Windows Analysis Report
vQu0zndLpi.dll

Source: Joe Sandbox View

ASN Name: FREERANGECLOUDCA FREERANGECLOUDCA

Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.248.99

Source: C:\Windows\System32\rundll32.exe

Code function: 10_2_0000016C5BFF3C80 recv,

10_2_0000016C5BFF3C80

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DF3AF0	4_2_00007FF8E7DF3AF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DB8880	4_2_00007FF8E7DB8880
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D8B890	4_2_00007FF8E7D8B890
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DCE890	4_2_00007FF8E7DCE890
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DCA820	4_2_00007FF8E7DCA820
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D737E0	4_2_00007FF8E7D737E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DD87C0	4_2_00007FF8E7DD87C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DBB7A0	4_2_00007FF8E7DBB7A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D89750	4_2_00007FF8E7D89750
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DD7700	4_2_00007FF8E7DD7700
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E0E6DC	4_2_00007FF8E7E0E6DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DC66C0	4_2_00007FF8E7DC66C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DB26D0	4_2_00007FF8E7DB26D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DC3600	4_2_00007FF8E7DC3600
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DFC5C8	4_2_00007FF8E7DFC5C8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D8F5B0	4_2_00007FF8E7D8F5B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DA3590	4_2_00007FF8E7DA3590
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DA0530	4_2_00007FF8E7DA0530
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DC64F0	4_2_00007FF8E7DC64F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DC43E0	4_2_00007FF8E7DC43E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D8A3C0	4_2_00007FF8E7D8A3C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DFC360	4_2_00007FF8E7DFC360
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DAA320	4_2_00007FF8E7DAA320
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D96310	4_2_00007FF8E7D96310
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E14248	4_2_00007FF8E7E14248
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D991D7	4_2_00007FF8E7D991D7
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DDC190	4_2_00007FF8E7DDC190
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DD8150	4_2_00007FF8E7DD8150
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DD30E0	4_2_00007FF8E7DD30E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DCB0B0	4_2_00007FF8E7DCB0B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DC3040	4_2_00007FF8E7DC3040
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E0D020	4_2_00007FF8E7E0D020
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DB8010	4_2_00007FF8E7DB8010
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DF2FF0	4_2_00007FF8E7DF2FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E07F78	4_2_00007FF8E7E07F78
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E0FF58	4_2_00007FF8E7E0FF58
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E0BE08	4_2_00007FF8E7E0BE08
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E11D90	4_2_00007FF8E7E11D90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D84D30	4_2_00007FF8E7D84D30
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E05C40	4_2_00007FF8E7E05C40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DB5C50	4_2_00007FF8E7DB5C50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DD8C00	4_2_00007FF8E7DD8C00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DF3BE4	4_2_00007FF8E7DF3BE4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DC3BE0	4_2_00007FF8E7DC3BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D96B40	4_2_00007FF8E7D96B40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E08A84	4_2_00007FF8E7E08A84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DBDA50	4_2_00007FF8E7DBDA50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7E0DA2C	4_2_00007FF8E7E0DA2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DCF9E0	4_2_00007FF8E7DCF9E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DBF9F0	4_2_00007FF8E7DBF9F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7DD59F0	4_2_00007FF8E7DD59F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00007FF8E7D88960	4_2_00007FF8E7D88960
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_0000016C5BFF826A	10_2_0000016C5BFF826A
Source: C:\Windows\System32\rundll32.exe	Code function: 13_2_000001D6AE6B826A	13_2_000001D6AE6B826A

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8E7DFDFA8 appears 176 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8E7D79980 appears 49 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8E7D758A0 appears 187 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8E7D7A750 appears 88 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7552 -s 468

Source: vQu0zndLpi.dll

Binary or memory string: OriginalFilenamewsc.dllB" vs vQu0zndLpi.dll

Source: classification engine

Classification label: mal60.evad.winDLL@21/5@0/1

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DCA4B0 CreateToolhelp32Snapshot,GetLastError,

4_2_00007FF8E7DCA4B0

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7D8B890 timeGetTime,CoCreateInstance,VariantInit,SafeArrayCreate,CoCreateInstance,_Mtx_unlock,VariantClear,

4_2_00007FF8E7D8B890

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7D8EA90 LoadResource,LockResource,SizeofResource,

4_2_00007FF8E7D8EA90

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7552
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\cd497a04-7ef6-4d04-9be3-1fe2953b23cb

Source: vQu0zndLpi.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart

Source: vQu0zndLpi.dll

ReversingLabs: Detection: 34%

Source: rundll32.exe

String found in binary or memory: /launch

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\vQu0zndLpi.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7552 -s 468
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,start
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,DllWinMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",xtart
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",start
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",DllWinMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",UnInstall
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,start	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,DllWinMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",xtart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",start	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",DllWinMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",UnInstall	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: vQu0zndLpi.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: vQu0zndLpi.dll

Static file information: File size 1138176 > 1048576

Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: vQu0zndLpi.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: vQu0zndLpi.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: vQu0zndLpi.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\bamboo\home\xml-data\build-dir\WSP-MASTER-SOURCES\bin\x64\Release\wsc.pdbd source: rundll32.exe, 00000004.00000002.1751363840.00007FF8E7E27000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3201068084.00007FF8E7E27000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.3201025176.00007FF8E7E27000.00000002.00000001.01000000.00000003.sdmp, vQu0zndLpi.dll
Source:	Binary string: D:\bamboo\home\xml-data\build-dir\WSP-MASTER-SOURCES\bin\x64\Release\wsc.pdb source: rundll32.exe, 00000004.00000002.1751363840.00007FF8E7E27000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3201068084.00007FF8E7E27000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.3201025176.00007FF8E7E27000.00000002.00000001.01000000.00000003.sdmp, vQu0zndLpi.dll

Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vQu0zndLpi.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DF3E90 LoadLibraryA,GetProcAddressForCaller,

4_2_00007FF8E7DF3E90

Source: vQu0zndLpi.dll

Static PE information: real checksum: 0x11082c should be: 0x11773c

Source: vQu0zndLpi.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DC8440 FreeLibrary,FreeLibrary,GetModuleHandleExW,FreeLibrary,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FF8E7DC8440

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

API coverage: 0.4 %

Source: C:\Windows\System32\loaddll64.exe TID: 7480	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7812	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7924	Thread sleep time: -300000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: rundll32.exe, 0000000A.00000002.3200548922.0000016C5BD7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: rundll32.exe, 0000000D.00000002.3200632330.000001D6AE488000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllttLzP
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DF0B94 GetLastError,IsDebuggerPresent,OutputDebugStringW,

4_2_00007FF8E7DF0B94

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DF0B94 GetLastError,IsDebuggerPresent,OutputDebugStringW,

4_2_00007FF8E7DF0B94

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DF3E90 LoadLibraryA,GetProcAddressForCaller,

4_2_00007FF8E7DF3E90

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7D71C00 GetProcessHeap,

4_2_00007FF8E7D71C00

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DF9A28 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00007FF8E7DF9A28

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\rundll32.exe

Network Connect: 45.66.248.99 443

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DC6C20 SetEntriesInAclW,LocalFree,LocalAlloc,LocalFree,GetLastError,LocalFree,InitializeSecurityDescriptor,GetLastError,SetSecurityDescriptorDacl,GetLastError,

4_2_00007FF8E7DC6C20

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DC63B0 AllocateAndInitializeSid,GetLastError,

4_2_00007FF8E7DC63B0

Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00007FF8E7E1A898
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FF8E7E106B8
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FF8E7E1A458
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00007FF8E7E1A388
Source: C:\Windows\System32\rundll32.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_00007FF8E7E1A038
Source: C:\Windows\System32\rundll32.exe	Code function: try_get_function,GetLocaleInfoW,	4_2_00007FF8E7E10C4C
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00007FF8E7E1AA74

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FF8E7DB8010 CreateFileW,GetLastError,GetFileTime,GetLastError,CloseHandle,FileTimeToSystemTime,GetLastError,GetSystemTime,CloseHandle,_invalid_parameter_noinfo_noreturn,

4_2_00007FF8E7DB8010

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vQu0zndLpi.dll	34%	ReversingLabs	Win64.Downloader.ZLoader

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.66.248.99	unknown	Russian Federation		53356	FREERANGECLOUDCA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572522
Start date and time:	2024-12-10 16:50:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vQu0zndLpi.dll renamed because original name is a hash value
Original Sample Name:	bef34611564f850070ab13288c6d52de24fbcfc2ede9323eb675d32a31413f18.dll.exe
Detection:	MAL
Classification:	mal60.evad.winDLL@21/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 236
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 13.107.246.40, 20.190.159.23, 172.202.163.200
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: vQu0zndLpi.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0012.t-0009.t-msedge.net	mtbkkesfthae.exe	Get hash	malicious	Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://www.cognitoforms.com/f/fWhXKikFUk-rIZ2zs1gjVw/1	Get hash	malicious	Unknown	Browse	13.107.246.40
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.40
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.40
	http://iglawfirm.com/services/antai-fr/	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://sales-agreement-carpal-relative.s3.amazonaws.com/payout/completed/SEKTJGJFFJlfkdjklm4GHKHKYKFLFL/onedrive.html	Get hash	malicious	Unknown	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREERANGECLOUDCA	jklarm5.elf	Get hash	malicious	Unknown	Browse	216.24.208.32
	Jaws.exe	Get hash	malicious	Stealc	Browse	45.66.248.237
	Setup-Pro.exe	Get hash	malicious	Stealc, Vidar	Browse	45.66.249.162
	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	forest.exe	Get hash	malicious	Unknown	Browse	45.66.249.249
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	23.129.35.4
	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.142.147.59
	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	193.142.147.59
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	193.142.147.59

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vQu_bf88271f391678879aeb028db498ef27a519745_bcdf938d_5b0df173-7573-42c5-a940-fac4fd2dc333\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8158221362514262
Encrypted:	false
SSDEEP:	192:P7KRiEzyouu0H2MtjV/vzuiF3Z24lO8g/:zKRiNouVH2MtjFzuiF3Y4lO8w
MD5:	0E40A60B0C7B88B6F1E79C7DD58EF26A
SHA1:	A22DDB43B5F04ACDEF50C9F270C9D85B2267D6A8
SHA-256:	E129A1DC837E912F9D6A56B25CC80228946B1C495E1895652BF2D7660BB42703
SHA-512:	E6C420B39BB76F1DD4C618A11BCD076F3FCC7294A0E33F7FD4968668CAC33A50F5D2E4A0D6E53F80612742E144572D6F1283FE3F9D9EC4B71E0A903AD23BCA90
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.3.1.9.4.6.9.4.1.5.3.1.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.3.1.9.4.7.0.3.3.7.1.8.1.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.0.d.f.1.7.3.-.7.5.7.3.-.4.2.c.5.-.a.9.4.0.-.f.a.c.4.f.d.2.d.c.3.3.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.6.0.7.b.f.e.-.e.b.f.3.-.4.1.e.f.-.a.e.5.a.-.b.e.3.f.d.8.5.b.1.2.9.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.v.Q.u.0.z.n.d.L.p.i...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.8.0.-.0.0.0.1.-.0.0.1.4.-.1.a.a.f.-.4.6.5.4.1.b.4.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB9E.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 10 15:51:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	566698
Entropy (8bit):	1.4533219106893092
Encrypted:	false
SSDEEP:	384:/FMBFVWjLpKInd1broP6SLzN9uasgRhf/w3NUnx+i/2s6zWxZ5WiVKQZ9vfQA6e4:tMB8x3+Sz7qmQU3o19hVVpc
MD5:	B47FD5F032437D97BE9DF61840D6101B
SHA1:	1CBD0853099D3DF9613B1414EBFA93A4F58BDC14
SHA-256:	ADE4D9D6A5FE3A1917D01AF199795EF8C5F7BE7EBFEB2E24183115DE5DEC5A44
SHA-512:	867AFB3E055F88388F19976EC5C3E0C828363BC9E130A37E5B427AC31195A82438C7348A2D0A3B21A502EA66E5535D31BC2ADC11E009F70048C7FFA10EE3485E
Malicious:	false
Preview:	MDMP..a..... .......mcXg........................................X-..........T.......8...........T...........X...R...........H...........4...............................................................................eJ..............Lw......................T...........lcXg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD16.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8530
Entropy (8bit):	3.697826936796312
Encrypted:	false
SSDEEP:	192:R6l7wVeJAjrndQ6YrDJ+5gmfp9jpD089bd/SfoKbfm:R6lXJqr66YHJogmfp93dKfoKq
MD5:	88DAF9F07305747426CDE1C30E753B97
SHA1:	DAFDC20422822B87524470F4D50D0683E71B9D50
SHA-256:	CA374A422E0E1A4D2E79E34712CCCA8A073603D21BC7F830CBE20CCBADE53B78
SHA-512:	41534E08C9E1647B296E9C54A3021E14DC8907354D85BB9237339814E30D89D99C9A10F2158F7B392547A5CEE913AE78E71F74A0318A52AA2A4E9C0E483D8989
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD46.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4759
Entropy (8bit):	4.487588012728869
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgJg771I9OJWpW8VY3CYm8M4JCY9CY1+AK6FwUpyyq85mYgAsxRptSTU:uIjfmI7947VmJ7VfK3SzSpoONd
MD5:	6D76A69D772009B883518AA1B6846F59
SHA1:	BF83C6F16726BB996F6F1E041935454145A88B1F
SHA-256:	A18A03BF5CF164C8BDA9FAD3CCE6F917FD92C73B43F8D8DEC8A892C8134FB346
SHA-512:	609A49270779778931D42D483E650FF8EAEAC18D78BFEA0FB9CCEB7077E857D326CF68B3EBF4DB338D15929826FE3DD815024973B8EA1DF5CE803B25139D6EF3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="625373" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394723751836357
Encrypted:	false
SSDEEP:	6144:0l4fiJoH0ncNXiUjt10qCG/gaocYGBoaUMMhA2NX4WABlBuNAfOBSqa:s4vFCMYQUMM6VFYSfU
MD5:	27835D65F1CE8B811731F05B1444E7D3
SHA1:	2D9FFA166FDC6BB8DF3F6F9D28FE1BD8DA0DF41D
SHA-256:	4D6EBA44F6E589F6968AFAE33E0825532F21F7C6241AB69A19595682093BCA69
SHA-512:	3F58051435571B9EB5483A6D4128DA8955860813AD928AAA570FFAE8820769B88392039440F358A4F946F4EA5B930D0E5B8061B2D6D20CAC3F3D0FCB32523544
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..T.K..............................................................................................................................................................................................................................................................................................................................................g.`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.476113305296515
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	vQu0zndLpi.dll
File size:	1'138'176 bytes
MD5:	6b0b96b6ec7950943213da4f98fab1c7
SHA1:	502b8b7c5888b476365345d029df4f1d80c381c2
SHA256:	bef34611564f850070ab13288c6d52de24fbcfc2ede9323eb675d32a31413f18
SHA512:	f80bbffc22aa041eb1ccbb39f390fd322ab2b701b30d83e6872b68bc85b8c645d076b7216c5da6eab159fc9074bfc2c8410db6a6ce2e1c658868086dc88c6951
SSDEEP:	24576:D+XUNkTrLLAhpLJdqhQZE8cpKPpo1MsAVHB+FYiY25r3wai:iXUNuAhpXqa+8cpKBgZAZBvig
TLSH:	7C356B1767F805A8E8B6D178897B5806F736B41587309AEF02D0226B1F77BE08E7E711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.........................5...............................................................a...J.......J.......J..............

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180083a90
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x66FA53D2 [Mon Sep 30 07:31:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	767132e147d9da374bf0eb60457b20e1

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
cmp edx, 01h
jne 00007F2C0CCB30C6h
dec eax
mov edx, ecx
dec eax
add edx, 001013B8h
call 00007F2C0CCB30FDh
dec sp
movd mm5, eax
mov eax, 00000001h
dec eax
add esp, 28h
ret
dec eax
sub esp, 28h
dec sp
movd eax, mm5
dec eax
add esp, 28h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F2C0CCB3093h
mov edx, 00001BD8h
dec eax
mov ecx, eax
call 00007F2C0CCB376Fh
call eax
xor eax, eax
dec eax
add esp, 28h
ret
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+08h], ecx
push ebp
push esi
push edi
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
dec eax
lea ebp, dword ptr [esp-27h]
dec eax
sub esp, 00000100h
inc ebp
xor esp, esp
dec eax
mov ebx, edx
mov dword ptr [esp+20h], 4C682648h
mov dword ptr [esp+24h], 436D2A5Fh
mov dword ptr [esp+28h], 4F4D674Fh
mov dword ptr [esp+2Ch], 75352979h
inc sp
mov dword ptr [esp+50h], esp
mov byte ptr [esp+30h], 00000000h
mov dword ptr [esp+38h], 0065006Bh
mov dword ptr [esp+3Ch], 006E0072h
mov dword ptr [esp+40h], 00000065h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xede80	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xedf0c	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x101000	0x196ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf8000	0x744c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xfcc00	0x4dc8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11b000	0x156c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd9330	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd9500	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xd93a0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb7000	0x5f8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb572c	0xb5800	fc6ea9a56a230231c4bb1fdc5ef08421	False	0.4668183970385675	data	6.386830917577598	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb7000	0x383b6	0x38400	ec611e4019790695ac7d6d148ac88116	False	0.3645833333333333	data	4.902790895501739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf0000	0x749c	0x5800	68b698e4c7307e6be67b30c865614f37	False	0.15185546875	data	4.497462253406015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf8000	0x744c	0x7600	27d6cbc5cf6ad3575f8a0f04a40429a3	False	0.4889433262711864	PEX Binary Archive	5.836748779718831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x100000	0xf4	0x200	3becaaa5faf69c9c92c0abf64cce14d9	False	0.3046875	data	2.4434385797190123	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x101000	0x196ec	0x19800	a2add8433692a7f4ef3e303d8b906d10	False	0.5730602787990197	data	7.1419435849845465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11b000	0x156c	0x1600	94db310f1ca40a2e184b4684ec88d3df	False	0.37659801136363635	data	5.401573591665021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1010e8	0x2d0	data	English	United States	0.46805555555555556
RT_ANICURSOR	0x1013b8	0x191b2	data			0.5751210689071707
RT_MANIFEST	0x11a56c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
RPCRT4.dll	UuidToStringW, UuidCreate, RpcStringFreeW
KERNEL32.dll	LoadLibraryExW, SizeofResource, LockResource, LoadResource, FindResourceExW, FindResourceW, EnterCriticalSection, ReleaseSemaphore, LeaveCriticalSection, InitializeCriticalSection, WaitForThreadpoolTimerCallbacks, GetCurrentThreadId, CloseThreadpoolWait, WaitForThreadpoolWaitCallbacks, CloseThreadpoolTimer, CloseHandle, SetThreadpoolTimer, SetThreadpoolWait, CreateSemaphoreW, MultiByteToWideChar, GetModuleHandleW, WideCharToMultiByte, LocalFree, DeleteCriticalSection, GetCurrentProcessId, CreateFileW, GetFileTime, FileTimeToSystemTime, GetSystemTime, CreateProcessW, DeleteProcThreadAttributeList, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, GetExitCodeProcess, CreateThreadpoolWait, CreateThreadpoolTimer, CreateEventW, ResetEvent, LocalAlloc, CreateThread, OpenProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, WriteConsoleW, FreeEnvironmentStringsW, GetEnvironmentStringsW, DecodePointer, RaiseException, InitializeCriticalSectionEx, WaitForSingleObject, SetEvent, GetLastError, VerSetConditionMask, VerifyVersionInfoW, GetModuleHandleExW, Sleep, GetProcAddress, LoadLibraryW, GetModuleFileNameW, FreeLibrary, GetProcessHeap, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, HeapDestroy, FormatMessageA, SetStdHandle, ExitProcess, GetCommandLineW, RtlUnwind, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, ReadConsoleW, GetConsoleMode, GetConsoleOutputCP, WriteFile, GetFileType, GetStdHandle, ReadFile, SetConsoleCtrlHandler, FreeLibraryAndExitThread, ExitThread, FlushFileBuffers, GetFileSizeEx, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, TlsFree, LCMapStringW, IsDebuggerPresent, OutputDebugStringW, GetStringTypeW, WaitForSingleObjectEx, GetExitCodeThread, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryEnterCriticalSection, FindClose, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, SetEndOfFile, SetFilePointerEx, GetFileInformationByHandleEx, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetCPInfo, InitializeCriticalSectionAndSpinCount, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, InterlockedFlushSList, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue
USER32.dll	AllowSetForegroundWindow
ADVAPI32.dll	RevertToSelf, ImpersonateLoggedOnUser, OpenProcessToken, QueryServiceStatusEx, OpenSCManagerW, OpenServiceW, GetSecurityInfo, GetSidIdentifierAuthority, GetAce, GetSidSubAuthority, GetSidSubAuthorityCount, EqualSid, ConvertSidToStringSidW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetEntriesInAclW, RegDeleteKeyW, FreeSid, CheckTokenMembership, AllocateAndInitializeSid, CloseServiceHandle, RegSetKeyValueW, RegOpenKeyExW, RegGetValueW, RegCloseKey
SHELL32.dll	CommandLineToArgvW, SHGetKnownFolderPath
ole32.dll	CoInitializeEx, CoUninitialize, CoSetProxyBlanket, CoTaskMemFree, CoCreateInstance
OLEAUT32.dll	SysAllocString, VariantClear, SafeArrayCreate, VariantInit, SysStringLen, SysAllocStringLen, SysFreeString
SHLWAPI.dll	PathRemoveFileSpecW, PathAppendW, PathIsRelativeW
WINMM.dll	timeGetTime
ntdll.dll	RtlLookupFunctionEntry, RtlVirtualUnwind, RtlCaptureContext

Exports

Name	Ordinal	Address
xtart	1	0x180020ad0
start	2	0x180020b00
DllWinMain	4	0x18005b0b0
UnInstall	3	0x18006cfe0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:51:12.912008047 CET	49718	443	192.168.2.9	45.66.248.99
Dec 10, 2024 16:51:12.912060022 CET	443	49718	45.66.248.99	192.168.2.9
Dec 10, 2024 16:51:12.912136078 CET	49718	443	192.168.2.9	45.66.248.99
Dec 10, 2024 16:51:12.915303946 CET	49718	443	192.168.2.9	45.66.248.99
Dec 10, 2024 16:51:12.915326118 CET	443	49718	45.66.248.99	192.168.2.9
Dec 10, 2024 16:51:12.915455103 CET	443	49718	45.66.248.99	192.168.2.9
Dec 10, 2024 16:51:19.638989925 CET	49736	443	192.168.2.9	45.66.248.99
Dec 10, 2024 16:51:19.639044046 CET	443	49736	45.66.248.99	192.168.2.9
Dec 10, 2024 16:51:19.639130116 CET	49736	443	192.168.2.9	45.66.248.99
Dec 10, 2024 16:51:19.651829958 CET	49736	443	192.168.2.9	45.66.248.99
Dec 10, 2024 16:51:19.651842117 CET	443	49736	45.66.248.99	192.168.2.9
Dec 10, 2024 16:51:19.651887894 CET	443	49736	45.66.248.99	192.168.2.9

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 16:51:06.284918070 CET	1.1.1.1	192.168.2.9	0xaf32	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:51:06.284918070 CET	1.1.1.1	192.168.2.9	0xaf32	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:51:08
Start date:	10/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\vQu0zndLpi.dll"
Imagebase:	0x7ff6d5dd0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	10:51:08
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	10:51:08
Start date:	10/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Imagebase:	0x7ff669af0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	10:51:08
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,xtart
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:51:08
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",#1
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	10:51:09
Start date:	10/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7552 -s 468
Imagebase:	0x7ff6858d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	10:51:11
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,start
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	10:51:14
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vQu0zndLpi.dll,DllWinMain
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	10:51:17
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",xtart
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	10:51:18
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",start
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	10:51:18
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",DllWinMain
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	10:51:18
Start date:	10/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vQu0zndLpi.dll",UnInstall
Imagebase:	0x7ff70c010000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true