metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2022-06-14 17:45:33.251470 2022-06-14 17:47:48.380713 135 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo2 win7 Clone 2 VirtualBox 2022-06-14 17:45:34 2022-06-14 17:47:47

File Details

File name e00e84a02c1bd5fd43ef5b9a2ff2d740d2a9aeb2.dll
File size 4444624 bytes
File type PE32 executable (console) Intel 80386, for MS Windows
CRC32 426FAF51
MD5 01d6f24b63f1fb033c58693396122439
SHA1 e00e84a02c1bd5fd43ef5b9a2ff2d740d2a9aeb2
SHA256 ad46600afd3b7e1b1267b5536b02f1e28441e99ead324c036cd664a208d5a6ec
SHA512 f58a7a0e2bb572ff6f946c3764a7c5bf801e9b9a87340c1e94b877388ab9c21aebdb18945f2f3efd8bc6380010868fc2faa7f8f76f0f3bc48910ab40bfd5d54a
Ssdeep None
PEiD None matched
Yara
  • DebuggerCheck__QueryInfo ()
  • SEH__vectored ()
  • SEH_Save ()
  • SEH_Init ()
  • Check_OutputDebugStringA_iat ()
  • anti_dbg (Checks if being debugged)
  • antisb_threatExpert (Anti-Sandbox checks for ThreatExpert)
  • disable_dep (Bypass DEP)
  • contains_base64 (This rule finds for base64 strings)
  • inject_thread (Code injection with CreateRemoteThread in a remote process)
  • network_tcp_listen (Listen for incoming communication)
  • network_tcp_socket (Communications over RAW socket)
  • escalate_priv (Escalade priviledges)
  • win_mutex (Create or check mutex)
  • win_registry (Affect system registries)
  • win_token (Affect system token)
  • win_files_operation (Affect private profile)
  • Str_Win32_Winsock2_Library (Match Winsock 2 API library declaration)
  • Big_Numbers1 (Looks for big numbers 32:sized)
  • Advapi_Hash_API (Looks for advapi API functions)
  • MD5_Constants (Look for MD5 constants)
  • SHA512_Constants (Look for SHA384/SHA512 constants)
  • BASE64_table (Look for Base64 table)
  • maldoc_find_kernel32_base_method_1 ()
  • IsPE32 ()
  • IsConsole ()
  • HasOverlay (Overlay Check)
  • HasDebugData (DebugData Check)
  • HasRichSignature (Rich Signature Check)
  • VC8_Microsoft_Corporation ()
  • Microsoft_Visual_Cpp_8 ()
  • Dropper_Strings (May have dropper capabilities)
  • Misc_Suspicious_Strings (Miscellaneous malware strings)
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1655243297]=0): Snort Events=0, AV Events=0
Total Score=50

Signatures

console_output details
has_pdb details
pe_features details
nolookup_communication details
packer_entropy details

Screenshots

No screenshots available.

Static Analysis

Version Infos

Sections

Resources

Imports

Strings

Dropped Files

Nothing to display.

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 484, Parent PID: 388

"C:\Users\Harry Dresden\AppData\Local\Temp\e00e84a02c1bd5fd43ef5b9a2ff2d740d2a9aeb2.dll" PID: 4432, Parent PID: 4260

Volatility

Nothing to display.