Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

OC & PL.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.778176200844999
Filename:	OC & PL.exe
Filesize:	1225216
MD5:	c6a534ee57dee61cb20b631d697a6a09
SHA1:	e9f122b4daf12299d0a55e6e51801b386063ed61
SHA256:	ad4cfc06bad357de4ab58c9c01bc2e7015fd1944e35a206ef8b053611119f04f
SHA512:	74fb83e33ddc07dba47045674747d40d56aeb1e511cc6d5217d86967c1c6e169fd46e0b49e0dd2ce97799b7bf01170f4567becd2b857300869403cb952726e1b
SSDEEP:	24576:+tb20pkaCqT5TBWgNQ7aujW8l3JCQz6A:rVg5tQ7aujd7p5
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Disable or Modify Tools
Binary is likely a compiled AutoIt script file	System Summary
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging	Disable or Modify Tools
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Native API Access Token Manipulation
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Process Discovery
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Disable or Modify Tools
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection Disable or Modify Tools
Detected potential crypto function	System Summary	System Time Discovery Process Discovery Archive Collected Data Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evaded block containing many API calls	Malware Analysis System Evasion	Disable or Modify Tools Process Discovery
Found evasive API chain (date check)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion	System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Disable or Modify Tools System Shutdown/Reboot
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Disable or Modify Tools
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
.NET source code contains calls to encryption/decryption functions	System Summary
Binary contains paths to development resources	System Summary
Contains functionality for error logging	System Summary	Disable or Modify Tools
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Disable or Modify Tools
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion	Disable or Modify Tools
Reads software policies	System Summary
Sample is known by Antivirus	System Summary	Disable or Modify Tools
Tries to load missing DLLs	System Summary	DLL Side-Loading Disable or Modify Tools
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary	Disable or Modify Tools

C:\Users\user\AppData\Local\Temp\aut1756.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut1756.tmp
Category:	dropped
Dump:	aut1756.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\OC & PL.exe
Type:	data
Entropy:	7.955384855077709
Encrypted:	false
Ssdeep:	3072:rAXTTB9Rps8EaaDrGalSaDuWX+M7Jw92sIMui02iruQ3SBOdlVvqo9LLTdlJjpf:rWvRps0aHGa4IjX9w9v7uXzNCE7Rqo9n
Size:	163718
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\immortaliser

data

modified

Details

File:	C:\Users\user\AppData\Local\Temp\immortaliser
Category:	modified
Dump:	immortaliser.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\OC & PL.exe
Type:	data
Entropy:	6.972874067264847
Encrypted:	false
Ssdeep:	6144:btKkuOp0JSazEuauTmMfrUbY0IeJeMsM64D6Xoyr9C:btGOi7AunT2INq646TQ
Size:	244224
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\OC & PL.exe

"C:\Users\user\Desktop\OC & PL.exe"

Details

Is windows:	false
Is dropped:	false
PID:	816
Target ID:	0
Parent PID:	4056
Name:	OC & PL.exe
Path:	C:\Users\user\Desktop\OC & PL.exe
Commandline:	"C:\Users\user\Desktop\OC & PL.exe"
Size:	1225216
MD5:	C6A534EE57DEE61CB20B631D697A6A09
Time:	03:08:41
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x700000
Modulesize:	1253376
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\OC & PL.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6400
Target ID:	5
Parent PID:	816
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\OC & PL.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	03:08:43
Date:	21/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x680000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://r10.o.lencr.org0#

unknown

Details

Name:	http://r10.o.lencr.org0#
TargetID:	5
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://mail.agaliofu.top

unknown

http://x1.c.lencr.org/0

unknown

Details

Name:	http://x1.c.lencr.org/0
TargetID:	5
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.i.

unknown

http://x1.i.lencr.org/0

unknown

Details

Name:	http://x1.i.lencr.org/0
TargetID:	5
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://agaliofu.top

unknown

http://r10.i.lencr.org/0

unknown

Details

Name:	http://r10.i.lencr.org/0
TargetID:	5
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

agaliofu.top

194.36.191.196

Details

Name:	agaliofu.top
IP:	194.36.191.196
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

mail.agaliofu.top

unknown

Details

Name:	mail.agaliofu.top
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

194.36.191.196

agaliofu.top

Netherlands

Details

IP:	194.36.191.196
TargetID:	5
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	60117
ASN name:	HSAE
Private:	false
Domain:	agaliofu.top

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Memdumps

Base Address

Regiontype

Protect

Malicious

670000

direct allocation

page read and write

2B01000

trusted library allocation

page read and write

2B83000

trusted library allocation

page read and write

2B57000

trusted library allocation

page read and write

402000

system

page execute and read and write

F9D000

heap

page read and write

E97000

trusted library allocation

page execute and read and write

1B0000

heap

page read and write

71A000

stack

page read and write

5210000

heap

page execute and read and write

7D0000

heap

page read and write

2B72000

trusted library allocation

page read and write

E86000

trusted library allocation

page execute and read and write

E82000

trusted library allocation

page read and write

E80000

trusted library allocation

page read and write

35D0000

direct allocation

page read and write

28C0000

trusted library allocation

page read and write

2910000

trusted library allocation

page read and write

57C0000

trusted library allocation

page read and write

BF0000

heap

page read and write

65F0000

heap

page read and write

36F9000

direct allocation

page read and write

56B2000

heap

page read and write

56BB000

heap

page read and write

5A0000

heap

page read and write

E60000

trusted library allocation

page read and write

576D000

trusted library allocation

page read and write

3430000

direct allocation

page read and write

36FD000

direct allocation

page read and write

E28000

heap

page read and write

57B0000

trusted library allocation

page read and write

E50000

trusted library allocation

page read and write

400000

system

page execute and read and write

5E6E000

stack

page read and write

5F6D000

unkown

page read and write

EB0000

trusted library allocation

page read and write

E7D000

trusted library allocation

page execute and read and write

154E000

stack

page read and write

36F9000

direct allocation

page read and write

5660000

heap

page read and write

36F9000

direct allocation

page read and write

2902000

trusted library allocation

page read and write

149000

stack

page read and write

C64000

heap

page read and write

CB8000

heap

page read and write

376E000

direct allocation

page read and write

704C6000

unkown

page readonly

ED5000

heap

page read and write

28FD000

trusted library allocation

page read and write

35D0000

direct allocation

page read and write

2B5B000

trusted library allocation

page read and write

F9D000

heap

page read and write

376E000

direct allocation

page read and write

3553000

direct allocation

page read and write

D8B000

heap

page read and write

29DE000

stack

page read and write

5780000

heap

page read and write

28EE000

trusted library allocation

page read and write

E27000

heap

page read and write

780000

heap

page read and write

10B0000

heap

page read and write

2920000

trusted library allocation

page read and write

507E000

stack

page read and write

5790000

trusted library allocation

page read and write

100E000

stack

page read and write

660000

heap

page read and write

36F9000

direct allocation

page read and write

704CF000

unkown

page readonly

50A0000

heap

page read and write

35D0000

direct allocation

page read and write

3B6A000

trusted library allocation

page read and write

E95000

trusted library allocation

page execute and read and write

1C0000

heap

page read and write

51AC000

stack

page read and write

F9D000

heap

page read and write

36FD000

direct allocation

page read and write

7D7000

unkown

page readonly

2AFE000

stack

page read and write

D99000

heap

page read and write

F9D000

heap

page read and write

704B0000

unkown

page readonly

7C7000

unkown

page readonly

51EE000

stack

page read and write

5684000

heap

page read and write

376E000

direct allocation

page read and write

F9D000

heap

page read and write

28F6000

trusted library allocation

page read and write

7D7000

unkown

page readonly

7AE000

unkown

page readonly

7AE000

unkown

page readonly

F9D000

heap

page read and write

6620000

trusted library allocation

page execute and read and write

DE4000

heap

page read and write

4BFE000

stack

page read and write

2B61000

trusted library allocation

page read and write

5D90000

trusted library allocation

page execute and read and write

CF0000

heap

page read and write

376E000

direct allocation

page read and write

E8A000

trusted library allocation

page execute and read and write

F9D000

heap

page read and write

28DB000

trusted library allocation

page read and write

2B7F000

trusted library allocation

page read and write

664000

heap

page read and write

28E2000

trusted library allocation

page read and write

D99000

heap

page read and write

F9D000

heap

page read and write

CE4000

heap

page read and write

5D80000

trusted library allocation

page read and write

F9D000

heap

page read and write

F9D000

heap

page read and write

701000

unkown

page execute read

3B29000

trusted library allocation

page read and write

299C000

stack

page read and write

F51000

heap

page read and write

7BA000

unkown

page write copy

531E000

stack

page read and write

5760000

trusted library allocation

page read and write

36FD000

direct allocation

page read and write

56A4000

heap

page read and write

541E000

stack

page read and write

F9D000

heap

page read and write

F9D000

heap

page read and write

BD0000

heap

page read and write

28F1000

trusted library allocation

page read and write

28D0000

trusted library allocation

page read and write

2950000

heap

page execute and read and write

700000

unkown

page readonly

3B01000

trusted library allocation

page read and write

E6D000

trusted library allocation

page execute and read and write

376E000

direct allocation

page read and write

4F40000

heap

page read and write

3553000

direct allocation

page read and write

54D000

stack

page read and write

E70000

trusted library allocation

page read and write

28DE000

trusted library allocation

page read and write

E63000

trusted library allocation

page execute and read and write

C25000

heap

page read and write

57B7000

trusted library allocation

page read and write

289C000

stack

page read and write

36F9000

direct allocation

page read and write

E92000

trusted library allocation

page read and write

C0E000

stack

page read and write

7C7000

unkown

page readonly

7F460000

trusted library allocation

page execute and read and write

7D5000

unkown

page readonly

D5E000

heap

page read and write

F52000

heap

page execute and read and write

700000

unkown

page readonly

1018000

trusted library allocation

page read and write

36FD000

direct allocation

page read and write

3430000

direct allocation

page read and write

3430000

direct allocation

page read and write

F9E000

heap

page read and write

64EE000

stack

page read and write

376E000

direct allocation

page read and write

CD2000

heap

page read and write

57A0000

trusted library allocation

page execute and read and write

C3C000

stack

page read and write

50E000

stack

page read and write

D5A000

heap

page read and write

D99000

heap

page read and write

5098000

trusted library allocation

page read and write

C7A000

heap

page read and write

D50000

heap

page read and write

7BF000

unkown

page write copy

C1A000

heap

page read and write

F51000

heap

page read and write

5090000

trusted library allocation

page read and write

28EA000

trusted library allocation

page read and write

CD0000

heap

page read and write

194E000

stack

page read and write

36F9000

direct allocation

page read and write

7C4000

unkown

page readonly

1D0000

heap

page read and write

F9D000

heap

page read and write

F57000

heap

page read and write

F50000

heap

page read and write

BF8000

heap

page read and write

36FD000

direct allocation

page read and write

78D000

unkown

page readonly

DB8000

heap

page read and write

606D000

stack

page read and write

5777000

trusted library allocation

page read and write

EC0000

heap

page read and write

3430000

direct allocation

page read and write

D7B000

heap

page read and write

6900000

heap

page read and write

29F0000

heap

page read and write

704B1000

unkown

page execute read

28A0000

trusted library allocation

page execute and read and write

65EE000

stack

page read and write

590000

heap

page read and write

35D0000

direct allocation

page read and write

AF9000

stack

page read and write

D99000

heap

page read and write

3553000

direct allocation

page read and write

F9E000

heap

page read and write

F9D000

heap

page read and write

50A3000

heap

page read and write

2B8B000

trusted library allocation

page read and write

7BA000

unkown

page read and write

C1B000

stack

page read and write

3553000

direct allocation

page read and write

35D0000

direct allocation

page read and write

3553000

direct allocation

page read and write

3430000

direct allocation

page read and write

704CD000

unkown

page read and write

CF5000

heap

page read and write

3553000

direct allocation

page read and write

3430000

direct allocation

page read and write

551E000

stack

page read and write

78D000

unkown

page readonly

F9D000

heap

page read and write

7D5000

unkown

page readonly

BFC000

stack

page read and write

36FD000

direct allocation

page read and write

35D0000

direct allocation

page read and write

28B0000

trusted library allocation

page read and write

C27000

heap

page read and write

43E000

system

page execute and read and write

E64000

trusted library allocation

page read and write

DA3000

heap

page read and write

D97000

heap

page read and write

5E2D000

stack

page read and write

E9B000

trusted library allocation

page execute and read and write

5770000

trusted library allocation

page read and write

56C6000

heap

page read and write

DC5000

heap

page read and write

701000

unkown

page execute read

7C4000

unkown

page readonly

There are 220 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
OC & PL.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportOC & PL.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
OC & PL.exe