Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

uFzZ48M67c.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	0.20035725231316096
Filename:	uFzZ48M67c.exe
Filesize:	80740352
MD5:	a441db009e52a518a60acf292302f8b9
SHA1:	7b074fd716dad974e147dee21566d37878c909f4
SHA256:	8c48688d795f1ff90fa87b1eafd94190518e4a850f5a9aa265350158c85cbc62
SHA512:	4b1814074434ee593d60de8f1218c4ae465c23973f60d76ee158fe1462c25096efb6fe8a93466e1d8f05f377626d481c89a9d2fff250df4d4307ce93ac306658
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCDQIvkMmTJ0QAJxGboPIf:7JZoQrbTFZY1iaCDNvkMbdJioPI
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection	Exploitation for Privilege Escalation
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	Security Software Discovery
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Access Token Manipulation
Contains functionality to launch a process as a different user	System Summary
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Encrypted Channel
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Obfuscated Files or Information Security Software Discovery
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information Archive Collected Data
Contains functionality for error logging	System Summary
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary	System Information Discovery
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to query windows version	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads ini files	System Summary	Security Software Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\lards

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\lards
Category:	dropped
Dump:	lards.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\uFzZ48M67c.exe
Type:	data
Entropy:	6.710547254223229
Encrypted:	false
Ssdeep:	6144:zq5uGpLYCvgDi56kgReiCvVUHJgDdc0GoxflC/U2aDYV72:efCpReLgJgDK0GoxNC82aDQ72
Size:	245760
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\uFzZ48M67c.exe

"C:\Users\user\Desktop\uFzZ48M67c.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6768
Target ID:	0
Parent PID:	2580
Name:	uFzZ48M67c.exe
Path:	C:\Users\user\Desktop\uFzZ48M67c.exe
Commandline:	"C:\Users\user\Desktop\uFzZ48M67c.exe"
Size:	80740352
MD5:	A441DB009E52A518A60ACF292302F8B9
Time:	08:08:07
Date:	08/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	741376
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Machine Learning detection for sample	AV Detection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\uFzZ48M67c.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6988
Target ID:	1
Parent PID:	6768
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\uFzZ48M67c.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	08:08:10
Date:	08/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xd40000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://flujoauditorias.cl

unknown

http://ip-api.com/line/?fields=hostings

unknown

http://mail.flujoauditorias.cl

unknown

https://account.dyn.com/

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2956839649.0000000003261000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2956839649.0000000003326000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://ip-api.com/line/?fields=hosting

208.95.112.1

Details

Name:	http://ip-api.com/line/?fields=hosting
IP:	208.95.112.1
TargetID:	1
From Memory:	false
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

http://ip-api.com

unknown

Details

Name:	http://ip-api.com
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2956839649.0000000003340000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2956839649.0000000003261000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2956839649.0000000003326000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

flujoauditorias.cl

15.235.118.15

Details

Name:	flujoauditorias.cl
IP:	15.235.118.15
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

ip-api.com

208.95.112.1

Details

Name:	ip-api.com
IP:	208.95.112.1
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Check if machine is in data center or colocation facility	Malware Analysis System Evasion	Security Software Discovery
HTTP GET or POST without a user agent	Networking
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

mail.flujoauditorias.cl

unknown

Details

Name:	mail.flujoauditorias.cl
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

208.95.112.1

ip-api.com

United States

15.235.118.15

flujoauditorias.cl

United States

Details

IP:	15.235.118.15
TargetID:	1
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	71
ASN name:	HP-INTERNET-ASUS
Private:	false
Domain:	flujoauditorias.cl

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

402000

system

page execute and read and write

16A0000

direct allocation

page read and write

573E000

stack

page read and write

42C7000

trusted library allocation

page read and write

3E81000

heap

page read and write

3B80000

heap

page read and write

4593000

direct allocation

page read and write

3E81000

heap

page read and write

59BC000

stack

page read and write

3DFB000

heap

page read and write

9A000

stack

page read and write

3E81000

heap

page read and write

6A34000

trusted library allocation

page read and write

1780000

trusted library allocation

page read and write

3EFF000

heap

page read and write

473D000

direct allocation

page read and write

32DA000

trusted library allocation

page read and write

A1D000

heap

page read and write

151E000

heap

page read and write

3EFD000

heap

page read and write

4593000

direct allocation

page read and write

4470000

direct allocation

page read and write

93E000

stack

page read and write

4289000

trusted library allocation

page read and write

1477000

trusted library allocation

page execute and read and write

3E59000

heap

page read and write

3ED0000

heap

page read and write

4593000

direct allocation

page read and write

3F74000

heap

page read and write

3EFF000

heap

page read and write

100000

heap

page read and write

3F75000

heap

page read and write

57A0000

heap

page read and write

336F000

trusted library allocation

page read and write

6BA0000

trusted library allocation

page execute and read and write

1620000

heap

page read and write

3EFE000

heap

page read and write

1466000

trusted library allocation

page execute and read and write

3EDA000

heap

page read and write

47AE000

direct allocation

page read and write

161E000

stack

page read and write

1670000

heap

page read and write

1537000

heap

page read and write

4470000

direct allocation

page read and write

319E000

stack

page read and write

DDA000

stack

page read and write

10F8000

stack

page read and write

17BD000

trusted library allocation

page read and write

691E000

stack

page read and write

1300000

heap

page read and write

400000

system

page execute and read and write

7F4C0000

trusted library allocation

page execute and read and write

4610000

direct allocation

page read and write

6B4E000

stack

page read and write

3EFF000

heap

page read and write

335D000

trusted library allocation

page read and write

4610000

direct allocation

page read and write

535D000

stack

page read and write

15A9000

heap

page read and write

1500000

heap

page read and write

1444000

trusted library allocation

page read and write

4610000

direct allocation

page read and write

1790000

trusted library allocation

page read and write

3E81000

heap

page read and write

3D58000

heap

page read and write

3EFC000

heap

page read and write

15DE000

stack

page read and write

47AE000

direct allocation

page read and write

3E81000

heap

page read and write

3340000

trusted library allocation

page read and write

146A000

trusted library allocation

page execute and read and write

492000

unkown

page read and write

47AE000

direct allocation

page read and write

3B81000

heap

page read and write

1472000

trusted library allocation

page read and write

3EE2000

heap

page read and write

4AB000

unkown

page readonly

1140000

heap

page read and write

9BE000

stack

page read and write

4470000

direct allocation

page read and write

47AE000

direct allocation

page read and write

4593000

direct allocation

page read and write

3261000

trusted library allocation

page read and write

3E81000

heap

page read and write

1706000

heap

page read and write

490000

unkown

page read and write

6420000

heap

page read and write

3E2E000

heap

page read and write

3C1E000

heap

page read and write

1770000

heap

page execute and read and write

473D000

direct allocation

page read and write

1460000

trusted library allocation

page read and write

6A50000

trusted library allocation

page read and write

645B000

heap

page read and write

6A40000

trusted library allocation

page read and write

3250000

heap

page read and write

3EF6000

heap

page read and write

56DC000

stack

page read and write

6DE0000

heap

page read and write

5CFF000

stack

page read and write

3E37000

heap

page read and write

47AE000

direct allocation

page read and write

4610000

direct allocation

page read and write

3320000

trusted library allocation

page read and write

473D000

direct allocation

page read and write

1450000

trusted library allocation

page read and write

4A8000

unkown

page read and write

3BFF000

heap

page read and write

58A0000

heap

page read and write

3E81000

heap

page read and write

4739000

direct allocation

page read and write

4739000

direct allocation

page read and write

4593000

direct allocation

page read and write

3E81000

heap

page read and write

3E81000

heap

page read and write

4AB000

unkown

page readonly

1700000

heap

page read and write

145D000

trusted library allocation

page execute and read and write

5ABE000

stack

page read and write

4261000

trusted library allocation

page read and write

6A1E000

stack

page read and write

4739000

direct allocation

page read and write

32E2000

trusted library allocation

page read and write

179E000

trusted library allocation

page read and write

3E81000

heap

page read and write

1796000

trusted library allocation

page read and write

7050000

heap

page read and write

3E81000

heap

page read and write

15DD000

heap

page read and write

8B4000

stack

page read and write

3EFF000

heap

page read and write

3D80000

heap

page read and write

32DC000

trusted library allocation

page read and write

5BBE000

stack

page read and write

179B000

trusted library allocation

page read and write

58B0000

heap

page execute and read and write

6A27000

trusted library allocation

page read and write

3E84000

heap

page read and write

3E81000

heap

page read and write

1305000

heap

page read and write

1470000

trusted library allocation

page read and write

9D0000

heap

page read and write

3D46000

heap

page read and write

334A000

trusted library allocation

page read and write

6A30000

trusted library allocation

page read and write

577E000

stack

page read and write

428D000

heap

page read and write

47AE000

direct allocation

page read and write

1690000

heap

page read and write

1440000

trusted library allocation

page read and write

17B1000

trusted library allocation

page read and write

642A000

heap

page read and write

3361000

trusted library allocation

page read and write

17F0000

heap

page read and write

3EE3000

heap

page read and write

3375000

trusted library allocation

page read and write

3EF2000

heap

page read and write

3DE7000

heap

page read and write

3E81000

heap

page read and write

6440000

heap

page read and write

11DF000

stack

page read and write

35DE000

stack

page read and write

3326000

trusted library allocation

page read and write

4470000

direct allocation

page read and write

3E81000

heap

page read and write

473D000

direct allocation

page read and write

15D7000

heap

page read and write

5E60000

trusted library allocation

page read and write

14E0000

heap

page read and write

473D000

direct allocation

page read and write

4610000

direct allocation

page read and write

17A2000

trusted library allocation

page read and write

491000

unkown

page write copy

4739000

direct allocation

page read and write

334C000

trusted library allocation

page read and write

14DE000

stack

page read and write

6AAE000

stack

page read and write

4739000

direct allocation

page read and write

3DF6000

heap

page read and write

4470000

direct allocation

page read and write

17E0000

trusted library allocation

page read and write

39EC000

heap

page read and write

105000

heap

page read and write

17D0000

trusted library allocation

page read and write

6E10000

trusted library allocation

page read and write

482000

unkown

page readonly

3DD9000

heap

page read and write

9EA000

heap

page read and write

8FE000

stack

page read and write

401000

unkown

page execute read

3350000

trusted library allocation

page read and write

67DE000

stack

page read and write

39DF000

stack

page read and write

3DF7000

heap

page read and write

68DE000

stack

page read and write

1674000

heap

page read and write

3EFE000

heap

page read and write

17B6000

trusted library allocation

page read and write

1443000

trusted library allocation

page execute and read and write

152A000

heap

page read and write

3338000

trusted library allocation

page read and write

3EFE000

heap

page read and write

3E81000

heap

page read and write

A1D000

heap

page read and write

1F0000

heap

page read and write

400000

unkown

page readonly

32EA000

trusted library allocation

page read and write

3E80000

heap

page execute and read and write

3D86000

heap

page read and write

490000

unkown

page write copy

144D000

trusted library allocation

page execute and read and write

9D5000

heap

page read and write

950000

heap

page read and write

1534000

heap

page read and write

17AE000

trusted library allocation

page read and write

3D76000

heap

page read and write

3ED1000

heap

page read and write

9EE000

heap

page read and write

482000

unkown

page readonly

400000

unkown

page readonly

3D70000

heap

page read and write

9E0000

heap

page read and write

16F0000

heap

page read and write

401000

unkown

page execute read

642C000

heap

page read and write

3E81000

heap

page read and write

3EFE000

heap

page read and write

1760000

trusted library allocation

page read and write

428B000

heap

page read and write

6A47000

trusted library allocation

page read and write

1508000

heap

page read and write

3DE7000

heap

page read and write

1462000

trusted library allocation

page read and write

5790000

heap

page read and write

5BFE000

stack

page read and write

1578000

heap

page read and write

6A60000

trusted library allocation

page execute and read and write

1750000

trusted library allocation

page execute and read and write

3295000

trusted library allocation

page read and write

3E81000

heap

page read and write

31A8000

trusted library allocation

page read and write

3EFE000

heap

page read and write

4610000

direct allocation

page read and write

17AA000

trusted library allocation

page read and write

3EFE000

heap

page read and write

4593000

direct allocation

page read and write

3EFE000

heap

page read and write

174C000

stack

page read and write

8AF000

stack

page read and write

1430000

trusted library allocation

page read and write

4358000

heap

page read and write

110000

heap

page read and write

5793000

heap

page read and write

3D6A000

heap

page read and write

6A20000

trusted library allocation

page read and write

147B000

trusted library allocation

page execute and read and write

4470000

direct allocation

page read and write

4739000

direct allocation

page read and write

473D000

direct allocation

page read and write

3C80000

heap

page read and write

1490000

trusted library allocation

page read and write

3D48000

heap

page read and write

6AB0000

trusted library allocation

page read and write

1260000

heap

page read and write

There are 254 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
uFzZ48M67c.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportuFzZ48M67c.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
uFzZ48M67c.exe