Edit tour

Windows Analysis Report
libpkcs11-helper-1.dll.dll

Overview

General Information

Sample name:libpkcs11-helper-1.dll.dll
(renamed file extension from exe to dll)
Original sample name:libpkcs11-helper-1.dll.exe
Analysis ID:1562676
MD5:923f2b061c22b2de64f2b228f676fe95
SHA1:40830c37101ed4f779955c8d0e1718d51714eb83
SHA256:5d15ca989acd53de9e458bca2ac226ece6c3e1cf97b070c930a9f3f4b6144a21
Tags:exeuser-johnk3r
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found evasive API chain (might use process or thread times for sandbox detection)
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • loaddll64.exe (PID: 6564 cmdline: loaddll64.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)
    • conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 1644 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • rundll32.exe (PID: 7160 cmdline: rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 7120 cmdline: rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLS_get_data_mtu MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 6632 cmdline: rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_client_method MD5: EF3179D498793BF4234F708D3BE28633)
    • rundll32.exe (PID: 1488 cmdline: rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_listen MD5: EF3179D498793BF4234F708D3BE28633)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: libpkcs11-helper-1.dll.dllReversingLabs: Detection: 13%
Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.9% probability
Source: libpkcs11-helper-1.dll.dllJoe Sandbox ML: detected
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C578C0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,GetLocalTime,OpenMutexA,GetTempPathW,GetTempFileNameW,CreateThreadpoolWait,GetSystemDefaultLangID,lstrlenW,HeapReAlloc,UnregisterBadMemoryNotification,ConnectNamedPipe,DeleteTimerQueueEx,FindFirstFileNameW,VirtualQuery,WaitCommEvent,CompareStringOrdinal,SetThreadErrorMode,WriteConsoleOutputW,IsThreadpoolTimerSet,NeedCurrentDirectoryForExePathW,HeapFree,GetDefaultCommConfigW,GetNamedPipeClientSessionId,FindVolumeClose,CreateSemaphoreW,CloseHandle,WakeConditionVariable,VerifyVersionInfoW,CompareStringEx,ConvertFiberToThread,GetStartupInfoW,GetOverlappedResultEx,GetProcessId,GetStringTypeW,WriteConsoleOutputCharacterW,SetTapeParameters,RegisterApplicationRestart,AddScopedPolicyIDAce,ConvertThreadToFiberEx,WaitForDebugEvent,UnregisterBadMemoryNotification,GetThreadSelectorEntry,LeaveCriticalSection,SetSystemFileCacheSize,VerifyScripts,SetUserGeoID,GetLocalTime,GetShortPathNameW,IsProcessInJob,GetVolumePathNamesForVolumeNameW,EscapeCommFunction,DeleteTimerQueueEx,WriteProcessMemory,IsValidLanguageGroup,GetDynamicTimeZoneInformation,InitOnceExecuteOnce,GetNumberOfConsoleMouseButtons,RtlCaptureStackBackTrace,GetNamedPipeServerProcessId,LoadResource,WinExec,GetCommModemStatus,FreeConsole,LoadResource,GetCurrentThread,CompareFileTime,HeapLock,GetNumberOfConsoleInputEvents,OpenFileMappingW,SetCommState,IsBadStringPtrW,GetStringTypeW,VirtualProtect,
Source: libpkcs11-helper-1.dll.dllStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C5AC80 GetStartupInfoW,CopyFile2,SetProcessPriorityBoost,IsValidLanguageGroup,SetProcessPriorityBoost,AssignProcessToJobObject,GetModuleFileNameW,GetComputerNameW,GetPrivateProfileSectionW,GetDefaultCommConfigW,SystemTimeToFileTime,GetNumaProcessorNode,GetLocaleInfoEx,GetCurrentProcessorNumber,FindFirstFileNameW,CopyFileTransactedW,QueryPerformanceCounter,FlushConsoleInputBuffer,MapUserPhysicalPagesScatter,LCMapStringW,QueryMemoryResourceNotification,VerifyScripts,FindStringOrdinal,SetFileTime,SetThreadGroupAffinity,EnumTimeFormatsW,OutputDebugStringA,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C578C0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,GetLocalTime,OpenMutexA,GetTempPathW,GetTempFileNameW,CreateThreadpoolWait,GetSystemDefaultLangID,lstrlenW,HeapReAlloc,UnregisterBadMemoryNotification,ConnectNamedPipe,DeleteTimerQueueEx,FindFirstFileNameW,VirtualQuery,WaitCommEvent,CompareStringOrdinal,SetThreadErrorMode,WriteConsoleOutputW,IsThreadpoolTimerSet,NeedCurrentDirectoryForExePathW,HeapFree,GetDefaultCommConfigW,GetNamedPipeClientSessionId,FindVolumeClose,CreateSemaphoreW,CloseHandle,WakeConditionVariable,VerifyVersionInfoW,CompareStringEx,ConvertFiberToThread,GetStartupInfoW,GetOverlappedResultEx,GetProcessId,GetStringTypeW,WriteConsoleOutputCharacterW,SetTapeParameters,RegisterApplicationRestart,AddScopedPolicyIDAce,ConvertThreadToFiberEx,WaitForDebugEvent,UnregisterBadMemoryNotification,GetThreadSelectorEntry,LeaveCriticalSection,SetSystemFileCacheSize,VerifyScripts,SetUserGeoID,GetLocalTime,GetShortPathNameW,IsProcessInJob,GetVolumePathNamesForVolumeNameW,EscapeCommFunction,DeleteTimerQueueEx,WriteProcessMemory,IsValidLanguageGroup,GetDynamicTimeZoneInformation,InitOnceExecuteOnce,GetNumberOfConsoleMouseButtons,RtlCaptureStackBackTrace,GetNamedPipeServerProcessId,LoadResource,WinExec,GetCommModemStatus,FreeConsole,LoadResource,GetCurrentThread,CompareFileTime,HeapLock,GetNumberOfConsoleInputEvents,OpenFileMappingW,SetCommState,IsBadStringPtrW,GetStringTypeW,VirtualProtect,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D901C0 FindFirstFileNameW,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CFC1EC FindFirstFileExW,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C56670 GetProcessShutdownParameters,WriteConsoleOutputW,SetWaitableTimerEx,GetThreadId,LocalReAlloc,GetFirmwareEnvironmentVariableW,WakeAllConditionVariable,RegisterApplicationRecoveryCallback,GetNumberOfConsoleInputEvents,ContinueDebugEvent,DuplicateHandle,HeapReAlloc,CancelWaitableTimer,CancelIo,GetNumaHighestNodeNumber,SetFilePointer,FindNextVolumeMountPointW,InterlockedPushEntrySList,CreateWaitableTimerW,GlobalSize,DeleteVolumeMountPointW,IsWow64Process,QueryDosDeviceW,ReadFileEx,RegisterApplicationRecoveryCallback,ToAsciiEx,lstrcmpiW,SetThreadpoolTimerEx,GetRawInputData,GetFullPathNameW,TabbedTextOutW,QueryThreadProfiling,CreateMailslotW,EnumResourceTypesW,AcquireSRWLockExclusive,CharPrevExA,GetWindowsDirectoryW,GetWindowPlacement,GetFullPathNameTransactedW,SetFirmwareEnvironmentVariableW,BackupWrite,SetTapeParameters,IsValidLocaleName,CopyFileExW,LoadCursorFromFileW,FindFirstVolumeW,CharToOemW,AddSecureMemoryCacheCallback,MulDiv,QueryThreadProfiling,GetKeyboardLayout,DrawEdge,LoadPackagedLibrary,GetDynamicTimeZoneInformation,DebugActiveProcess,GetSystemDirectoryW,HeapCompact,GlobalHandle,WaitNamedPipeW,SetCommState,CreateMailslotW,VirtualProtect,InterlockedFlushSList,GlobalGetAtomNameW,AllocConsole,GetNLSVersionEx,GetSystemTimes,PowerSetRequest,WriteConsoleW,SetTimeZoneInformation,QueryProtectedPolicy,GetCurrentProcessorNumber,CompareFileTime,GetCurrentThread,ConvertDefaultLocale,GetActiveProcessorGroupCount,SetConsoleCursorPosition,SetConsoleOutputCP,NeedCurrentDirectoryForExePathW,OfferVirtualMemory,SetFileIoOverlappedRange,PrefetchVirtualMemory,SystemTimeToFileTime,GetProfileIntW,GetConsoleCursorInfo,GlobalGetAtomNameW,SizeofResource,GetCurrentThread,OpenEventW,EnumSystemGeoID,SleepConditionVariableCS,OpenWaitableTimerW,EnumResourceNamesW,SetThreadpoolStackInformation,GetLogicalProcessorInformationEx,ReadFileEx,GetConsoleAliasesW,QueryThreadProfiling,GetFileSizeEx,VirtualUnlock,GetSystemDirectoryW,FindNextChangeNotification,HeapWalk,TerminateThread,HeapWalk,UnlockFile,QueryThreadpoolStackInformation,CreateDirectoryExW,FindFirstFileTransactedW,LockFile,GetFileTime,CloseThreadpoolTimer,CheckTokenMembershipEx,UnregisterApplicationRestart,GetSystemTime,FlushFileBuffers,FindVolumeClose,GetUserDefaultLCID,ConvertThreadToFiber,AddSecureMemoryCacheCallback,GetNumaHighestNodeNumber,CloseThreadpoolIo,GetProcessPreferredUILanguages,DnsHostnameToComputerNameW,RaiseException,GetFileAttributesExW,SetVolumeMountPointW,lstrlenW,GetUserDefaultLCID,SetCommMask,SizeofResource,GetSystemDEPPolicy,GetVolumeNameForVolumeMountPointW,FreeLibrary,DrawFocusRect,DnsHostnameToComputerNameW,GetSystemMenu,GetThreadPriorityBoost,RegisterWindowMessageW,LogicalToPhysicalPoint,FreeLibraryWhenCallbackReturns,DdeSetUserHandle,GetModuleFileNameW,RemoveVectoredContinueHandler,SetConsoleMode,IsThreadpoolTimerSet,SetProcessWorkingSetSize,GetScrollPos,SetWindowContextHelpId,FlushConsoleInputBuffer,SetWaitableTimerEx,IsValidCodePage,CommConfigDialogW,EscapeCommFunct
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59790 UnregisterSuspendResumeNotification,ValidateRect,MessageBoxIndirectW,SetFileAttributesW,IsProcessDPIAware,SetProcessRestrictionExemption,GetModuleHandleExW,FindWindowExW,GetGUIThreadInfo,TransmitCommChar,HeapQueryInformation,SetSystemCursor,GetNumberOfConsoleInputEvents,RemoveVectoredExceptionHandler,SetLocaleInfoW,CopyFileW,mouse_event,GetCurrentProcess,GlobalReAlloc,EndDeferWindowPos,DefRawInputProc,GetUserDefaultLocaleName,PrefetchVirtualMemory,EnumWindows,DialogBoxParamW,DialogBoxParamW,SetProcessWorkingSetSizeEx,GetLastInputInfo,GetPriorityClass,SetNamedPipeHandleState,MapVirtualKeyW,OpenPrivateNamespaceW,SetSystemCursor,GetCurrentConsoleFont,TzSpecificLocalTimeToSystemTimeEx,FlushViewOfFile,FindNextVolumeW,NotifyUILanguageChange,EscapeCommFunction,Wow64SuspendThread,DeleteAtom,GetSystemDefaultLCID,GetFirmwareType,ReleaseSRWLockExclusive,SetCommTimeouts,RtlCaptureContext,GetCommMask,QueryProtectedPolicy,WriteConsoleW,RemoveDllDirectory,GetUserDefaultLangID,CreateMailslotW,StartThreadpoolIo,FatalAppExitW,GetCommProperties,Wow64SetThreadContext,GetFileInformationByHandle,SetConsoleHistoryInfo,WriteProfileStringW,InitializeSynchronizationBarrier,SetFilePointerEx,SetMailslotInfo,GetNumaAvailableMemoryNodeEx,GetProcessGroupAffinity,FindResourceW,ApplicationRecoveryInProgress,DnsHostnameToComputerNameW,GetConsoleProcessList,DeleteTimerQueueEx,GetNLSVersionEx,PurgeComm,OpenFileMappingW,FindFirstFileNameTransactedW,SetThreadpoolStackInformation,CheckTokenCapability,GetCurrencyFormatW,GetConsoleProcessList,GetCurrentConsoleFont,MapViewOfFileEx,RequestWakeupLatency,FlsFree,ConvertDefaultLocale,GetProcessHeap,TryEnterCriticalSection,EnumLanguageGroupLocalesW,EnumLanguageGroupLocalesW,DeleteTimerQueueEx,InitializeConditionVariable,GetLongPathNameTransactedW,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C533F0 GetTempPathA,GetTempFileNameA,QueryFullProcessImageNameW,CommConfigDialogW,CallbackMayRunLong,lstrcatW,UnregisterApplicationRestart,GetThreadSelectorEntry,BuildCommDCBW,SetConsoleHistoryInfo,PtVisible,CreatePrivateNamespaceW,GetConsoleSelectionInfo,WakeConditionVariable,PeekNamedPipe,EnumCalendarInfoExEx,Polygon,OpenWaitableTimerW,GetLogicalDrives,EnumResourceTypesExW,GetPhysicallyInstalledSystemMemory,SetEventWhenCallbackReturns,CopyFileW,GetFirmwareType,GetStartupInfoW,GetColorAdjustment,CreateMetaFileW,CancelWaitableTimer,BackupRead,GetCommState,GetCommandLineW,GetWindowsDirectoryW,GetConsoleCursorInfo,GetNamedPipeServerProcessId,GetMaximumProcessorGroupCount,OpenWaitableTimerW,SetFileAttributesTransactedW,DeleteTimerQueueEx,SetFileAttributesW,MoveFileExW,WaitForThreadpoolTimerCallbacks,CreateThreadpoolWait,CopyFileW,ReadConsoleOutputCharacterW,SetFirmwareEnvironmentVariableW,GetTempFileNameW,AddScopedPolicyIDAce,GetCPInfoExW,QueryInformationJobObject,FatalExit,CreateThreadpoolWork,RegOpenKeyExA,GetLongPathNameW,SetConsoleCP,VerifyScripts,CreateThreadpoolIo,EnumResourceLanguagesW,FindNLSString,CancelThreadpoolIo,UpdateResourceW,CheckNameLegalDOS8Dot3W,ScrollConsoleScreenBufferW,GetVolumeNameForVolumeMountPointW,TransactNamedPipe,ReadFile,CreateEventW,GetLogicalDriveStringsW,CreateDirectoryExW,EnumResourceTypesW,RegQueryValueExA,GetThreadGroupAffinity,CreateWaitableTimerW,GetNamedPipeClientComputerNameW,VirtualFreeEx,TerminateThread,SetDynamicTimeZoneInformation,GetLogicalDriveStringsW,CloseThreadpoolWork,GetThreadIdealProcessorEx,CreateJobObjectW,UnregisterWait,OpenFileById,MapViewOfFile,UnregisterWait,AddIntegrityLabelToBoundaryDescriptor,CancelIo,SetThreadPriorityBoost,QueryPerformanceFrequency,RegCloseKey,OutputDebugStringA,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C56670 GetProcessShutdownParameters,WriteConsoleOutputW,SetWaitableTimerEx,GetThreadId,LocalReAlloc,GetFirmwareEnvironmentVariableW,WakeAllConditionVariable,RegisterApplicationRecoveryCallback,GetNumberOfConsoleInputEvents,ContinueDebugEvent,DuplicateHandle,HeapReAlloc,CancelWaitableTimer,CancelIo,GetNumaHighestNodeNumber,SetFilePointer,FindNextVolumeMountPointW,InterlockedPushEntrySList,CreateWaitableTimerW,GlobalSize,DeleteVolumeMountPointW,IsWow64Process,QueryDosDeviceW,ReadFileEx,RegisterApplicationRecoveryCallback,ToAsciiEx,lstrcmpiW,SetThreadpoolTimerEx,GetRawInputData,GetFullPathNameW,TabbedTextOutW,QueryThreadProfiling,CreateMailslotW,EnumResourceTypesW,AcquireSRWLockExclusive,CharPrevExA,GetWindowsDirectoryW,GetWindowPlacement,GetFullPathNameTransactedW,SetFirmwareEnvironmentVariableW,BackupWrite,SetTapeParameters,IsValidLocaleName,CopyFileExW,LoadCursorFromFileW,FindFirstVolumeW,CharToOemW,AddSecureMemoryCacheCallback,MulDiv,QueryThreadProfiling,GetKeyboardLayout,DrawEdge,LoadPackagedLibrary,GetDynamicTimeZoneInformation,DebugActiveProcess,GetSystemDirectoryW,HeapCompact,GlobalHandle,WaitNamedPipeW,SetCommState,CreateMailslotW,VirtualProtect,InterlockedFlushSList,GlobalGetAtomNameW,AllocConsole,GetNLSVersionEx,GetSystemTimes,PowerSetRequest,WriteConsoleW,SetTimeZoneInformation,QueryProtectedPolicy,GetCurrentProcessorNumber,CompareFileTime,GetCurrentThread,ConvertDefaultLocale,GetActiveProcessorGroupCount,SetConsoleCursorPosition,SetConsoleOutputCP,NeedCurrentDirectoryForExePathW,OfferVirtualMemory,SetFileIoOverlappedRange,PrefetchVirtualMemory,SystemTimeToFileTime,GetProfileIntW,GetConsoleCursorInfo,GlobalGetAtomNameW,SizeofResource,GetCurrentThread,OpenEventW,EnumSystemGeoID,SleepConditionVariableCS,OpenWaitableTimerW,EnumResourceNamesW,SetThreadpoolStackInformation,GetLogicalProcessorInformationEx,ReadFileEx,GetConsoleAliasesW,QueryThreadProfiling,GetFileSizeEx,VirtualUnlock,GetSystemDirectoryW,FindNextChangeNotification,HeapWalk,TerminateThread,HeapWalk,UnlockFile,QueryThreadpoolStackInformation,CreateDirectoryExW,FindFirstFileTransactedW,LockFile,GetFileTime,CloseThreadpoolTimer,CheckTokenMembershipEx,UnregisterApplicationRestart,GetSystemTime,FlushFileBuffers,FindVolumeClose,GetUserDefaultLCID,ConvertThreadToFiber,AddSecureMemoryCacheCallback,GetNumaHighestNodeNumber,CloseThreadpoolIo,GetProcessPreferredUILanguages,DnsHostnameToComputerNameW,RaiseException,GetFileAttributesExW,SetVolumeMountPointW,lstrlenW,GetUserDefaultLCID,SetCommMask,SizeofResource,GetSystemDEPPolicy,GetVolumeNameForVolumeMountPointW,FreeLibrary,DrawFocusRect,DnsHostnameToComputerNameW,GetSystemMenu,GetThreadPriorityBoost,RegisterWindowMessageW,LogicalToPhysicalPoint,FreeLibraryWhenCallbackReturns,DdeSetUserHandle,GetModuleFileNameW,RemoveVectoredContinueHandler,SetConsoleMode,IsThreadpoolTimerSet,SetProcessWorkingSetSize,GetScrollPos,SetWindowContextHelpId,FlushConsoleInputBuffer,SetWaitableTimerEx,IsValidCodePage,CommConfigDialogW,EscapeCommFunct
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C5AC80
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C54090
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C533F0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C555A0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C578C0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C54B70
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C58CB0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF8C24
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D02ED0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE4EC0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE8EA8
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CECE98
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D00FE0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CFC1EC
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF815C
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE4210
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF83D8
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF24AC
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE4414
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF0588
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF66E8
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C5E6A0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C56670
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CFE614
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE39F0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF5BD4
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE3BF4
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CEBB2C
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE5C58
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE3E00
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CEE0CC
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF6068
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE4004
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CEF108
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CEB2E0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE93B4
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C57460
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CFB410
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CED53C
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D0356C
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C5F530
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CFF790
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59790
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CE5854
Source: C:\Windows\System32\loaddll64.exeCode function: String function: 00007FF8A8CDDAAC appears 216 times
Source: classification engineClassification label: mal56.winDLL@12/0@0/0
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CAAD30 GetDiskFreeSpaceExA,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0 GetDynamicTimeZoneInformation,SetUnhandledExceptionFilter,IsClipboardFormatAvailable,SleepConditionVariableSRW,GetActiveProcessorGroupCount,GetDlgItemInt,CreateDirectoryTransactedW,LoadPackagedLibrary,GetCommModemStatus,ReleaseMutex,WaitForDebugEvent,GetFullPathNameTransactedW,RaiseException,GetACP,GetBrushOrgEx,GlobalUnlock,GetNamedPipeClientComputerNameW,SetTapeParameters,WritePrivateProfileSectionW,FindCloseChangeNotification,BackupWrite,LocalFlags,GetThreadPreferredUILanguages,GetDeviceCaps,GetVolumePathNameW,CreateBrushIndirect,GetEnhMetaFileW,LPtoDP,PowerCreateRequest,GetConsoleOutputCP,SleepConditionVariableSRW,RaiseException,SetThreadPriorityBoost,OpenFile,SetFilePointerEx,FindNLSStringEx,QueryDosDeviceW,OpenMutexW,SetFileAttributesTransactedW,InterlockedPopEntrySList,PowerCreateRequest,GlobalReAlloc,GetProcAddress,LoadModule,CloseThreadpoolCleanupGroup,GetProcessHeaps,GetNLSVersionEx,GetCommState,FreeUserPhysicalPages,FreeResource,GetLocalTime,GetSystemInfo,CreateEventExW,MapViewOfFile,CreateRemoteThread,SetProcessShutdownParameters,SetDllDirectoryW,GetLongPathNameTransactedW,GetNumberOfConsoleMouseButtons,SetCalendarInfoW,DisassociateCurrentThreadFromCallback,GetCommProperties,BindIoCompletionCallback,CompareStringOrdinal,SetCommMask,Wow64GetThreadContext,IsProcessInJob,SystemTimeToTzSpecificLocalTime,IsValidLocale,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,GetProcessHeaps,SetFileApisToANSI,FindVolumeMountPointClose,InitOnceExecuteOnce,UnregisterApplicationRestart,FileTimeToDosDateTime,InitializeProcThreadAttributeList,ReOpenFile,LCMapStringW,SetProcessWorkingSetSizeEx,FindNLSString,GetMaximumProcessorCount,DdeReconnect,FindFirstVolumeW,InterlockedPushListSListEx,IsWindowUnicode,GetNumaAvailableMemoryNodeEx,TzSpecificLocalTimeToSystemTimeEx,ChangeDisplaySettingsW,UserHandleGrantAccess,GetTapeParameters,RemoveVectoredExceptionHandler,EnumTimeFormatsW,FindNextVolumeW,GetWriteWatch,SetProcessPreferredUILanguages,CharUpperW,GetStartupInfoW,DdeNameService,GetVersionExW,FatalExit,FatalExit,
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: libpkcs11-helper-1.dll.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLS_get_data_mtu
Source: libpkcs11-helper-1.dll.dllReversingLabs: Detection: 13%
Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll"
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLS_get_data_mtu
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_client_method
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_listen
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLS_get_data_mtu
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_client_method
Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_listen
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exeSection loaded: apphelp.dll
Source: C:\Windows\System32\loaddll64.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\loaddll64.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\loaddll64.exeSection loaded: cryptbase.dll
Source: libpkcs11-helper-1.dll.dllStatic PE information: More than 118 > 100 exports found
Source: libpkcs11-helper-1.dll.dllStatic PE information: Image base 0x180000000 > 0x60000000
Source: libpkcs11-helper-1.dll.dllStatic file information: File size 1396736 > 1048576
Source: libpkcs11-helper-1.dll.dllStatic PE information: More than 200 imports for KERNEL32.dll
Source: libpkcs11-helper-1.dll.dllStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: libpkcs11-helper-1.dll.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: libpkcs11-helper-1.dll.dllStatic PE information: section name: .hdata
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D94745 push rsi; ret
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C555A0 GetLocalTime,GetCurrentProcess,GetProcessTimes,FileTimeToSystemTime,OutputDebugStringW,GetLocalTime,GetDateFormatW,VirtualQuery,FormatMessageW,FindClose,WinExec,ReadThreadProfilingData,WriteConsoleOutputCharacterW,SetThreadpoolThreadMaximum,GetCurrentConsoleFontEx,SetHandleInformation,GetCurrentThreadId,GetEnvironmentVariableW,RegisterWaitForSingleObject,OffsetClipRgn,FindNLSStringEx,OpenMutexW,OutputDebugStringW,CloseHandle,OutputDebugStringW,GetTempPathW,GetFileAttributesW,OutputDebugStringA,RegOpenKeyExW,RegCloseKey,OutputDebugStringW,Concurrency::cancel_current_task,GetConsoleAliasesW,GetConsoleCursorInfo,RegisterApplicationRecoveryCallback,lstrcmpiW,CreateThreadpool,GetSystemPowerStatus,BeginUpdateResourceW,LoadResource,UnlockFileEx,CreateMutexExW,CreateMemoryResourceNotification,FindResourceW,GetCalendarInfoEx,DosDateTimeToFileTime,CreateThreadpoolWork,UnlockFileEx,GetFirmwareEnvironmentVariableW,DeleteProcThreadAttributeList,EnumTimeFormatsW,GetSystemFileCacheSize,CreateFileW,CancelThreadpoolIo,BackupSeek,SetStdHandle,CreateThreadpoolWork,FreeEnvironmentStringsW,GetUserDefaultLangID,EnumResourceNamesExW,IsDBCSLeadByte,GetConsoleProcessList,CloseThreadpoolIo,OpenFileById,RtlCaptureStackBackTrace,GetThreadPreferredUILanguages,TerminateThread,FatalExit,
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\loaddll64.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C5AC80 GetStartupInfoW,CopyFile2,SetProcessPriorityBoost,IsValidLanguageGroup,SetProcessPriorityBoost,AssignProcessToJobObject,GetModuleFileNameW,GetComputerNameW,GetPrivateProfileSectionW,GetDefaultCommConfigW,SystemTimeToFileTime,GetNumaProcessorNode,GetLocaleInfoEx,GetCurrentProcessorNumber,FindFirstFileNameW,CopyFileTransactedW,QueryPerformanceCounter,FlushConsoleInputBuffer,MapUserPhysicalPagesScatter,LCMapStringW,QueryMemoryResourceNotification,VerifyScripts,FindStringOrdinal,SetFileTime,SetThreadGroupAffinity,EnumTimeFormatsW,OutputDebugStringA,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C578C0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,GetLocalTime,OpenMutexA,GetTempPathW,GetTempFileNameW,CreateThreadpoolWait,GetSystemDefaultLangID,lstrlenW,HeapReAlloc,UnregisterBadMemoryNotification,ConnectNamedPipe,DeleteTimerQueueEx,FindFirstFileNameW,VirtualQuery,WaitCommEvent,CompareStringOrdinal,SetThreadErrorMode,WriteConsoleOutputW,IsThreadpoolTimerSet,NeedCurrentDirectoryForExePathW,HeapFree,GetDefaultCommConfigW,GetNamedPipeClientSessionId,FindVolumeClose,CreateSemaphoreW,CloseHandle,WakeConditionVariable,VerifyVersionInfoW,CompareStringEx,ConvertFiberToThread,GetStartupInfoW,GetOverlappedResultEx,GetProcessId,GetStringTypeW,WriteConsoleOutputCharacterW,SetTapeParameters,RegisterApplicationRestart,AddScopedPolicyIDAce,ConvertThreadToFiberEx,WaitForDebugEvent,UnregisterBadMemoryNotification,GetThreadSelectorEntry,LeaveCriticalSection,SetSystemFileCacheSize,VerifyScripts,SetUserGeoID,GetLocalTime,GetShortPathNameW,IsProcessInJob,GetVolumePathNamesForVolumeNameW,EscapeCommFunction,DeleteTimerQueueEx,WriteProcessMemory,IsValidLanguageGroup,GetDynamicTimeZoneInformation,InitOnceExecuteOnce,GetNumberOfConsoleMouseButtons,RtlCaptureStackBackTrace,GetNamedPipeServerProcessId,LoadResource,WinExec,GetCommModemStatus,FreeConsole,LoadResource,GetCurrentThread,CompareFileTime,HeapLock,GetNumberOfConsoleInputEvents,OpenFileMappingW,SetCommState,IsBadStringPtrW,GetStringTypeW,VirtualProtect,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D901C0 FindFirstFileNameW,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CFC1EC FindFirstFileExW,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C56670 GetProcessShutdownParameters,WriteConsoleOutputW,SetWaitableTimerEx,GetThreadId,LocalReAlloc,GetFirmwareEnvironmentVariableW,WakeAllConditionVariable,RegisterApplicationRecoveryCallback,GetNumberOfConsoleInputEvents,ContinueDebugEvent,DuplicateHandle,HeapReAlloc,CancelWaitableTimer,CancelIo,GetNumaHighestNodeNumber,SetFilePointer,FindNextVolumeMountPointW,InterlockedPushEntrySList,CreateWaitableTimerW,GlobalSize,DeleteVolumeMountPointW,IsWow64Process,QueryDosDeviceW,ReadFileEx,RegisterApplicationRecoveryCallback,ToAsciiEx,lstrcmpiW,SetThreadpoolTimerEx,GetRawInputData,GetFullPathNameW,TabbedTextOutW,QueryThreadProfiling,CreateMailslotW,EnumResourceTypesW,AcquireSRWLockExclusive,CharPrevExA,GetWindowsDirectoryW,GetWindowPlacement,GetFullPathNameTransactedW,SetFirmwareEnvironmentVariableW,BackupWrite,SetTapeParameters,IsValidLocaleName,CopyFileExW,LoadCursorFromFileW,FindFirstVolumeW,CharToOemW,AddSecureMemoryCacheCallback,MulDiv,QueryThreadProfiling,GetKeyboardLayout,DrawEdge,LoadPackagedLibrary,GetDynamicTimeZoneInformation,DebugActiveProcess,GetSystemDirectoryW,HeapCompact,GlobalHandle,WaitNamedPipeW,SetCommState,CreateMailslotW,VirtualProtect,InterlockedFlushSList,GlobalGetAtomNameW,AllocConsole,GetNLSVersionEx,GetSystemTimes,PowerSetRequest,WriteConsoleW,SetTimeZoneInformation,QueryProtectedPolicy,GetCurrentProcessorNumber,CompareFileTime,GetCurrentThread,ConvertDefaultLocale,GetActiveProcessorGroupCount,SetConsoleCursorPosition,SetConsoleOutputCP,NeedCurrentDirectoryForExePathW,OfferVirtualMemory,SetFileIoOverlappedRange,PrefetchVirtualMemory,SystemTimeToFileTime,GetProfileIntW,GetConsoleCursorInfo,GlobalGetAtomNameW,SizeofResource,GetCurrentThread,OpenEventW,EnumSystemGeoID,SleepConditionVariableCS,OpenWaitableTimerW,EnumResourceNamesW,SetThreadpoolStackInformation,GetLogicalProcessorInformationEx,ReadFileEx,GetConsoleAliasesW,QueryThreadProfiling,GetFileSizeEx,VirtualUnlock,GetSystemDirectoryW,FindNextChangeNotification,HeapWalk,TerminateThread,HeapWalk,UnlockFile,QueryThreadpoolStackInformation,CreateDirectoryExW,FindFirstFileTransactedW,LockFile,GetFileTime,CloseThreadpoolTimer,CheckTokenMembershipEx,UnregisterApplicationRestart,GetSystemTime,FlushFileBuffers,FindVolumeClose,GetUserDefaultLCID,ConvertThreadToFiber,AddSecureMemoryCacheCallback,GetNumaHighestNodeNumber,CloseThreadpoolIo,GetProcessPreferredUILanguages,DnsHostnameToComputerNameW,RaiseException,GetFileAttributesExW,SetVolumeMountPointW,lstrlenW,GetUserDefaultLCID,SetCommMask,SizeofResource,GetSystemDEPPolicy,GetVolumeNameForVolumeMountPointW,FreeLibrary,DrawFocusRect,DnsHostnameToComputerNameW,GetSystemMenu,GetThreadPriorityBoost,RegisterWindowMessageW,LogicalToPhysicalPoint,FreeLibraryWhenCallbackReturns,DdeSetUserHandle,GetModuleFileNameW,RemoveVectoredContinueHandler,SetConsoleMode,IsThreadpoolTimerSet,SetProcessWorkingSetSize,GetScrollPos,SetWindowContextHelpId,FlushConsoleInputBuffer,SetWaitableTimerEx,IsValidCodePage,CommConfigDialogW,EscapeCommFunct
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59790 UnregisterSuspendResumeNotification,ValidateRect,MessageBoxIndirectW,SetFileAttributesW,IsProcessDPIAware,SetProcessRestrictionExemption,GetModuleHandleExW,FindWindowExW,GetGUIThreadInfo,TransmitCommChar,HeapQueryInformation,SetSystemCursor,GetNumberOfConsoleInputEvents,RemoveVectoredExceptionHandler,SetLocaleInfoW,CopyFileW,mouse_event,GetCurrentProcess,GlobalReAlloc,EndDeferWindowPos,DefRawInputProc,GetUserDefaultLocaleName,PrefetchVirtualMemory,EnumWindows,DialogBoxParamW,DialogBoxParamW,SetProcessWorkingSetSizeEx,GetLastInputInfo,GetPriorityClass,SetNamedPipeHandleState,MapVirtualKeyW,OpenPrivateNamespaceW,SetSystemCursor,GetCurrentConsoleFont,TzSpecificLocalTimeToSystemTimeEx,FlushViewOfFile,FindNextVolumeW,NotifyUILanguageChange,EscapeCommFunction,Wow64SuspendThread,DeleteAtom,GetSystemDefaultLCID,GetFirmwareType,ReleaseSRWLockExclusive,SetCommTimeouts,RtlCaptureContext,GetCommMask,QueryProtectedPolicy,WriteConsoleW,RemoveDllDirectory,GetUserDefaultLangID,CreateMailslotW,StartThreadpoolIo,FatalAppExitW,GetCommProperties,Wow64SetThreadContext,GetFileInformationByHandle,SetConsoleHistoryInfo,WriteProfileStringW,InitializeSynchronizationBarrier,SetFilePointerEx,SetMailslotInfo,GetNumaAvailableMemoryNodeEx,GetProcessGroupAffinity,FindResourceW,ApplicationRecoveryInProgress,DnsHostnameToComputerNameW,GetConsoleProcessList,DeleteTimerQueueEx,GetNLSVersionEx,PurgeComm,OpenFileMappingW,FindFirstFileNameTransactedW,SetThreadpoolStackInformation,CheckTokenCapability,GetCurrencyFormatW,GetConsoleProcessList,GetCurrentConsoleFont,MapViewOfFileEx,RequestWakeupLatency,FlsFree,ConvertDefaultLocale,GetProcessHeap,TryEnterCriticalSection,EnumLanguageGroupLocalesW,EnumLanguageGroupLocalesW,DeleteTimerQueueEx,InitializeConditionVariable,GetLongPathNameTransactedW,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C533F0 GetTempPathA,GetTempFileNameA,QueryFullProcessImageNameW,CommConfigDialogW,CallbackMayRunLong,lstrcatW,UnregisterApplicationRestart,GetThreadSelectorEntry,BuildCommDCBW,SetConsoleHistoryInfo,PtVisible,CreatePrivateNamespaceW,GetConsoleSelectionInfo,WakeConditionVariable,PeekNamedPipe,EnumCalendarInfoExEx,Polygon,OpenWaitableTimerW,GetLogicalDrives,EnumResourceTypesExW,GetPhysicallyInstalledSystemMemory,SetEventWhenCallbackReturns,CopyFileW,GetFirmwareType,GetStartupInfoW,GetColorAdjustment,CreateMetaFileW,CancelWaitableTimer,BackupRead,GetCommState,GetCommandLineW,GetWindowsDirectoryW,GetConsoleCursorInfo,GetNamedPipeServerProcessId,GetMaximumProcessorGroupCount,OpenWaitableTimerW,SetFileAttributesTransactedW,DeleteTimerQueueEx,SetFileAttributesW,MoveFileExW,WaitForThreadpoolTimerCallbacks,CreateThreadpoolWait,CopyFileW,ReadConsoleOutputCharacterW,SetFirmwareEnvironmentVariableW,GetTempFileNameW,AddScopedPolicyIDAce,GetCPInfoExW,QueryInformationJobObject,FatalExit,CreateThreadpoolWork,RegOpenKeyExA,GetLongPathNameW,SetConsoleCP,VerifyScripts,CreateThreadpoolIo,EnumResourceLanguagesW,FindNLSString,CancelThreadpoolIo,UpdateResourceW,CheckNameLegalDOS8Dot3W,ScrollConsoleScreenBufferW,GetVolumeNameForVolumeMountPointW,TransactNamedPipe,ReadFile,CreateEventW,GetLogicalDriveStringsW,CreateDirectoryExW,EnumResourceTypesW,RegQueryValueExA,GetThreadGroupAffinity,CreateWaitableTimerW,GetNamedPipeClientComputerNameW,VirtualFreeEx,TerminateThread,SetDynamicTimeZoneInformation,GetLogicalDriveStringsW,CloseThreadpoolWork,GetThreadIdealProcessorEx,CreateJobObjectW,UnregisterWait,OpenFileById,MapViewOfFile,UnregisterWait,AddIntegrityLabelToBoundaryDescriptor,CancelIo,SetThreadPriorityBoost,QueryPerformanceFrequency,RegCloseKey,OutputDebugStringA,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0 GetDynamicTimeZoneInformation,SetUnhandledExceptionFilter,IsClipboardFormatAvailable,SleepConditionVariableSRW,GetActiveProcessorGroupCount,GetDlgItemInt,CreateDirectoryTransactedW,LoadPackagedLibrary,GetCommModemStatus,ReleaseMutex,WaitForDebugEvent,GetFullPathNameTransactedW,RaiseException,GetACP,GetBrushOrgEx,GlobalUnlock,GetNamedPipeClientComputerNameW,SetTapeParameters,WritePrivateProfileSectionW,FindCloseChangeNotification,BackupWrite,LocalFlags,GetThreadPreferredUILanguages,GetDeviceCaps,GetVolumePathNameW,CreateBrushIndirect,GetEnhMetaFileW,LPtoDP,PowerCreateRequest,GetConsoleOutputCP,SleepConditionVariableSRW,RaiseException,SetThreadPriorityBoost,OpenFile,SetFilePointerEx,FindNLSStringEx,QueryDosDeviceW,OpenMutexW,SetFileAttributesTransactedW,InterlockedPopEntrySList,PowerCreateRequest,GlobalReAlloc,GetProcAddress,LoadModule,CloseThreadpoolCleanupGroup,GetProcessHeaps,GetNLSVersionEx,GetCommState,FreeUserPhysicalPages,FreeResource,GetLocalTime,GetSystemInfo,CreateEventExW,MapViewOfFile,CreateRemoteThread,SetProcessShutdownParameters,SetDllDirectoryW,GetLongPathNameTransactedW,GetNumberOfConsoleMouseButtons,SetCalendarInfoW,DisassociateCurrentThreadFromCallback,GetCommProperties,BindIoCompletionCallback,CompareStringOrdinal,SetCommMask,Wow64GetThreadContext,IsProcessInJob,SystemTimeToTzSpecificLocalTime,IsValidLocale,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,GetProcessHeaps,SetFileApisToANSI,FindVolumeMountPointClose,InitOnceExecuteOnce,UnregisterApplicationRestart,FileTimeToDosDateTime,InitializeProcThreadAttributeList,ReOpenFile,LCMapStringW,SetProcessWorkingSetSizeEx,FindNLSString,GetMaximumProcessorCount,DdeReconnect,FindFirstVolumeW,InterlockedPushListSListEx,IsWindowUnicode,GetNumaAvailableMemoryNodeEx,TzSpecificLocalTimeToSystemTimeEx,ChangeDisplaySettingsW,UserHandleGrantAccess,GetTapeParameters,RemoveVectoredExceptionHandler,EnumTimeFormatsW,FindNextVolumeW,GetWriteWatch,SetProcessPreferredUILanguages,CharUpperW,GetStartupInfoW,DdeNameService,GetVersionExW,FatalExit,FatalExit,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C54090 AllocConsole,SetConsoleScreenBufferInfoEx,TryEnterCriticalSection,AreFileApisANSI,IsValidCodePage,SetDefaultCommConfigW,GetProcessHandleCount,ReleaseMutexWhenCallbackReturns,CloseThreadpoolTimer,DeleteCriticalSection,SetFileShortNameW,SystemTimeToFileTime,GetPrivateProfileSectionW,WriteConsoleW,GetStringTypeA,CreateEventExW,GetCurrentDirectoryW,GetFileAttributesW,GlobalAlloc,OutputDebugStringW,GlobalLock,LocalAlloc,FindNextVolumeW,GetCapture,GetEnvironmentStringsW,GetNumaAvailableMemoryNode,GetCurrentConsoleFontEx,SetComputerNameExW,UnregisterApplicationRestart,AnyPopup,IsZoomed,lstrcpyW,ReadConsoleInputW,GetMaximumProcessorCount,SetupComm,GetDiskFreeSpaceW,LocalLock,GetProcessHeap,IsDebuggerPresent,WaitForThreadpoolTimerCallbacks,GlobalHandle,SetUnhandledExceptionFilter,CreateThreadpool,HeapAlloc,MulDiv,SetCommConfig,FindNextFileW,SetFileValidData,ReleaseMutex,SetThreadLocale,CreateFileMappingFromApp,PrepareTape,GetLogicalProcessorInformation,WriteFileEx,VirtualAlloc,AllocConsole,CloseHandle,WritePrivateProfileSectionW,GetLocaleInfoW,GlobalSize,HeapFree,CreateTapePartition,GetDriveTypeW,GetErrorMode,GetCurrentThreadId,SetConsoleTextAttribute,CreateEventExW,GetProcessHandleCount,IsDBCSLeadByte,GetMaximumProcessorCount,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0 GetDynamicTimeZoneInformation,SetUnhandledExceptionFilter,IsClipboardFormatAvailable,SleepConditionVariableSRW,GetActiveProcessorGroupCount,GetDlgItemInt,CreateDirectoryTransactedW,LoadPackagedLibrary,GetCommModemStatus,ReleaseMutex,WaitForDebugEvent,GetFullPathNameTransactedW,RaiseException,GetACP,GetBrushOrgEx,GlobalUnlock,GetNamedPipeClientComputerNameW,SetTapeParameters,WritePrivateProfileSectionW,FindCloseChangeNotification,BackupWrite,LocalFlags,GetThreadPreferredUILanguages,GetDeviceCaps,GetVolumePathNameW,CreateBrushIndirect,GetEnhMetaFileW,LPtoDP,PowerCreateRequest,GetConsoleOutputCP,SleepConditionVariableSRW,RaiseException,SetThreadPriorityBoost,OpenFile,SetFilePointerEx,FindNLSStringEx,QueryDosDeviceW,OpenMutexW,SetFileAttributesTransactedW,InterlockedPopEntrySList,PowerCreateRequest,GlobalReAlloc,GetProcAddress,LoadModule,CloseThreadpoolCleanupGroup,GetProcessHeaps,GetNLSVersionEx,GetCommState,FreeUserPhysicalPages,FreeResource,GetLocalTime,GetSystemInfo,CreateEventExW,MapViewOfFile,CreateRemoteThread,SetProcessShutdownParameters,SetDllDirectoryW,GetLongPathNameTransactedW,GetNumberOfConsoleMouseButtons,SetCalendarInfoW,DisassociateCurrentThreadFromCallback,GetCommProperties,BindIoCompletionCallback,CompareStringOrdinal,SetCommMask,Wow64GetThreadContext,IsProcessInJob,SystemTimeToTzSpecificLocalTime,IsValidLocale,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,GetProcessHeaps,SetFileApisToANSI,FindVolumeMountPointClose,InitOnceExecuteOnce,UnregisterApplicationRestart,FileTimeToDosDateTime,InitializeProcThreadAttributeList,ReOpenFile,LCMapStringW,SetProcessWorkingSetSizeEx,FindNLSString,GetMaximumProcessorCount,DdeReconnect,FindFirstVolumeW,InterlockedPushListSListEx,IsWindowUnicode,GetNumaAvailableMemoryNodeEx,TzSpecificLocalTimeToSystemTimeEx,ChangeDisplaySettingsW,UserHandleGrantAccess,GetTapeParameters,RemoveVectoredExceptionHandler,EnumTimeFormatsW,FindNextVolumeW,GetWriteWatch,SetProcessPreferredUILanguages,CharUpperW,GetStartupInfoW,DdeNameService,GetVersionExW,FatalExit,FatalExit,
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0 GetDynamicTimeZoneInformation,SetUnhandledExceptionFilter,IsClipboardFormatAvailable,SleepConditionVariableSRW,GetActiveProcessorGroupCount,GetDlgItemInt,CreateDirectoryTransactedW,LoadPackagedLibrary,GetCommModemStatus,ReleaseMutex,WaitForDebugEvent,GetFullPathNameTransactedW,RaiseException,GetACP,GetBrushOrgEx,GlobalUnlock,GetNamedPipeClientComputerNameW,SetTapeParameters,WritePrivateProfileSectionW,FindCloseChangeNotification,BackupWrite,LocalFlags,GetThreadPreferredUILanguages,GetDeviceCaps,GetVolumePathNameW,CreateBrushIndirect,GetEnhMetaFileW,LPtoDP,PowerCreateRequest,GetConsoleOutputCP,SleepConditionVariableSRW,RaiseException,SetThreadPriorityBoost,OpenFile,SetFilePointerEx,FindNLSStringEx,QueryDosDeviceW,OpenMutexW,SetFileAttributesTransactedW,InterlockedPopEntrySList,PowerCreateRequest,GlobalReAlloc,GetProcAddress,LoadModule,CloseThreadpoolCleanupGroup,GetProcessHeaps,GetNLSVersionEx,GetCommState,FreeUserPhysicalPages,FreeResource,GetLocalTime,GetSystemInfo,CreateEventExW,MapViewOfFile,CreateRemoteThread,SetProcessShutdownParameters,SetDllDirectoryW,GetLongPathNameTransactedW,GetNumberOfConsoleMouseButtons,SetCalendarInfoW,DisassociateCurrentThreadFromCallback,GetCommProperties,BindIoCompletionCallback,CompareStringOrdinal,SetCommMask,Wow64GetThreadContext,IsProcessInJob,SystemTimeToTzSpecificLocalTime,IsValidLocale,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,GetProcessHeaps,SetFileApisToANSI,FindVolumeMountPointClose,InitOnceExecuteOnce,UnregisterApplicationRestart,FileTimeToDosDateTime,InitializeProcThreadAttributeList,ReOpenFile,LCMapStringW,SetProcessWorkingSetSizeEx,FindNLSString,GetMaximumProcessorCount,DdeReconnect,FindFirstVolumeW,InterlockedPushListSListEx,IsWindowUnicode,GetNumaAvailableMemoryNodeEx,TzSpecificLocalTimeToSystemTimeEx,ChangeDisplaySettingsW,UserHandleGrantAccess,GetTapeParameters,RemoveVectoredExceptionHandler,EnumTimeFormatsW,FindNextVolumeW,GetWriteWatch,SetProcessPreferredUILanguages,CharUpperW,GetStartupInfoW,DdeNameService,GetVersionExW,FatalExit,FatalExit,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C54090 AllocConsole,SetConsoleScreenBufferInfoEx,TryEnterCriticalSection,AreFileApisANSI,IsValidCodePage,SetDefaultCommConfigW,GetProcessHandleCount,ReleaseMutexWhenCallbackReturns,CloseThreadpoolTimer,DeleteCriticalSection,SetFileShortNameW,SystemTimeToFileTime,GetPrivateProfileSectionW,WriteConsoleW,GetStringTypeA,CreateEventExW,GetCurrentDirectoryW,GetFileAttributesW,GlobalAlloc,OutputDebugStringW,GlobalLock,LocalAlloc,FindNextVolumeW,GetCapture,GetEnvironmentStringsW,GetNumaAvailableMemoryNode,GetCurrentConsoleFontEx,SetComputerNameExW,UnregisterApplicationRestart,AnyPopup,IsZoomed,lstrcpyW,ReadConsoleInputW,GetMaximumProcessorCount,SetupComm,GetDiskFreeSpaceW,LocalLock,GetProcessHeap,IsDebuggerPresent,WaitForThreadpoolTimerCallbacks,GlobalHandle,SetUnhandledExceptionFilter,CreateThreadpool,HeapAlloc,MulDiv,SetCommConfig,FindNextFileW,SetFileValidData,ReleaseMutex,SetThreadLocale,CreateFileMappingFromApp,PrepareTape,GetLogicalProcessorInformation,WriteFileEx,VirtualAlloc,AllocConsole,CloseHandle,WritePrivateProfileSectionW,GetLocaleInfoW,GlobalSize,HeapFree,CreateTapePartition,GetDriveTypeW,GetErrorMode,GetCurrentThreadId,SetConsoleTextAttribute,CreateEventExW,GetProcessHandleCount,IsDBCSLeadByte,GetMaximumProcessorCount,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D90DA0 SetUnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CEC8B4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CDC808 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59790 UnregisterSuspendResumeNotification,ValidateRect,MessageBoxIndirectW,SetFileAttributesW,IsProcessDPIAware,SetProcessRestrictionExemption,GetModuleHandleExW,FindWindowExW,GetGUIThreadInfo,TransmitCommChar,HeapQueryInformation,SetSystemCursor,GetNumberOfConsoleInputEvents,RemoveVectoredExceptionHandler,SetLocaleInfoW,CopyFileW,mouse_event,GetCurrentProcess,GlobalReAlloc,EndDeferWindowPos,DefRawInputProc,GetUserDefaultLocaleName,PrefetchVirtualMemory,EnumWindows,DialogBoxParamW,DialogBoxParamW,SetProcessWorkingSetSizeEx,GetLastInputInfo,GetPriorityClass,SetNamedPipeHandleState,MapVirtualKeyW,OpenPrivateNamespaceW,SetSystemCursor,GetCurrentConsoleFont,TzSpecificLocalTimeToSystemTimeEx,FlushViewOfFile,FindNextVolumeW,NotifyUILanguageChange,EscapeCommFunction,Wow64SuspendThread,DeleteAtom,GetSystemDefaultLCID,GetFirmwareType,ReleaseSRWLockExclusive,SetCommTimeouts,RtlCaptureContext,GetCommMask,QueryProtectedPolicy,WriteConsoleW,RemoveDllDirectory,GetUserDefaultLangID,CreateMailslotW,StartThreadpoolIo,FatalAppExitW,GetCommProperties,Wow64SetThreadContext,GetFileInformationByHandle,SetConsoleHistoryInfo,WriteProfileStringW,InitializeSynchronizationBarrier,SetFilePointerEx,SetMailslotInfo,GetNumaAvailableMemoryNodeEx,GetProcessGroupAffinity,FindResourceW,ApplicationRecoveryInProgress,DnsHostnameToComputerNameW,GetConsoleProcessList,DeleteTimerQueueEx,GetNLSVersionEx,PurgeComm,OpenFileMappingW,FindFirstFileNameTransactedW,SetThreadpoolStackInformation,CheckTokenCapability,GetCurrencyFormatW,GetConsoleProcessList,GetCurrentConsoleFont,MapViewOfFileEx,RequestWakeupLatency,FlsFree,ConvertDefaultLocale,GetProcessHeap,TryEnterCriticalSection,EnumLanguageGroupLocalesW,EnumLanguageGroupLocalesW,DeleteTimerQueueEx,InitializeConditionVariable,GetLongPathNameTransactedW,
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8D05D60 cpuid
Source: C:\Windows\System32\loaddll64.exeCode function: GetStartupInfoW,CopyFile2,SetProcessPriorityBoost,IsValidLanguageGroup,SetProcessPriorityBoost,AssignProcessToJobObject,GetModuleFileNameW,GetComputerNameW,GetPrivateProfileSectionW,GetDefaultCommConfigW,SystemTimeToFileTime,GetNumaProcessorNode,GetLocaleInfoEx,GetCurrentProcessorNumber,FindFirstFileNameW,CopyFileTransactedW,QueryPerformanceCounter,FlushConsoleInputBuffer,MapUserPhysicalPagesScatter,LCMapStringW,QueryMemoryResourceNotification,VerifyScripts,FindStringOrdinal,SetFileTime,SetThreadGroupAffinity,EnumTimeFormatsW,OutputDebugStringA,
Source: C:\Windows\System32\loaddll64.exeCode function: AllocConsole,SetConsoleScreenBufferInfoEx,TryEnterCriticalSection,AreFileApisANSI,IsValidCodePage,SetDefaultCommConfigW,GetProcessHandleCount,ReleaseMutexWhenCallbackReturns,CloseThreadpoolTimer,DeleteCriticalSection,SetFileShortNameW,SystemTimeToFileTime,GetPrivateProfileSectionW,WriteConsoleW,GetStringTypeA,CreateEventExW,GetCurrentDirectoryW,GetFileAttributesW,GlobalAlloc,OutputDebugStringW,GlobalLock,LocalAlloc,FindNextVolumeW,GetCapture,GetEnvironmentStringsW,GetNumaAvailableMemoryNode,GetCurrentConsoleFontEx,SetComputerNameExW,UnregisterApplicationRestart,AnyPopup,IsZoomed,lstrcpyW,ReadConsoleInputW,GetMaximumProcessorCount,SetupComm,GetDiskFreeSpaceW,LocalLock,GetProcessHeap,IsDebuggerPresent,WaitForThreadpoolTimerCallbacks,GlobalHandle,SetUnhandledExceptionFilter,CreateThreadpool,HeapAlloc,MulDiv,SetCommConfig,FindNextFileW,SetFileValidData,ReleaseMutex,SetThreadLocale,CreateFileMappingFromApp,PrepareTape,GetLogicalProcessorInformation,WriteFileEx,VirtualAlloc,AllocConsole,CloseHandle,WritePrivateProfileSectionW,GetLocaleInfoW,GlobalSize,HeapFree,CreateTapePartition,GetDriveTypeW,GetErrorMode,GetCurrentThreadId,SetConsoleTextAttribute,CreateEventExW,GetProcessHandleCount,IsDBCSLeadByte,GetMaximumProcessorCount,
Source: C:\Windows\System32\loaddll64.exeCode function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exeCode function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoEx,
Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exeCode function: GetProcessShutdownParameters,WriteConsoleOutputW,SetWaitableTimerEx,GetThreadId,LocalReAlloc,GetFirmwareEnvironmentVariableW,WakeAllConditionVariable,RegisterApplicationRecoveryCallback,GetNumberOfConsoleInputEvents,ContinueDebugEvent,DuplicateHandle,HeapReAlloc,CancelWaitableTimer,CancelIo,GetNumaHighestNodeNumber,SetFilePointer,FindNextVolumeMountPointW,InterlockedPushEntrySList,CreateWaitableTimerW,GlobalSize,DeleteVolumeMountPointW,IsWow64Process,QueryDosDeviceW,ReadFileEx,RegisterApplicationRecoveryCallback,ToAsciiEx,lstrcmpiW,SetThreadpoolTimerEx,GetRawInputData,GetFullPathNameW,TabbedTextOutW,QueryThreadProfiling,CreateMailslotW,EnumResourceTypesW,AcquireSRWLockExclusive,CharPrevExA,GetWindowsDirectoryW,GetWindowPlacement,GetFullPathNameTransactedW,SetFirmwareEnvironmentVariableW,BackupWrite,SetTapeParameters,IsValidLocaleName,CopyFileExW,LoadCursorFromFileW,FindFirstVolumeW,CharToOemW,AddSecureMemoryCacheCallback,MulDiv,QueryThreadProfiling,GetKeyboardLayout,DrawEdge,LoadPackagedLibrary,GetDynamicTimeZoneInformation,DebugActiveProcess,GetSystemDirectoryW,HeapCompact,GlobalHandle,WaitNamedPipeW,SetCommState,CreateMailslotW,VirtualProtect,InterlockedFlushSList,GlobalGetAtomNameW,AllocConsole,GetNLSVersionEx,GetSystemTimes,PowerSetRequest,WriteConsoleW,SetTimeZoneInformation,QueryProtectedPolicy,GetCurrentProcessorNumber,CompareFileTime,GetCurrentThread,ConvertDefaultLocale,GetActiveProcessorGroupCount,SetConsoleCursorPosition,SetConsoleOutputCP,NeedCurrentDirectoryForExePathW,OfferVirtualMemory,SetFileIoOverlappedRange,PrefetchVirtualMemory,SystemTimeToFileTime,GetProfileIntW,GetConsoleCursorInfo,GlobalGetAtomNameW,SizeofResource,GetCurrentThread,OpenEventW,EnumSystemGeoID,SleepConditionVariableCS,OpenWaitableTimerW,EnumResourceNamesW,SetThreadpoolStackInformation,GetLogicalProcessorInformationEx,ReadFileEx,GetConsoleAliasesW,QueryThreadProfiling,GetFileSizeEx,VirtualUnlock,GetSystemDirectoryW,FindNextChangeNotification,HeapWalk,TerminateThread,HeapWalk,UnlockFile,QueryThreadpoolStackInformation,CreateDirectoryExW,FindFirstFileTransactedW,LockFile,GetFileTime,CloseThreadpoolTimer,CheckTokenMembershipEx,UnregisterApplicationRestart,GetSystemTime,FlushFileBuffers,FindVolumeClose,GetUserDefaultLCID,ConvertThreadToFiber,AddSecureMemoryCacheCallback,GetNumaHighestNodeNumber,CloseThreadpoolIo,GetProcessPreferredUILanguages,DnsHostnameToComputerNameW,RaiseException,GetFileAttributesExW,SetVolumeMountPointW,lstrlenW,GetUserDefaultLCID,SetCommMask,SizeofResource,GetSystemDEPPolicy,GetVolumeNameForVolumeMountPointW,FreeLibrary,DrawFocusRect,DnsHostnameToComputerNameW,GetSystemMenu,GetThreadPriorityBoost,RegisterWindowMessageW,LogicalToPhysicalPoint,FreeLibraryWhenCallbackReturns,DdeSetUserHandle,GetModuleFileNameW,RemoveVectoredContinueHandler,SetConsoleMode,IsThreadpoolTimerSet,SetProcessWorkingSetSize,GetScrollPos,SetWindowContextHelpId,FlushConsoleInputBuffer,SetWaitableTimerEx,IsValidCodePage,CommConfigDialogW,EscapeCommFunction,EnumSystemLocales
Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exeCode function: EnumSystemLocalesW,
Source: C:\Windows\System32\loaddll64.exeCode function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0 GetDynamicTimeZoneInformation,SetUnhandledExceptionFilter,IsClipboardFormatAvailable,SleepConditionVariableSRW,GetActiveProcessorGroupCount,GetDlgItemInt,CreateDirectoryTransactedW,LoadPackagedLibrary,GetCommModemStatus,ReleaseMutex,WaitForDebugEvent,GetFullPathNameTransactedW,RaiseException,GetACP,GetBrushOrgEx,GlobalUnlock,GetNamedPipeClientComputerNameW,SetTapeParameters,WritePrivateProfileSectionW,FindCloseChangeNotification,BackupWrite,LocalFlags,GetThreadPreferredUILanguages,GetDeviceCaps,GetVolumePathNameW,CreateBrushIndirect,GetEnhMetaFileW,LPtoDP,PowerCreateRequest,GetConsoleOutputCP,SleepConditionVariableSRW,RaiseException,SetThreadPriorityBoost,OpenFile,SetFilePointerEx,FindNLSStringEx,QueryDosDeviceW,OpenMutexW,SetFileAttributesTransactedW,InterlockedPopEntrySList,PowerCreateRequest,GlobalReAlloc,GetProcAddress,LoadModule,CloseThreadpoolCleanupGroup,GetProcessHeaps,GetNLSVersionEx,GetCommState,FreeUserPhysicalPages,FreeResource,GetLocalTime,GetSystemInfo,CreateEventExW,MapViewOfFile,CreateRemoteThread,SetProcessShutdownParameters,SetDllDirectoryW,GetLongPathNameTransactedW,GetNumberOfConsoleMouseButtons,SetCalendarInfoW,DisassociateCurrentThreadFromCallback,GetCommProperties,BindIoCompletionCallback,CompareStringOrdinal,SetCommMask,Wow64GetThreadContext,IsProcessInJob,SystemTimeToTzSpecificLocalTime,IsValidLocale,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,GetProcessHeaps,SetFileApisToANSI,FindVolumeMountPointClose,InitOnceExecuteOnce,UnregisterApplicationRestart,FileTimeToDosDateTime,InitializeProcThreadAttributeList,ReOpenFile,LCMapStringW,SetProcessWorkingSetSizeEx,FindNLSString,GetMaximumProcessorCount,DdeReconnect,FindFirstVolumeW,InterlockedPushListSListEx,IsWindowUnicode,GetNumaAvailableMemoryNodeEx,TzSpecificLocalTimeToSystemTimeEx,ChangeDisplaySettingsW,UserHandleGrantAccess,GetTapeParameters,RemoveVectoredExceptionHandler,EnumTimeFormatsW,FindNextVolumeW,GetWriteWatch,SetProcessPreferredUILanguages,CharUpperW,GetStartupInfoW,DdeNameService,GetVersionExW,FatalExit,FatalExit,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8CF815C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0 GetDynamicTimeZoneInformation,SetUnhandledExceptionFilter,IsClipboardFormatAvailable,SleepConditionVariableSRW,GetActiveProcessorGroupCount,GetDlgItemInt,CreateDirectoryTransactedW,LoadPackagedLibrary,GetCommModemStatus,ReleaseMutex,WaitForDebugEvent,GetFullPathNameTransactedW,RaiseException,GetACP,GetBrushOrgEx,GlobalUnlock,GetNamedPipeClientComputerNameW,SetTapeParameters,WritePrivateProfileSectionW,FindCloseChangeNotification,BackupWrite,LocalFlags,GetThreadPreferredUILanguages,GetDeviceCaps,GetVolumePathNameW,CreateBrushIndirect,GetEnhMetaFileW,LPtoDP,PowerCreateRequest,GetConsoleOutputCP,SleepConditionVariableSRW,RaiseException,SetThreadPriorityBoost,OpenFile,SetFilePointerEx,FindNLSStringEx,QueryDosDeviceW,OpenMutexW,SetFileAttributesTransactedW,InterlockedPopEntrySList,PowerCreateRequest,GlobalReAlloc,GetProcAddress,LoadModule,CloseThreadpoolCleanupGroup,GetProcessHeaps,GetNLSVersionEx,GetCommState,FreeUserPhysicalPages,FreeResource,GetLocalTime,GetSystemInfo,CreateEventExW,MapViewOfFile,CreateRemoteThread,SetProcessShutdownParameters,SetDllDirectoryW,GetLongPathNameTransactedW,GetNumberOfConsoleMouseButtons,SetCalendarInfoW,DisassociateCurrentThreadFromCallback,GetCommProperties,BindIoCompletionCallback,CompareStringOrdinal,SetCommMask,Wow64GetThreadContext,IsProcessInJob,SystemTimeToTzSpecificLocalTime,IsValidLocale,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,GetProcessHeaps,SetFileApisToANSI,FindVolumeMountPointClose,InitOnceExecuteOnce,UnregisterApplicationRestart,FileTimeToDosDateTime,InitializeProcThreadAttributeList,ReOpenFile,LCMapStringW,SetProcessWorkingSetSizeEx,FindNLSString,GetMaximumProcessorCount,DdeReconnect,FindFirstVolumeW,InterlockedPushListSListEx,IsWindowUnicode,GetNumaAvailableMemoryNodeEx,TzSpecificLocalTimeToSystemTimeEx,ChangeDisplaySettingsW,UserHandleGrantAccess,GetTapeParameters,RemoveVectoredExceptionHandler,EnumTimeFormatsW,FindNextVolumeW,GetWriteWatch,SetProcessPreferredUILanguages,CharUpperW,GetStartupInfoW,DdeNameService,GetVersionExW,FatalExit,FatalExit,
Source: C:\Windows\System32\loaddll64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FF8A8C59CD0 GetDynamicTimeZoneInformation,SetUnhandledExceptionFilter,IsClipboardFormatAvailable,SleepConditionVariableSRW,GetActiveProcessorGroupCount,GetDlgItemInt,CreateDirectoryTransactedW,LoadPackagedLibrary,GetCommModemStatus,ReleaseMutex,WaitForDebugEvent,GetFullPathNameTransactedW,RaiseException,GetACP,GetBrushOrgEx,GlobalUnlock,GetNamedPipeClientComputerNameW,SetTapeParameters,WritePrivateProfileSectionW,FindCloseChangeNotification,BackupWrite,LocalFlags,GetThreadPreferredUILanguages,GetDeviceCaps,GetVolumePathNameW,CreateBrushIndirect,GetEnhMetaFileW,LPtoDP,PowerCreateRequest,GetConsoleOutputCP,SleepConditionVariableSRW,RaiseException,SetThreadPriorityBoost,OpenFile,SetFilePointerEx,FindNLSStringEx,QueryDosDeviceW,OpenMutexW,SetFileAttributesTransactedW,InterlockedPopEntrySList,PowerCreateRequest,GlobalReAlloc,GetProcAddress,LoadModule,CloseThreadpoolCleanupGroup,GetProcessHeaps,GetNLSVersionEx,GetCommState,FreeUserPhysicalPages,FreeResource,GetLocalTime,GetSystemInfo,CreateEventExW,MapViewOfFile,CreateRemoteThread,SetProcessShutdownParameters,SetDllDirectoryW,GetLongPathNameTransactedW,GetNumberOfConsoleMouseButtons,SetCalendarInfoW,DisassociateCurrentThreadFromCallback,GetCommProperties,BindIoCompletionCallback,CompareStringOrdinal,SetCommMask,Wow64GetThreadContext,IsProcessInJob,SystemTimeToTzSpecificLocalTime,IsValidLocale,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,GetProcessHeaps,SetFileApisToANSI,FindVolumeMountPointClose,InitOnceExecuteOnce,UnregisterApplicationRestart,FileTimeToDosDateTime,InitializeProcThreadAttributeList,ReOpenFile,LCMapStringW,SetProcessWorkingSetSizeEx,FindNLSString,GetMaximumProcessorCount,DdeReconnect,FindFirstVolumeW,InterlockedPushListSListEx,IsWindowUnicode,GetNumaAvailableMemoryNodeEx,TzSpecificLocalTimeToSystemTimeEx,ChangeDisplaySettingsW,UserHandleGrantAccess,GetTapeParameters,RemoveVectoredExceptionHandler,EnumTimeFormatsW,FindNextVolumeW,GetWriteWatch,SetProcessPreferredUILanguages,CharUpperW,GetStartupInfoW,DdeNameService,GetVersionExW,FatalExit,FatalExit,
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API
1
DLL Side-Loading
11
Process Injection
1
Virtualization/Sandbox Evasion
11
Input Capture
2
System Time Discovery
Remote Services11
Input Capture
2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading
11
Process Injection
LSASS Memory2
Security Software Discovery
Remote Desktop Protocol1
Archive Collected Data
Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information
Security Account Manager1
Virtualization/Sandbox Evasion
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
Obfuscated Files or Information
NTDS2
File and Directory Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Rundll32
LSA Secrets27
System Information Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading
Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1562676 Sample: libpkcs11-helper-1.dll.exe Startdate: 25/11/2024 Architecture: WINDOWS Score: 56 19 Multi AV Scanner detection for submitted file 2->19 21 Machine Learning detection for sample 2->21 23 AI detected suspicious sample 2->23 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 2 other processes 7->15 process5 17 rundll32.exe 9->17         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
libpkcs11-helper-1.dll.dll13%ReversingLabs
libpkcs11-helper-1.dll.dll100%Joe Sandbox ML
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox version:41.0.0 Charoite
Analysis ID:1562676
Start date and time:2024-11-25 21:33:06 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 2m 39s
Hypervisor based Inspection enabled:false
Report type:light
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:8
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:libpkcs11-helper-1.dll.dll
(renamed file extension from exe to dll)
Original Sample Name:libpkcs11-helper-1.dll.exe
Detection:MAL
Classification:mal56.winDLL@12/0@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Stop behavior analysis, all processes terminated
  • Exclude process from analysis (whitelisted): dllhost.exe
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: libpkcs11-helper-1.dll.dll
No simulations
No context
No context
No context
No context
No context
No created / dropped files found
File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):6.735401999676938
TrID:
  • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
  • Win64 Executable (generic) (12005/4) 10.17%
  • Generic Win/DOS Executable (2004/3) 1.70%
  • DOS Executable Generic (2002/1) 1.70%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:libpkcs11-helper-1.dll.dll
File size:1'396'736 bytes
MD5:923f2b061c22b2de64f2b228f676fe95
SHA1:40830c37101ed4f779955c8d0e1718d51714eb83
SHA256:5d15ca989acd53de9e458bca2ac226ece6c3e1cf97b070c930a9f3f4b6144a21
SHA512:c74840d5d5da8e7b5befdd5dd4fdff5bbd96d0e4d244cd69672c665cf490b7936347b66ac505fd3d1e7f75104281cfcb0702022274fa40ee71d6f08e672e896d
SSDEEP:12288:ofcrcqxscK9J+jARFtUGRPIsTywaHC/Vm4sXCYl7Ks5mehO3y/7Q31jfMYgk/yJh:ErzGD+mfXCYVKjLxM
TLSH:0E55B531B522B162E0385077D74F65CAC7E7A83A0BF15ACB8ADF07D9475ADB70129232
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Cg.........." ...).x...$......P.....................................................`................................
Icon Hash:7ae282899bbab082
Entrypoint:0x18008c350
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x180000000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:0x674381BE [Sun Nov 24 19:42:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:0
File Version Major:6
File Version Minor:0
Subsystem Version Major:6
Subsystem Version Minor:0
Import Hash:e387dc4bdb5cad8e22d8d6f93255e70f
Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F4074C3E477h
call 00007F4074C3EA54h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F4074C3E310h
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F4074C3E482h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F4074C3E485h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F4074C3E47Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F4074C3E48Ah
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
add byte ptr [eax], al
NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x155de00xf58.hdata
IMAGE_DIRECTORY_ENTRY_IMPORT0x156d380x8c.hdata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x1380000x7b00.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x15c0000x1228.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x14f1600x1c.hdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x14f3000x28.hdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x14f0200x140.hdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x1400000x12a0.hdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000xb776c0xb7800b57a10af318c8f657ba255011a4e5121False0.2834466003916894data6.282067419257649IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0xb90000x7e13c0x792006a950a7c61dd7c9c4d473a0db89a73a0False0.4171363035345717DOS executable (block device driver)5.981572925789988IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata0x1380000x7b000x7c00f5883b3d0ab4ca12b3c2898190c39ff0False0.4255922379032258PEX Binary Archive5.784283108873415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hdata0x1400000x1b17a0x1b200aa2c1b6ed0781a7f3de99bbc62a9a463False0.40666402649769584data5.101172330682713IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0x15c0000x12280x140060019b946543072edb9f437826abddc0False0.4306640625data5.154396489304555IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
DLLImport
KERNEL32.dllInitOnceExecuteOnce, GetNumaAvailableMemoryNodeEx, GetProcessShutdownParameters, CreateThreadpool, WriteProcessMemory, SetHandleInformation, NeedCurrentDirectoryForExePathW, SetEventWhenCallbackReturns, LoadModule, GetConsoleAliasesW, MapUserPhysicalPagesScatter, FindFirstVolumeW, GetSystemDefaultLCID, VirtualProtect, CopyFileTransactedW, CreateDirectoryTransactedW, HeapFree, GetPhysicallyInstalledSystemMemory, CreateEventExW, SetConsoleTextAttribute, GetCommProperties, FindFirstFileNameW, RtlCaptureContext, GetCommandLineW, CreateTapePartition, IsThreadpoolTimerSet, EnumCalendarInfoExEx, FindVolumeMountPointClose, QueryProtectedPolicy, GetFullPathNameW, FindNextFileW, FindNLSString, GetLongPathNameW, GetCurrentProcess, GetConsoleOutputCP, lstrlenW, CreateWaitableTimerW, SetFileShortNameW, EnumResourceTypesW, SetDynamicTimeZoneInformation, WriteFile, Wow64DisableWow64FsRedirection, TzSpecificLocalTimeToSystemTimeEx, GetThreadIdealProcessorEx, CheckTokenMembershipEx, RegisterWaitForSingleObject, RemoveDllDirectory, GetModuleHandleExW, SetTimeZoneInformation, CreatePrivateNamespaceW, UnregisterWait, GetShortPathNameW, GetDiskFreeSpaceW, SetConsoleMode, GetConsoleCursorInfo, OutputDebugStringA, VirtualAlloc, AssignProcessToJobObject, GetNumberOfConsoleMouseButtons, WaitForDebugEvent, GetProfileIntW, PrefetchVirtualMemory, WakeAllConditionVariable, HeapLock, DisassociateCurrentThreadFromCallback, SetFileTime, GetUserDefaultLangID, AddSecureMemoryCacheCallback, GetModuleFileNameW, OpenPrivateNamespaceW, WakeConditionVariable, CreateThreadpoolIo, ReOpenFile, PurgeComm, GetSystemTimes, SetMailslotInfo, InitializeProcThreadAttributeList, GetCommModemStatus, RequestWakeupLatency, SetProcessShutdownParameters, GetThreadSelectorEntry, AddScopedPolicyIDAce, GetLocaleInfoEx, GetUserDefaultLocaleName, Wow64SetThreadContext, CheckTokenCapability, GetProcessId, VirtualUnlock, CreateJobObjectW, DeleteTimerQueueEx, GetUserDefaultUILanguage, GetNamedPipeClientComputerNameW, CompareStringOrdinal, SetSystemFileCacheSize, LockFile, DnsHostnameToComputerNameW, GetThreadPreferredUILanguages, DeleteAtom, GetNamedPipeClientProcessId, GetDynamicTimeZoneInformation, LeaveCriticalSection, Wow64GetThreadContext, InitializeConditionVariable, SetFilePointer, GetNumaAvailableMemoryNode, GetNumaProcessorNode, OpenFileById, GetEnvironmentVariableW, WriteFileEx, GetSystemPowerStatus, FindFirstFileTransactedW, EnumResourceNamesW, UnlockFileEx, PeekNamedPipe, FatalExit, GetTempPathW, GetWriteWatch, CreateMutexW, OpenFile, TrySubmitThreadpoolCallback, GetPrivateProfileSectionW, WaitForThreadpoolTimerCallbacks, ResetWriteWatch, FindClose, GetLocaleInfoW, GetVolumePathNameW, GetCommMask, LocalAlloc, CreateFileW, GetFileAttributesW, FreeLibraryAndExitThread, GetCurrentThreadId, UnregisterBadMemoryNotification, SetComputerNameExW, OpenEventW, GetVersionExW, EnumSystemCodePagesW, ReleaseMutex, OpenFileMappingW, CancelThreadpoolIo, SetThreadpoolThreadMinimum, SetupComm, GetSystemDirectoryW, FreeEnvironmentStringsW, HeapWalk, CallbackMayRunLong, QueryMemoryResourceNotification, ContinueDebugEvent, GlobalGetAtomNameW, DuplicateHandle, IsProcessInJob, GetSystemDefaultLangID, GetACP, PrepareTape, RtlCaptureStackBackTrace, FreeResource, LCIDToLocaleName, GetVersion, ApplicationRecoveryInProgress, CancelWaitableTimer, GetVolumeNameForVolumeMountPointW, ClosePrivateNamespace, SetFileAttributesW, IsValidCodePage, GetLogicalDriveStringsW, CloseThreadpoolCleanupGroup, CreateEventW, SetFileAttributesTransactedW, ConvertThreadToFiberEx, GetFileInformationByHandle, SetTapeParameters, LoadPackagedLibrary, QueryThreadProfiling, GetTempPathA, FormatMessageW, ReadThreadProfilingData, SetConsoleScreenBufferInfoEx, PowerCreateRequest, BuildCommDCBW, VerifyScripts, OpenWaitableTimerW, SetCalendarInfoW, GetMaximumProcessorCount, FlsSetValue, OpenMutexA, WaitForThreadpoolWaitCallbacks, EnumSystemLocalesEx, SetUserGeoID, EscapeCommFunction, SetThreadpoolThreadMaximum, GetLogicalProcessorInformationEx, GetFileAttributesExW, ReleaseSRWLockExclusive, GetConsoleProcessList, OutputDebugStringW, GetMaximumProcessorGroupCount, ConvertDefaultLocale, FindNextVolumeMountPointW, WaitCommEvent, ReadConsoleInputW, SetThreadpoolTimerEx, FlushViewOfFile, GlobalSize, GetThreadUILanguage, GetUserDefaultLCID, GetLogicalProcessorInformation, FileTimeToSystemTime, CloseThreadpoolTimer, GetSystemFileCacheSize, OfferVirtualMemory, GetCurrentThread, InterlockedFlushSList, AcquireSRWLockExclusive, TerminateThread, GetActiveProcessorGroupCount, FindCloseChangeNotification, lstrcatW, GetTapeParameters, SetWaitableTimerEx, CreateThreadpoolWait, GetFullPathNameTransactedW, QueryPerformanceFrequency, EnumResourceNamesExW, GetCommState, GlobalAlloc, InterlockedPushListSListEx, TransmitCommChar, GetSystemDEPPolicy, GlobalFree, HeapReAlloc, CloseHandle, SetProcessPreferredUILanguages, ReleaseMutexWhenCallbackReturns, CompareStringEx, EnumResourceLanguagesW, GetFileSizeEx, RaiseException, FreeConsole, GetSystemInfo, GetProcessHeaps, BindIoCompletionCallback, SetProcessWorkingSetSizeEx, ReadFileEx, LoadLibraryW, IsDBCSLeadByte, ScrollConsoleScreenBufferW, LoadResource, DeleteProcThreadAttributeList, FindResourceW, HeapAlloc, Wow64SuspendThread, GetCurrencyFormatW, FatalAppExitW, GetLocalTime, GetDefaultCommConfigW, GetNLSVersionEx, GetCurrentDirectoryW, GetProcessPreferredUILanguages, SetStdHandle, UpdateResourceW, GetCurrentConsoleFontEx, CloseThreadpoolIo, SetCommMask, HeapCompact, FindNextChangeNotification, SetVolumeMountPointW, GetNamedPipeServerProcessId, SetFirmwareEnvironmentVariableW, GetNamedPipeClientSessionId, QueryIdleProcessorCycleTimeEx, GetCurrentProcessorNumber, UnlockFile, CreateFileMappingFromApp, DeleteFileTransactedW, FlushConsoleInputBuffer, SetLocaleInfoW, SetThreadGroupAffinity, GetWindowsDirectoryW, WriteConsoleW, GetErrorMode, SetThreadPriorityBoost, GetPriorityClass, GetProcAddress, GlobalLock, UnregisterApplicationRestart, SetFilePointerEx, CreateMutexExW, DebugActiveProcess, FindFirstFileNameTransactedW, HeapQueryInformation, GetTimeFormatW, MoveFileExW, GetThreadId, GetOverlappedResultEx, GetFileSize, SetDefaultCommConfigW, CreateMemoryResourceNotification, DeleteCriticalSection, ExitProcess, LCMapStringW, GetComputerNameW, FindVolumeClose, SetConsoleCP, FindFirstStreamW, CopyFile2, GetProcessHeap, SystemTimeToFileTime, GetNumberOfConsoleInputEvents, IsValidLocale, FreeLibrary, CreateSemaphoreW, IsValidLanguageGroup, TransactNamedPipe, CopyFileW, SetThreadpoolStackInformation, GetVolumePathNamesForVolumeNameW, lstrcpyW, GetLongPathNameTransactedW, WinExec, CreateRemoteThread, SleepConditionVariableSRW, RemoveVectoredContinueHandler, VerifyVersionInfoW, WritePrivateProfileSectionW, BeginUpdateResourceW, SystemTimeToTzSpecificLocalTime, FreeUserPhysicalPages, QueryFullProcessImageNameW, ReadConsoleOutputCharacterW, CommConfigDialogW, LocalReAlloc, GetTempFileNameW, SetConsoleOutputCP, ConvertFiberToThread, AddAtomW, EnumSystemGeoID, LocalFlags, GetDiskFreeSpaceExA, SetFileApisToANSI, GetSystemTime, GetThreadGroupAffinity, GetFirmwareType, DeleteVolumeMountPointW, SetThreadErrorMode, VirtualFreeEx, CopyFileExW, SetProcessWorkingSetSize, GetTempFileNameA, BackupRead, InterlockedPushEntrySList, SetConsoleCursorPosition, DosDateTimeToFileTime, MapViewOfFile, GetNumaNodeProcessorMaskEx, FindNextVolumeW, SetFileValidData, IsValidLocaleName, lstrcmpiW, BackupSeek, QueryPerformanceCounter, GetProcessGroupAffinity, CreateMailslotW, GetStringTypeW, GetDateFormatW, FreeLibraryWhenCallbackReturns, OpenMutexW, SetCommTimeouts, GetEnvironmentStringsW, WaitNamedPipeW, GlobalUnlock, FlsFree, SetCommState, SetDllDirectoryW, SetCommConfig, GetCalendarInfoEx, AllocConsole, ConvertThreadToFiber, WriteConsoleOutputW, GetStringTypeA, GetProcessHandleCount, MulDiv, InitializeSynchronizationBarrier, MapViewOfFileEx, GetFirmwareEnvironmentVariableW, VirtualQuery, RegisterApplicationRestart, IsWow64Process, CheckNameLegalDOS8Dot3W, GetProcessTimes, GetDriveTypeW, GetFileTime, InterlockedPopEntrySList, GlobalReAlloc, AddIntegrityLabelToBoundaryDescriptor, GetConsoleSelectionInfo, IsDebuggerPresent, ConnectNamedPipe, QueryDepthSList, SetFileCompletionNotificationModes, WriteConsoleOutputCharacterW, CreateDirectoryExW, SetUnhandledExceptionFilter, IsBadStringPtrW, FlushFileBuffers, GetCurrentConsoleFont, FileTimeToDosDateTime, RegisterApplicationRecoveryCallback, CreateThreadpoolWork, SetEndOfFile, HeapSize, SetEnvironmentVariableW, GetCommandLineA, GetOEMCP, FindFirstFileExW, ReadConsoleW, GetTimeZoneInformation, EnumSystemLocalesW, CompareStringW, FlsGetValue, FlsAlloc, GetConsoleMode, GetFileType, GetStdHandle, ExitThread, CreateThread, LoadLibraryExW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, SetLastError, GetLastError, RtlPcToFileHeader, RtlUnwindEx, TerminateProcess, InitializeSListHead, GetCurrentProcessId, IsProcessorFeaturePresent, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, GetCPInfo, LCMapStringEx, DecodePointer, EncodePointer, EnterCriticalSection, GetModuleHandleW, GetSystemTimeAsFileTime, InitializeCriticalSectionEx, GetExitCodeThread, WaitForSingleObjectEx, Sleep, TryAcquireSRWLockExclusive, WideCharToMultiByte, GlobalHandle, CompareFileTime, SetThreadLocale, NotifyUILanguageChange, StartThreadpoolIo, EnumResourceTypesExW, SetNamedPipeHandleState, CloseThreadpoolWork, QueryInformationJobObject, QueryThreadpoolStackInformation, LocalLock, WriteProfileStringW, CancelIo, GetThreadPriorityBoost, GetLogicalDrives, EnumTimeFormatsW, RemoveVectoredExceptionHandler, SetConsoleCtrlHandler, SetConsoleHistoryInfo, SetFileIoOverlappedRange, TryEnterCriticalSection, QueryDosDeviceW, BackupWrite, PowerSetRequest, FindStringOrdinal, SizeofResource, EnumLanguageGroupLocalesW, ReadFile, GetCPInfoExW, GetStartupInfoW, SleepConditionVariableCS, SetProcessPriorityBoost, GetNumaHighestNodeNumber, FindNLSStringEx, AreFileApisANSI, MultiByteToWideChar, RtlUnwind
USER32.dllValidateRect, GetMessageW, CharPrevExA, TabbedTextOutW, DefWindowProcW, GetSystemMenu, CharUpperW, LogicalToPhysicalPoint, MapVirtualKeyW, FindWindowExW, GetLastInputInfo, MessageBoxW, SetWindowLongPtrW, DefRawInputProc, CreateWindowExW, ShowOwnedPopups, ToAsciiEx, SendMessageW, DdeReconnect, UnregisterSuspendResumeNotification, SetWindowTextW, GetWindowLongPtrW, GetScrollPos, GetWindowPlacement, ShowWindow, AnyPopup, ChangeDisplaySettingsW, GetCapture, DispatchMessageW, DdeSetUserHandle, EndPaint, GetRawInputData, RegisterClassW, GetKeyboardLayout, SetProcessRestrictionExemption, IsProcessDPIAware, DrawFocusRect, MessageBoxIndirectW, EnumWindows, TranslateMessage, SetWindowContextHelpId, CharToOemW, mouse_event, EndDeferWindowPos, GetDlgItemInt, GetClientRect, IsZoomed, IsClipboardFormatAvailable, DrawTextW, DdeNameService, PostQuitMessage, DrawEdge, UserHandleGrantAccess, IsWindowUnicode, SetSystemCursor, RegisterWindowMessageW, DialogBoxParamW, LoadCursorFromFileW, LoadImageW, InvalidateRect, GetGUIThreadInfo, BeginPaint
GDI32.dllBitBlt, SelectObject, CreateCompatibleDC, SetPixel, GetColorAdjustment, CreateBrushIndirect, GetEnhMetaFileW, GetStockObject, OffsetClipRgn, GetDeviceCaps, DeleteDC, TextOutW, LineTo, CreatePen, GetObjectW, Polygon, MoveToEx, Ellipse, LPtoDP, DeleteObject, CreateSolidBrush, GetBrushOrgEx, PtVisible, CreateMetaFileW
ADVAPI32.dllRegCloseKey, CryptAcquireContextW, RegQueryValueExA, CryptGenRandom, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExA, RegOpenKeyExW, CryptReleaseContext
SHELL32.dllSHGetPathFromIDListW, SHBrowseForFolderW
ole32.dllCoTaskMemFree
NameOrdinalAddress
DTLS_get_data_mtu10x18000aa30
DTLSv1_client_method20x18000ac20
DTLSv1_listen30x18000abc0
DTLSv1_method40x18000ab60
eglBindAPI50x18000bf70
eglBindTexImage60x18000bf70
eglChooseConfig70x18000bf70
eglClientWaitSync80x18000bf70
eglClientWaitSyncKHR90x18000bf70
eglCopyBuffers100x18000bf70
eglCreateContext110x18000bf70
eglCreateDeviceANGLE120x18000bf70
eglCreateImage130x18000bf70
eglCreateImageKHR140x18000bf70
eglCreatePbufferFromClientBuffer150x18000bf70
eglCreatePbufferSurface160x18000bf70
eglCreatePixmapSurface170x18000bf70
eglCreatePlatformPixmapSurface180x18000bf70
eglCreatePlatformPixmapSurfaceEXT190x18000bf70
eglCreatePlatformWindowSurface200x18000bf70
eglCreatePlatformWindowSurfaceEXT210x18000bf70
eglCreateStreamKHR220x18000bf70
eglCreateStreamProducerD3DTextureANGLE230x18000bf70
eglCreateSync240x18000bf70
eglCreateSyncKHR250x18000bf70
eglCreateWindowSurface260x18000bf70
eglDebugMessageControlKHR270x18000bf70
eglDestroyContext280x18000bf70
eglDestroyImage290x18000bf70
eglDestroyImageKHR300x18000bf70
eglDestroyStreamKHR310x18000bf70
eglDestroySurface320x18000bf70
eglDestroySync330x18000bf70
eglDestroySyncKHR340x18000bf70
eglDupNativeFenceFDANDROID350x18000bf70
eglGetConfigAttrib360x18000bf70
eglGetConfigs370x18000bf70
eglGetCurrentContext380x18000bf70
eglGetCurrentDisplay390x18000bf70
eglGetCurrentSurface400x18000bf70
eglGetDisplay410x18000bf70
eglGetError420x18000bf70
eglGetMscRateANGLE430x18000bf70
eglGetNativeClientBufferANDROID440x18000bf70
eglGetPlatformDisplay450x18000bf70
eglGetPlatformDisplayEXT460x18000bf70
eglGetProcAddress470x18000bf70
eglGetSyncAttrib480x18000bf70
eglGetSyncAttribKHR490x18000bf70
eglGetSyncValuesCHROMIUM500x18000bf70
eglInitialize510x18000bf70
eglLabelObjectKHR520x18000bf70
eglMakeCurrent530x18000bf70
eglPostSubBufferNV540x18000bf70
eglPresentationTimeANDROID550x18000bf70
eglProgramCacheGetAttribANGLE560x18000bf70
eglProgramCachePopulateANGLE570x18000bf70
eglProgramCacheQueryANGLE580x18000bf70
eglProgramCacheResizeANGLE590x18000bf70
eglQueryAPI600x18000bf70
eglQueryContext610x18000bf70
eglQueryDebugKHR620x18000bf70
eglQueryDeviceAttribEXT630x18000bf70
eglQueryDeviceStringEXT640x18000bf70
eglQueryDisplayAttribANGLE650x18000bf70
eglQueryDisplayAttribEXT660x18000bf70
eglQueryStreamKHR670x18000bf70
eglQueryStreamu64KHR680x18000bf70
eglQueryString690x18000bf70
eglQueryStringiANGLE700x18000bf70
eglQuerySurface710x18000bf70
eglQuerySurfacePointerANGLE720x18000bf70
eglReleaseDeviceANGLE730x18000bf70
eglReleaseTexImage740x18000bf70
eglReleaseThread750x18000bf70
eglSetBlobCacheFuncsANDROID760x18000bf70
eglSignalSyncKHR770x18000bf70
eglStreamAttribKHR780x18000bf70
eglStreamConsumerAcquireKHR790x18000bf70
eglStreamConsumerGLTextureExternalAttribsNV800x18000bf70
eglStreamConsumerGLTextureExternalKHR810x18000bf70
eglStreamConsumerReleaseKHR820x18000bf70
eglStreamPostD3DTextureANGLE830x18000bf70
eglSurfaceAttrib840x18000bf70
eglSwapBuffers850x18000bf70
eglSwapBuffersWithDamageKHR860x18000bf70
eglSwapInterval870x18000bf70
eglTerminate880x18000bf70
eglWaitClient890x18000bf70
eglWaitGL900x18000bf70
eglWaitNative910x18000bf70
eglWaitSync920x18000bf70
eglWaitSyncKHR930x18000bf70
pkcs11h_certificate_create940x18000bf70
pkcs11h_certificate_deserializeCertificateId950x18000bf70
pkcs11h_certificate_enumCertificateIds960x18000bf70
pkcs11h_certificate_freeCertificate970x18000bf70
pkcs11h_certificate_freeCertificateId980x18000bf70
pkcs11h_certificate_freeCertificateIdList990x18000bf70
pkcs11h_certificate_getCertificateBlob1000x18000bf70
pkcs11h_certificate_serializeCertificateId1010x18000bf70
pkcs11h_certificate_signAny_ex1020x18000bf70
pkcs11h_engine_setSystem1030x18000bf70
pkcs11h_getMessage1040x18000bf70
pkcs11h_initialize1050x18000bf70
pkcs11h_initializeProvider1060x18000bf70
pkcs11h_logout1070x18000bf70
pkcs11h_openssl_getX5091080x18000bf70
pkcs11h_registerProvider1090x18000bf70
pkcs11h_removeProvider1100x18000bf70
pkcs11h_setForkMode1110x18000bf70
pkcs11h_setLogHook1120x18000bf70
pkcs11h_setLogLevel1130x18000bf70
pkcs11h_setPINCachePeriod1140x18000bf70
pkcs11h_setPINPromptHook1150x18000bf70
pkcs11h_setProtectedAuthentication1160x18000bf70
pkcs11h_setProviderProperty1170x18000bf70
pkcs11h_setTokenPromptHook1180x18000bf70
pkcs11h_terminate1190x18000bf70
No network behavior found
All data are 0.

Target ID:0
Start time:15:33:57
Start date:25/11/2024
Path:C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):false
Commandline:loaddll64.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll"
Imagebase:0x7ff745cb0000
File size:165'888 bytes
MD5 hash:763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Target ID:1
Start time:15:33:57
Start date:25/11/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Target ID:2
Start time:15:33:57
Start date:25/11/2024
Path:C:\Windows\System32\cmd.exe
Wow64 process (32bit):false
Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1
Imagebase:0x7ff7ff0a0000
File size:289'792 bytes
MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Target ID:3
Start time:15:33:57
Start date:25/11/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLS_get_data_mtu
Imagebase:0x7ff6e4740000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Target ID:4
Start time:15:33:57
Start date:25/11/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe "C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll",#1
Imagebase:0x7ff6e4740000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Target ID:6
Start time:15:34:00
Start date:25/11/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_client_method
Imagebase:0x7ff6e4740000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

Target ID:7
Start time:15:34:03
Start date:25/11/2024
Path:C:\Windows\System32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe C:\Users\user\Desktop\libpkcs11-helper-1.dll.dll,DTLSv1_listen
Imagebase:0x7ff6e4740000
File size:71'680 bytes
MD5 hash:EF3179D498793BF4234F708D3BE28633
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

No disassembly