Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 2, 2021, 9:38 a.m.	June 2, 2021, 9:47 a.m.

Size	10.1KB
Type	Microsoft Word 2007+
MD5	`b611e891cb9f097c7c357bb2c0e4ead3`
SHA256	`c6354273980658e3a9973b5458893e925f8762b5b3b19a2b520d6ce005953d0b`
CRC32	`3FC4A502`
ssdeep	`96:kHcIMm57P6Jb73IdmGJa6T/n/jNT7aTZ4WSZny6+IwlLEl9V7JaqMxnIOU+txL/p:ScIMmtPs5G/bhaTOZu4R7JarU+3bTV`
Yara	None matched

WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" C:\Users\test22\AppData\Local\Temp\loki.docx
3576

Name	Response	Post-Analysis Lookup
gaag.ddns.net	A 23.95.122.53	23.95.122.53
bit.do	A 54.83.52.76	54.83.52.76

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
23.95.122.53	Active	Moloch
54.83.52.76	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 23.95.122.53:80 -> 192.168.56.102:49813	2026863	ET INFO Possible RTF File With Obfuscated Version Header	Potentially Bad Traffic
UDP 192.168.56.102:50839 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
TCP 192.168.56.102:49815 -> 23.95.122.53:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 2, 2021, 9:38 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289 wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9 wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418 DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431 DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4 wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2167716 registers.edi: 1957755408 registers.eax: 2167716 registers.ebp: 2167796 registers.edx: 0 registers.ebx: 3651948 registers.esi: 2147944126 registers.ecx: 2460773449	1	0	0
__exception__ June 2, 2021, 9:38 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289 wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9 wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418 DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431 DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4 wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2167408 registers.edi: 1957755408 registers.eax: 2167408 registers.ebp: 2167488 registers.edx: 0 registers.ebx: 3651372 registers.esi: 2147944122 registers.ecx: 2460773449	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 2, 2021, 9:38 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289
wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9
wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c
DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2167716
registers.edi: 1957755408
registers.eax: 2167716
registers.ebp: 2167796
registers.edx: 0
registers.ebx: 3651948
registers.esi: 2147944126
registers.ecx: 2460773449

__exception__

June 2, 2021, 9:38 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289
wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9
wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c
DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2167408
registers.edi: 1957755408
registers.eax: 2167408
registers.ebp: 2167488
registers.edx: 0
registers.ebx: 3651372
registers.esi: 2147944122
registers.ecx: 2460773449

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://23.95.122.53/imo/l.dot
suspicious_features	Connection to IP address				suspicious_request	HEAD http://23.95.122.53/imo/l.dot

Connects to a Dynamic DNS Domain (1 event)

domain

gaag.ddns.net

Performs some HTTP requests (7 events)

request	OPTIONS http://bit.do/
request	PROPFIND http://bit.do/
request	GET http://bit.do/fQWAj
request	GET http://23.95.122.53/imo/l.dot
request	HEAD http://bit.do/fQWAj
request	HEAD http://23.95.122.53/imo/l.dot
request	GET http://gaag.ddns.net/imo/ana.exe

Allocates read-write-execute memory (usually to unpack itself) (32 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e5e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66a91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x745f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x745d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x065c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2021, 9:38 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x507c1000 process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (3 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process WINWORD.EXE with pid 3576 crashed
__exception__ June 2, 2021, 9:38 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289 wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9 wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418 DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431 DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4 wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2167716 registers.edi: 1957755408 registers.eax: 2167716 registers.ebp: 2167796 registers.edx: 0 registers.ebx: 3651948 registers.esi: 2147944126 registers.ecx: 2460773449	1	0	0
__exception__ June 2, 2021, 9:38 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68 wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0 DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232 DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206 DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6 DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6 DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289 wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9 wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418 DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431 DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4 wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7 wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 2167408 registers.edi: 1957755408 registers.eax: 2167408 registers.ebp: 2167488 registers.edx: 0 registers.ebx: 3651372 registers.esi: 2147944122 registers.ecx: 2460773449	1	0	0

Application Crash

Process WINWORD.EXE with pid 3576 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

June 2, 2021, 9:38 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x74b41414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289
wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9
wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c
DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

__exception__

June 2, 2021, 9:38 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74d5374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x74bff725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74d6414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x74bfc8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x74af98ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x74afb641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x74afb5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x74afb172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x74afa66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x74b7a68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x74b577e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x74b414b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x74b57b68
wdGetApplicationObject+0x131f9 wdCommandDispatch-0x4c476 wwlib+0x394dff @ 0x64e54dff
DllCanUnloadNow+0xbaf5e wwlib+0x9692a0 @ 0x654292a0
DllCanUnloadNow+0x339ef0 wwlib+0xbe8232 @ 0x656a8232
DllCanUnloadNow+0x54e0c9 wwlib+0xdfc40b @ 0x658bc40b
DllCanUnloadNow+0x55865b wwlib+0xe0699d @ 0x658c699d
DllCanUnloadNow+0x33bec4 wwlib+0xbea206 @ 0x656aa206
DllCanUnloadNow+0xbd684 wwlib+0x96b9c6 @ 0x6542b9c6
DllCanUnloadNow+0x215f8 wwlib+0x8cf93a @ 0x6538f93a
DllGetClassObject+0x2d9ac DllGetLCID-0x22ded4 wwlib+0x325f6 @ 0x64af25f6
DllGetClassObject+0x5b213 DllGetLCID-0x20066d wwlib+0x5fe5d @ 0x64b1fe5d
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x290f47 wwlib+0xb3f289 @ 0x655ff289
wdCommandDispatch+0x19f764 DllCanUnloadNow-0x32d969 wwlib+0x5809d9 @ 0x650409d9
wdCommandDispatch+0x468fb7 DllCanUnloadNow-0x64116 wwlib+0x84a22c @ 0x6530a22c
DllGetClassObject+0x5b481 DllGetLCID-0x2003ff wwlib+0x600cb @ 0x64b200cb
DllGetClassObject+0x5a904 DllGetLCID-0x200f7c wwlib+0x5f54e @ 0x64b1f54e
DllCanUnloadNow+0x3200d6 wwlib+0xbce418 @ 0x6568e418
DllCanUnloadNow+0x2d334c wwlib+0xb8168e @ 0x6564168e
DllGetClassObject+0x157e7 DllGetLCID-0x246099 wwlib+0x1a431 @ 0x64ada431
DllGetClassObject+0x3b23 DllGetLCID-0x257d5d wwlib+0x876d @ 0x64ac876d
FMain+0x482 DllGetClassObject-0x266 wwlib+0x49e4 @ 0x64ac49e4
wdCommandDispatch-0x2ed winword+0x15d7 @ 0x2fe015d7
wdCommandDispatch-0x367 winword+0x155d @ 0x2fe0155d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 2167408
registers.edi: 1957755408
registers.eax: 2167408
registers.ebp: 2167488
registers.edx: 0
registers.ebx: 3651372
registers.esi: 2147944122
registers.ecx: 2460773449

Creates (office) documents on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\~$loki.docx
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\l[1].doc
file	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\80554CB4.doc

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile June 2, 2021, 9:38 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x000003e4 filepath: C:\Users\test22\AppData\Local\Temp\~$loki.docx desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$loki.docx create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

loki.docx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All