Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 12, 2021, 10:08 a.m.	April 12, 2021, 10:10 a.m.

Size	22.2KB
Type	Microsoft Word 2007+
MD5	`33aaf4c68958e89ce690265369e151d6`
SHA256	`9701dfa41e88b4d3ee40ddd48a09ae237251449bb5e9b062cbf6d5b720e71415`
CRC32	`E3804C63`
ssdeep	`384:tsMtxnA6iD7BtzwntQ1wM7Su98jbMADyj8v55n0bsc8/cIejkLe50DNg4M9iVI:Xxhin78KquIQDjin8B8deieYgR9i2`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries]

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\1.dotm
2648

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
106.52.236.88	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x65001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c761000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c764000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6caa1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06720000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$1.dotm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile April 12, 2021, 10:08 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003ec filepath: C:\Users\test22\AppData\Local\Temp\~$1.dotm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$1.dotm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Yara rule detected in process memory (9 events)

description	Affect private profile	rule	win_files_operation
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

106.52.236.88

Allocates execute permission to another process indicative of possible code injection (50 out of 1597 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1

Manipulates memory of a non-child process indicative of process injection (50 out of 1598 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2648 manipulating memory of non-child process 596
NtAllocateVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0
NtProtectVirtualMemory April 12, 2021, 10:08 a.m.	process_identifier: 596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 process_handle: 0x00000490	1	0	0

One or more non-whitelisted processes were created (1 event)

parent_process

winword.exe

martian_process

C:\Windows\\SysWOW64\\rundll32.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2648 resumed a thread in remote process 596
NtResumeThread April 12, 2021, 10:08 a.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 596	1	0	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

MicroWorld-eScan	VB:Trojan.Valyria.163
FireEye	VB:Trojan.Valyria.163
CAT-QuickHeal	O97M.Donoff.B
McAfee	X97M/Downloader.j
Sangfor	Trojan.Macro.Inject.se
Cyren	PP97M/Shellcode.B.gen!Eldorado
Symantec	ISB.Downloader!gen136
ESET-NOD32	VBA/Kryptik.C
Baidu	VBA.Trojan.Kryptik.d
TrendMicro-HouseCall	W2KM_POWLOAD.SME
Avast	VBA:Dropper-AK [Trj]
ClamAV	Doc.Macro.Injection-6355574-0
Kaspersky	HEUR:Trojan.Script.Agent.gen
BitDefender	VB:Trojan.Valyria.163
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Rising	Macro.Agent.bn (CLASSIC)
Ad-Aware	VB:Trojan.Valyria.163
Emsisoft	VB:Trojan.Valyria.163 (B)
DrWeb	W97M.DownLoader.2358
TrendMicro	W2KM_POWLOAD.SME
McAfee-GW-Edition	BehavesLike.Downloader.mc
Sophos	ATK/VbShlCde-A
SentinelOne	Static AI - Malicious OPENXML
Avira	HEUR/Macro.Downloader
MAX	malware (ai score=83)
Microsoft	TrojanDownloader:O97M/Bartallex.AA
Arcabit	VB:Trojan.Valyria.163
GData	VB:Trojan.Valyria.163
Cynet	Malicious (score: 70)
AhnLab-V3	VBA/Downloader.S12
Zoner	Probably Heur.W97ShellA
Tencent	OLE.Win32.Macro.704456
Ikarus	Trojan.VBA.Crypt
Fortinet	VBA/Kryptik.A!tr
AVG	VBA:Dropper-AK [Trj]
Qihoo-360	heur.macro.download.1d

1.dotm

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All