page readonly

6E80000

heap

page read and write

6A1E000

stack

page read and write

66DE000

stack

page read and write

1429000

heap

page read and write

5CE0000

trusted library allocation

page read and write

5620000

heap

page read and write

71F0000

heap

page read and write

15EA000

heap

page read and write

1384000

trusted library allocation

page read and write

16BC000

heap

page read and write

1625000

heap

page read and write

671E000

stack

page read and write

13C7000

heap

page read and write

13CE000

stack

page read and write

5D10000

trusted library allocation

page read and write

41ED000

direct allocation

page read and write

425E000

direct allocation

page read and write

5600000

heap

page execute and read and write

1370000

trusted library allocation

page read and write

22C0000

heap

page read and write

41ED000

direct allocation

page read and write

16BC000

heap

page read and write

673B000

trusted library allocation

page read and write

13FC000

stack

page read and write

16DD000

trusted library allocation

page execute and read and write

274000

unkown

page readonly

6720000

trusted library allocation

page execute and read and write

55ED000

trusted library allocation

page read and write

3207000

trusted library allocation

page read and write

15E0000

heap

page read and write

3170000

heap

page execute and read and write

3140000

trusted library allocation

page read and write

425E000

direct allocation

page read and write

1820000

heap

page read and write

16FB000

trusted library allocation

page execute and read and write

1858000

heap

page read and write

1380000

trusted library allocation

page read and write

6527000

heap

page read and write

704EF000

unkown

page readonly

40C0000

direct allocation

page read and write

41E9000

direct allocation

page read and write

704D1000

unkown

page execute read

704E6000

unkown

page readonly

15D0000

heap

page read and write

31E7000

trusted library allocation

page read and write

3F20000

direct allocation

page read and write

5D40000

trusted library allocation

page execute and read and write

There are 201 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
pmm.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportpmm.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
pmm.exe