Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 3, 2021, 4:45 p.m.	May 3, 2021, 4:59 p.m.

Size	2.4MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c7ac2a1e30b01678d51973aa253ff546`
SHA256	`abfd412e775e8a81efbd61484a67de9aed008c0e51910d9d8a9051c4ea9856b3`
CRC32	`B49DF57D`
ssdeep	`1536:xpQ32OQNwCyl4asV12Nr4DLd0HyjyH3yshsAuc0nsMso5SOv/k4HiM6iobVsrsZr:c33`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

kdotx.exe "C:\Users\test22\AppData\Local\Temp\kdotx.exe"
656
- cmd.exe "C:\Windows\System32\cmd.exe" /c timeout 1
  6928
  - timeout.exe timeout 1
    8956

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 3, 2021, 4:45 p.m.			0	0
IsDebuggerPresent May 3, 2021, 4:45 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW May 3, 2021, 4:45 p.m.	buffer: Waiting for 1 console_handle: 0x00000007	1	1	0
WriteConsoleW May 3, 2021, 4:45 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey May 3, 2021, 4:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00689bf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00689b38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2021, 4:45 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00689b38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 3, 2021, 4:45 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00782000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0079c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0078c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a suspicious process (2 events)

cmdline	cmd.exe /c timeout 1
cmdline	"C:\Windows\System32\cmd.exe" /c timeout 1

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 3, 2021, 4:45 p.m.	show_type: 0 filepath_r: cmd.exe parameters: /c timeout 1 filepath: cmd.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 3, 2021, 4:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (50 out of 10512 events)

Time & API	Arguments	Status
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 6012 process_handle: 0x00000260
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 6012 process_handle: 0x00000260	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 8948 process_handle: 0x0000038c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 8948 process_handle: 0x0000038c	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 2228 process_handle: 0x00000368
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 2228 process_handle: 0x00000368	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4384 process_handle: 0x000003bc
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4384 process_handle: 0x000003bc	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4792 process_handle: 0x000003c8
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4792 process_handle: 0x000003c8	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 6420 process_handle: 0x000003d0
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 6420 process_handle: 0x000003d0	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 2724 process_handle: 0x000003d8
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 2724 process_handle: 0x000003d8	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4884 process_handle: 0x000003e0
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4884 process_handle: 0x000003e0	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 3812 process_handle: 0x000003e8
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 3812 process_handle: 0x000003e8	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 5260 process_handle: 0x000003f0
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 5260 process_handle: 0x000003f0	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7552 process_handle: 0x000003f8
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7552 process_handle: 0x000003f8	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7316 process_handle: 0x00000404
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7316 process_handle: 0x00000404	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 1036 process_handle: 0x0000040c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 1036 process_handle: 0x0000040c	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 8636 process_handle: 0x00000414
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 8636 process_handle: 0x00000414	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7672 process_handle: 0x0000041c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7672 process_handle: 0x0000041c	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 8004 process_handle: 0x00000424
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 8004 process_handle: 0x00000424	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7908 process_handle: 0x0000042c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7908 process_handle: 0x0000042c	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7932 process_handle: 0x00000434
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7932 process_handle: 0x00000434	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 3932 process_handle: 0x0000043c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 3932 process_handle: 0x0000043c	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7304 process_handle: 0x00000444
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 7304 process_handle: 0x00000444	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4164 process_handle: 0x0000044c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4164 process_handle: 0x0000044c	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 1432 process_handle: 0x00000454
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 1432 process_handle: 0x00000454	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4804 process_handle: 0x0000045c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 4804 process_handle: 0x0000045c	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 3252 process_handle: 0x00000464
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 3252 process_handle: 0x00000464	1
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 9016 process_handle: 0x0000046c
NtTerminateProcess May 3, 2021, 4:45 p.m.	status_code: 0xffffffff process_identifier: 9016 process_handle: 0x0000046c	1

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (50 out of 5256 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6012 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c0	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8948 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000033c	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2228 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000348	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4384 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000344	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4792 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000034c	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6420 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c4	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2724 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003cc	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4884 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003d4	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3812 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003dc	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 5260 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003e4	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7552 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003ec	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7316 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003f4	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1036 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8636 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7672 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000410	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8004 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000418	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7908 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000420	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7932 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000428	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3932 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000430	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7304 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000438	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4164 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1432 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4804 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3252 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000458	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 9016 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000460	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7656 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000468	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8936 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000470	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7128 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000478	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 884 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000480	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4640 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000488	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3976 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000490	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1536 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000498	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 500 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004a0	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6124 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004a8	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 5000 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004b0	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8812 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004b8	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 5624 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004c0	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3884 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004c8	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6788 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004d0	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2720 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004d8	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8488 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004e0	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7120 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004e8	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7488 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004f0	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6872 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000004f8	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6620 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000500	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7412 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000508	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8624 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000510	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6556 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000518	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 108 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000520	3221225496
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2384 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000528	3221225496

Manipulates memory of a non-child process indicative of process injection (50 out of 10512 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 656 manipulating memory of non-child process 6012
Process injection	Process 656 manipulating memory of non-child process 8948
Process injection	Process 656 manipulating memory of non-child process 2228
Process injection	Process 656 manipulating memory of non-child process 4384
Process injection	Process 656 manipulating memory of non-child process 4792
Process injection	Process 656 manipulating memory of non-child process 6420
Process injection	Process 656 manipulating memory of non-child process 2724
Process injection	Process 656 manipulating memory of non-child process 4884
Process injection	Process 656 manipulating memory of non-child process 3812
Process injection	Process 656 manipulating memory of non-child process 5260
Process injection	Process 656 manipulating memory of non-child process 7552
Process injection	Process 656 manipulating memory of non-child process 7316
Process injection	Process 656 manipulating memory of non-child process 1036
Process injection	Process 656 manipulating memory of non-child process 8636
Process injection	Process 656 manipulating memory of non-child process 7672
Process injection	Process 656 manipulating memory of non-child process 8004
Process injection	Process 656 manipulating memory of non-child process 7908
Process injection	Process 656 manipulating memory of non-child process 7932
Process injection	Process 656 manipulating memory of non-child process 3932
Process injection	Process 656 manipulating memory of non-child process 7304
Process injection	Process 656 manipulating memory of non-child process 4164
Process injection	Process 656 manipulating memory of non-child process 1432
Process injection	Process 656 manipulating memory of non-child process 4804
Process injection	Process 656 manipulating memory of non-child process 3252
Process injection	Process 656 manipulating memory of non-child process 9016
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6012 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c0	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8948 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000033c	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2228 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000348	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4384 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000344	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4792 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000034c	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6420 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c4	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2724 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003cc	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4884 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003d4	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3812 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003dc	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 5260 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003e4	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7552 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003ec	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7316 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003f4	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1036 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8636 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7672 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000410	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8004 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000418	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7908 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000420	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7932 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000428	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3932 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000430	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7304 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000438	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4164 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000440	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1432 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000448	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4804 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000450	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3252 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000458	3221225496	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 9016 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000460	3221225496	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.c7ac2a1e30b01678
McAfee	Artemis!C7AC2A1E30B0
Cybereason	malicious.18189a
BitDefenderTheta	Gen:NN.ZemsilF.34686.xo0@aKrdbUg
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.FEVA
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
McAfee-GW-Edition	BehavesLike.Win32.Generic.vz
Sophos	ML/PE-A
Ikarus	Trojan.MSIL.PSW
Microsoft	Trojan:Win32/AgentTesla!ml
Cylance	Unsafe
SentinelOne	Static AI - Malicious PE
AVG	Win32:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (50 out of 15778 events)

Time & API	Arguments	Status	Return
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 656	1	0
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 656	1	0
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 656	1	0
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x00000204 suspend_count: 1 process_identifier: 656	1	0
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000000e0	1	0
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 656	1	0
NtResumeThread May 3, 2021, 4:45 p.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 656	1	0
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 7636 thread_handle: 0x0000038c process_identifier: 6928 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c timeout 1 filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000394	1	1
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 8752 thread_handle: 0x00000364 process_identifier: 6012 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003c0	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x00000364	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6012 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c0		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 4960 thread_handle: 0x00000260 process_identifier: 8948 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000033c	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x00000260	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8948 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000033c		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 1160 thread_handle: 0x0000038c process_identifier: 2228 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000348	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x0000038c	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2228 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000348		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 8340 thread_handle: 0x00000368 process_identifier: 4384 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000344	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x00000368	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4384 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000344		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 7940 thread_handle: 0x000003bc process_identifier: 4792 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000034c	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003bc	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4792 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000034c		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 7664 thread_handle: 0x000003c8 process_identifier: 6420 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003c4	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003c8	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 6420 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003c4		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 2644 thread_handle: 0x000003d0 process_identifier: 2724 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003cc	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003d0	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 2724 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003cc		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 2268 thread_handle: 0x000003d8 process_identifier: 4884 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003d4	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003d8	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 4884 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003d4		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 7532 thread_handle: 0x000003e0 process_identifier: 3812 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003dc	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003e0	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 3812 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003dc		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 4608 thread_handle: 0x000003e8 process_identifier: 5260 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003e4	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003e8	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 5260 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003e4		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 2196 thread_handle: 0x000003f0 process_identifier: 7552 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003ec	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003f0	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7552 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003ec		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 6080 thread_handle: 0x000003f8 process_identifier: 7316 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003f4	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x000003f8	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 7316 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003f4		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 4012 thread_handle: 0x00000404 process_identifier: 1036 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003fc	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x00000404	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 1036 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003fc		3221225496
CreateProcessInternalW May 3, 2021, 4:45 p.m.	thread_identifier: 9100 thread_handle: 0x0000040c process_identifier: 8636 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\kdotx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\kdotx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000408	1	1
NtGetContextThread May 3, 2021, 4:45 p.m.	thread_handle: 0x0000040c	1	0
NtAllocateVirtualMemory May 3, 2021, 4:45 p.m.	process_identifier: 8636 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000408		3221225496

kdotx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All