'
metaflows logo
Category Started On Completed On Duration Cuckoo Version
FILE 2018-08-17 15:13:19.096541 2018-08-17 15:13:48.544608 29 seconds 2.0-dev
Machine Label Manager Started On Shutdown On
win7cuckoo win7 Clone 1 VirtualBox 2018-08-17 15:13:19 2018-08-17 15:13:48

File Details

File name c6c46d37d6dba195ad03915e8f80831b355e4405.zip
File size 645006 bytes
File type Zip archive data, at least v2.0 to extract
CRC32 02E484FA
MD5 05cd1218d27046df045c75c238df5266
SHA1 c6c46d37d6dba195ad03915e8f80831b355e4405
SHA256 2b4f485428046c217ff1a88464b0009b643a2d728891fd270f0a3eac8a7a7b9d
SHA512 c3002a1ca940482c1ab2fc480436af8c8f690bca4033ffdd24fe7625d8b413222e33ac8d5e1f235653c6758964edfa71dd09aeadd75479a5d4e5ee20700e309a
Ssdeep None
PEiD None matched
Yara None matched
VirusTotal File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=75, Anomalies=0, PEiD=0, Yara=0, VT[1534533236]=0): Snort Events=0, AV Events=0
Total Score=75

Dropped File/Buffer Yara Signatures:
mednafen_snes_libretro.dll: spyeye

Signatures

nolookup_communication details

Screenshots

No screenshots available.

Static Analysis

Nothing to display.

Dropped Files

mednafen_snes_libretro.dll

Network Analysis

Hosts Involved

DNS Requests

HTTP Requests

Behavior Summary

File-Opened
  • C:\Windows\System32\en-US\KERNELBASE.dll.mui
Registry Key-Read
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Windows\System32\rundll32.exe" C : \ U s e r s \ H A R R Y D ~ 1 \ A p p D a t a \ L o c a l \ T e m p \ m e d n a f e n _ s n e s _ l i b r e t r o . d l l , D l l M a i n PID: 1064, Parent PID: 2328

Volatility

Nothing to display.