IOC Report
rMA7e8O8iY

loading gif

Files

File Path
Type
Category
Malicious
rMA7e8O8iY.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_326eb6a19cfdf346a5bd562595d48d974b8521d_7522e4b5_3279ce3c-6d9e-42cd-8c2d-460228f7ae03\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_33482b87b0d8e03f47394b2e9a0604dbf93164_7522e4b5_0ba2ff45-be23-4a4a-b704-a8553d49b4a2\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_33482b87b0d8e03f47394b2e9a0604dbf93164_7522e4b5_296a96e6-a1fd-4510-b036-067b4db15b33\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c018787967c562f75385d7bd4d3f68f02869ef4c_7522e4b5_ac1e9f39-e6d8-48d1-88ca-21009397ff1b\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER529D.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Oct 13 12:05:16 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER52BC.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Oct 13 12:05:16 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5398.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER53A8.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER53C8.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER53D7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D6B.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Oct 13 12:05:19 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DAA.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E09.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6961.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Oct 13 12:05:22 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A2D.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A6D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 8 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\loaddll32.exe
loaddll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\rMA7e8O8iY.dll,GzDHLPTXbfjnZdGY
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 600
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6348 -s 608
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\rMA7e8O8iY.dll,bnihrxnmrpio
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6160 -s 600
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\rMA7e8O8iY.dll,bnpghteyxrum
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 592
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",GzDHLPTXbfjnZdGY
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",bnihrxnmrpio
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",bnpghteyxrum
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",snozacqpuormqulw
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",rbfyvzbrlz
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\rMA7e8O8iY.dll",fnyxctjuscq
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
ProgramId
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
FileId
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
LowerCaseLongPath
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
LongPathHash
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Name
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
OriginalFileName
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Publisher
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Version
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
BinFileVersion
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
BinaryType
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
ProductName
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
ProductVersion
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
LinkDate
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
BinProductVersion
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
AppxPackageFullName
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
AppxPackageRelativeId
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Size
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Language
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
IsOsComponent
\REGISTRY\A\{0866624a-aba2-39c2-467e-616e58f08e5b}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 12 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
6C790000
unkown
page readonly
26FF000
stack
page read and write
269A000
heap
page read and write
2EE0000
heap
page read and write
F5F000
heap
page read and write
2690000
heap
page read and write
6C790000
unkown
page readonly
2ABE000
stack
page read and write
F6D000
heap
page read and write
6C791000
unkown
page execute read
6C7AC000
unkown
page readonly
263E000
stack
page read and write
2770000
heap
page read and write
343E000
stack
page read and write
2C70000
remote allocation
page read and write
4BF0000
heap
page read and write
350A000
heap
page read and write
6C791000
unkown
page execute read
124F000
stack
page read and write
2E0000
heap
page read and write
2880000
heap
page read and write
267F000
stack
page read and write
272B000
stack
page read and write
6C790000
unkown
page readonly
2B0000
heap
page read and write
2C3B000
stack
page read and write
33FE000
stack
page read and write
15B000
stack
page read and write
4CF5000
heap
page read and write
3F30000
remote allocation
page read and write
6C7A1000
unkown
page readonly
347F000
stack
page read and write
6C7AE000
unkown
page readonly
4CF0000
heap
page read and write
2E10000
heap
page read and write
6C7AC000
unkown
page readonly
2CAA000
heap
page read and write
6C7AE000
unkown
page readonly
26BE000
stack
page read and write
2D3E000
stack
page read and write
31A0000
heap
page read and write
6C7AC000
unkown
page readonly
2770000
heap
page read and write
2CA0000
heap
page read and write
2BC0000
heap
page read and write
2D0000
heap
page read and write
6C7A1000
unkown
page readonly
2D2A000
heap
page read and write
6C790000
unkown
page readonly
2C0000
heap
page read and write
6C7A9000
unkown
page read and write
2C0E000
stack
page read and write
2A20000
heap
page read and write
2D20000
heap
page read and write
2EEA000
heap
page read and write
2C4F000
stack
page read and write
6C7AC000
unkown
page readonly
260000
heap
page read and write
2B20000
heap
page read and write
3500000
heap
page read and write
2FAB000
stack
page read and write
4950000
heap
page read and write
6C791000
unkown
page execute read
30E0000
heap
page read and write
2B30000
heap
page read and write
6C7AC000
unkown
page readonly
26C0000
heap
page read and write
27E0000
heap
page read and write
2B90000
heap
page read and write
28BC000
stack
page read and write
2F70000
heap
page read and write
2CC0000
heap
page read and write
2B3A000
heap
page read and write
1AB000
stack
page read and write
2680000
heap
page read and write
4BDF000
stack
page read and write
2C40000
heap
page read and write
F50000
heap
page read and write
6C791000
unkown
page execute read
268F000
stack
page read and write
2AD0000
heap
page read and write
28BC000
stack
page read and write
2A50000
heap
page read and write
E1E000
stack
page read and write
DD0000
heap
page read and write
315E000
stack
page read and write
114F000
stack
page read and write
319F000
stack
page read and write
1EC000
stack
page read and write
6C7AE000
unkown
page readonly
200000
heap
page read and write
29F0000
heap
page read and write
6C790000
unkown
page readonly
4560000
remote allocation
page read and write
6C7AE000
unkown
page readonly
2B0E000
stack
page read and write
6C790000
unkown
page readonly
1D0000
heap
page read and write
4640000
heap
page read and write
6C7AE000
unkown
page readonly
6C791000
unkown
page execute read
6C790000
unkown
page readonly
6C791000
unkown
page execute read
6C7A1000
unkown
page readonly
276C000
stack
page read and write
303B000
stack
page read and write
2ACF000
stack
page read and write
30D0000
heap
page read and write
273B000
stack
page read and write
2CB0000
heap
page read and write
48A0000
heap
page read and write
4250000
heap
page read and write
250000
heap
page read and write
6C7AE000
unkown
page readonly
6C7A1000
unkown
page readonly
6C7AE000
unkown
page readonly
3490000
heap
page read and write
6C791000
unkown
page execute read
3250000
heap
page read and write
6C7A9000
unkown
page read and write
4B9E000
stack
page read and write
6C7A9000
unkown
page read and write
307C000
stack
page read and write
33BE000
stack
page read and write
6C7A1000
unkown
page readonly
264E000
stack
page read and write
6C7AE000
unkown
page readonly
3FD0000
heap
page read and write
288A000
heap
page read and write
2B3E000
stack
page read and write
263E000
stack
page read and write
C5C000
stack
page read and write
2C4A000
heap
page read and write
2BAF000
stack
page read and write
2790000
heap
page read and write
2A70000
heap
page read and write
47C0000
remote allocation
page read and write
2C3F000
stack
page read and write
277C000
stack
page read and write
23F0000
heap
page read and write
D5C000
stack
page read and write
4CC0000
heap
page read and write
6C7A9000
unkown
page read and write
27E0000
heap
page read and write
F4E000
stack
page read and write
3530000
heap
page read and write
4E0F000
stack
page read and write
3340000
heap
page read and write
3330000
heap
page read and write
46A0000
heap
page read and write
6C7A1000
unkown
page readonly
2A20000
heap
page read and write
32AA000
heap
page read and write
287B000
stack
page read and write
6C7A1000
unkown
page readonly
2B7F000
stack
page read and write
27D0000
heap
page read and write
239F000
stack
page read and write
6C791000
unkown
page execute read
2D40000
heap
page read and write
2B6E000
stack
page read and write
6C7A1000
unkown
page readonly
6C7AC000
unkown
page readonly
6C791000
unkown
page execute read
6C790000
unkown
page readonly
2C7C000
stack
page read and write
F68000
heap
page read and write
287B000
stack
page read and write
6C7AC000
unkown
page readonly
235E000
stack
page read and write
2E5F000
stack
page read and write
34F0000
heap
page read and write
6C7AE000
unkown
page readonly
2930000
heap
page read and write
2DFF000
stack
page read and write
2C60000
heap
page read and write
6C7A9000
unkown
page read and write
2C80000
remote allocation
page read and write
6C791000
unkown
page execute read
19C000
stack
page read and write
6C7A1000
unkown
page readonly
6C7AC000
unkown
page readonly
293A000
heap
page read and write
32A0000
heap
page read and write
45B0000
heap
page read and write
6C7AC000
unkown
page readonly
6C7A9000
unkown
page read and write
12B000
stack
page read and write
2B7F000
stack
page read and write
2BB0000
heap
page read and write
47E0000
heap
page read and write
6C7AC000
unkown
page readonly
6C790000
unkown
page readonly
4450000
heap
page read and write
2A55000
heap
page read and write
2A00000
heap
page read and write
6C7AE000
unkown
page readonly
6C7A9000
unkown
page read and write
2920000
heap
page read and write
2AE0000
heap
page read and write
2B2F000
stack
page read and write
2750000
heap
page read and write
4790000
heap
page read and write
237E000
stack
page read and write
4620000
heap
page read and write
6C7A1000
unkown
page readonly
4955000
heap
page read and write
4130000
heap
page read and write
2ED0000
heap
page read and write
23BF000
stack
page read and write
2920000
heap
page read and write
2E9E000
stack
page read and write
2A00000
heap
page read and write
6C7A9000
unkown
page read and write
6C7A9000
unkown
page read and write
27F0000
heap
page read and write
4C20000
remote allocation
page read and write
4E60000
heap
page read and write
6C790000
unkown
page readonly
4050000
heap
page read and write
E30000
heap
page read and write
2BFE000
stack
page read and write
16C000
stack
page read and write
2FEC000
stack
page read and write
267F000
stack
page read and write
2B3E000
stack
page read and write
2755000
heap
page read and write
6C7A9000
unkown
page read and write
F5B000
heap
page read and write
DC0000
heap
page read and write
2A8E000
stack
page read and write
There are 221 hidden memdumps, click here to show them.