f06e5072477c30286a1a11ca1ddc39053993dabed88c178a97abfde8d0b14a23 | ANY.RUN - Free Malware Sandbox Online
https://app.any.run/tasks/d090ef25-d67d-4db9-8d5b-c913e77f0029
12/6/2018, 03:26:07
9faaccf618d3afd96f36e1b7c627b760
d14d91100dfbfc54f43ace9fd638113830614a47
f06e5072477c30286a1a11ca1ddc39053993dabed88c178a97abfde8d0b14a23
6144:barYtWXmaoUnVlFqLlXhj2OC+CUEQkkPTJG9f4699WXpZgb46MRlwGtxyXE:YYxaoUoLlx7TCeRlY3QXpubLMUayU
rundll32.exe (PID: 3200)
readerdc_en_crd_install.exe (PID: 3512)
nsA7DF.tmp (PID: 2680)
cmd.exe (PID: 2400)
2018:01:30 04:57:38+01:00
30-Jan-2018 03:57:38
.text 0x00001000 0x00006077 0x00006200 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.40397
.rdata 0x00008000 0x00001248 0x00001400 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.04426
.rsrc 0x0002D000 0x00003EB0 0x00004000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.98994
drop and start start readerdc_en_crd_install.exe nsa7df.tmp no specs rundll32.exe cmd.exe no specs whoami.exe no specs
"C:\Users\admin\AppData\Local\Temp\readerdc_en_crd_install.exe"
C:\Users\admin\AppData\Local\Temp\readerdc_en_crd_install.exe
c:\users\admin\appdata\local\temp\nswa7ce.tmp\system.dll
c:\users\admin\appdata\local\temp\nswa7ce.tmp\nsexec.dll
c:\users\admin\appdata\local\temp\nswa7ce.tmp\nsa7df.tmp
"C:\Users\admin\AppData\Local\Temp\nswA7CE.tmp\nsA7DF.tmp" "rundll32.exe" C:\Users\admin\AppData\Local\Temp\helpdb.dat, main
nsA7DF.tmp
3200 rundll32.exe 37.252.9.68:443 DE malicious