Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 18, 2021, 5:33 p.m.	June 18, 2021, 5:47 p.m.

Size	296.5KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`fe6bb808dff8cb1a8571a1a07dbafe89`
SHA256	`b14a43816be48e5624a82bc768011389daf67645ae8cfe2078a9ee523d8e8afe`
CRC32	`98509409`
ssdeep	`6144:Et5hBPi0BW69hd1MMdxPe9N9uA069TBIcr7tGuHo67g7GnJaKeOnSlt6iPigOqZt:Etzww69Ta0ZGuVLJat/lsiPigO0npUq`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description)

SystemCrasher_ByDaniel.exe "C:\Users\test22\AppData\Local\Temp\SystemCrasher_ByDaniel.exe"
1116
- cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\63A4.tmp\63B5.tmp\63B6.bat C:\Users\test22\AppData\Local\Temp\SystemCrasher_ByDaniel.exe"
  2252
  - calc.exe calc
    2044
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2772
  - explorer.exe explorer
    1572
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2892
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    1276
  - mspaint.exe mspaint
    668
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2312
  - write.exe write
    2448
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      1684
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    1468
  - write.exe write
    2724
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      2644
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    1932
  - write.exe write
    1768
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      2620
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2232
  - control.exe control
    2988
  - net.exe net user DANIEL TROJAN /add
    1472
    - net1.exe C:\Windows\system32\net1 user DANIEL TROJAN /add
      2548
  - net.exe net user 30298 /add
    1052
    - net1.exe C:\Windows\system32\net1 user 30298 /add
      2544
  - net.exe net user YOUR PC IS TRASHED BY DANIEL /add
    3144
    - net1.exe C:\Windows\system32\net1 user YOUR PC IS TRASHED BY DANIEL /add
      3208
  - calc.exe calc
    3256
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3324
  - explorer.exe explorer
    3408
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3480
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3764
  - mspaint.exe mspaint
    3812
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3884
  - write.exe write
    3944
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      3148
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4024
  - write.exe write
    4076
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      3512
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    752
  - write.exe write
    3284
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      3796
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3444
  - control.exe control
    3532
  - calc.exe calc
    3608
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3956
  - explorer.exe explorer
    4072
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3168
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3704
  - mspaint.exe mspaint
    3852
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4052
  - write.exe write
    3744
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      3272
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2696
  - write.exe write
    3564
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      3340
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3116
  - write.exe write
    4028
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      3108
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    3068
  - control.exe control
    3856
  - calc.exe calc
    1996
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    996
  - explorer.exe explorer
    1124
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2536
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    1340
  - mspaint.exe mspaint
    2592
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2224
  - write.exe write
    1160
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4344
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    2284
  - write.exe write
    4124
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4432
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4216
  - write.exe write
    4272
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4608
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4376
  - control.exe control
    4492
  - calc.exe calc
    4580
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4704
  - explorer.exe explorer
    4780
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4860
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    5088
  - mspaint.exe mspaint
    1036
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4248
  - write.exe write
    4320
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4832
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4452
  - write.exe write
    4504
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4856
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4372
  - write.exe write
    4820
    - wordpad.exe "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4548
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4944
  - control.exe control
    5032
  - calc.exe calc
    4268
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4332
  - explorer.exe explorer
    4708
  - msg.exe msg * Looks Your OS Has Been Trashed By The Daniel Trojan Malware. Make Sure Have Fun And Enjoy Your System Destroyed! -Daniel
    4316

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 18, 2021, 5:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 5:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 5:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 18, 2021, 5:45 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 18, 2021, 5:26 p.m.			0	0
IsDebuggerPresent June 18, 2021, 5:45 p.m.			0	0
IsDebuggerPresent June 18, 2021, 5:45 p.m.			0	0
IsDebuggerPresent June 18, 2021, 5:46 p.m.			0	0
IsDebuggerPresent June 18, 2021, 5:46 p.m.			0	0
IsDebuggerPresent June 18, 2021, 5:39 p.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 18, 2021, 5:26 p.m.	buffer: The system cannot find the file msedge. console_handle: 0x000000000000000b	1	1
WriteConsoleW June 18, 2021, 5:27 p.m.	buffer: The system cannot find the file msedge. console_handle: 0x000000000000000b	1	1
WriteConsoleW June 18, 2021, 5:27 p.m.	buffer: The system cannot find the file msedge. console_handle: 0x000000000000000b	1	1
WriteConsoleW June 18, 2021, 5:27 p.m.	buffer: The system cannot find the file msedge. console_handle: 0x000000000000000b	1	1
WriteConsoleW June 18, 2021, 5:28 p.m.	buffer: The system cannot find the file msedge. console_handle: 0x000000000000000b	1	1
WriteConsoleW June 18, 2021, 5:45 p.m.	buffer: The command completed successfully. console_handle: 0x0000000000000007	1	1
WriteConsoleW June 18, 2021, 5:45 p.m.	buffer: The command completed successfully. console_handle: 0x0000000000000007	1	1
WriteConsoleW June 18, 2021, 5:45 p.m.	buffer: The syntax of this command is: console_handle: 0x000000000000000b	1	1
WriteConsoleW June 18, 2021, 5:45 p.m.	buffer: NET USER [username [password \| ] [options]] [/DOMAIN] username {password \| } /ADD [options] [/DOMAIN] username [/DELETE] [/DOMAIN] username [/TIMES:{times \| ALL}] console_handle: 0x000000000000000b	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 18, 2021, 5:26 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.code

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ June 18, 2021, 5:26 p.m.	stacktrace: 0x1be7704 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 79 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1be7704 registers.r14: 1 registers.r15: 2 registers.rcx: 48 registers.rsi: 4287116384 registers.r10: 0 registers.rbx: 3155744 registers.rsp: 1561800 registers.r11: 1572624 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 0 registers.rbp: 1561920 registers.rdi: 524836 registers.rax: 29259520 registers.r13: 0	1
__exception__ June 18, 2021, 5:45 p.m.	stacktrace: 0x1c67704 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 79 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1c67704 registers.r14: 1 registers.r15: 2 registers.rcx: 48 registers.rsi: 4284167264 registers.r10: 0 registers.rbx: 2893632 registers.rsp: 2215880 registers.r11: 2226704 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 8796092883536 registers.r12: 0 registers.rbp: 2216000 registers.rdi: 263008 registers.rax: 29783808 registers.r13: 0	1
__exception__ June 18, 2021, 5:45 p.m.	stacktrace: 0x3b7704 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 79 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3b7704 registers.r14: 1 registers.r15: 2 registers.rcx: 48 registers.rsi: 4278793312 registers.r10: 0 registers.rbx: 2762016 registers.rsp: 2018936 registers.r11: 2029760 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 8796092879440 registers.r12: 0 registers.rbp: 2019056 registers.rdi: 263308 registers.rax: 3897088 registers.r13: 0	1
__exception__ June 18, 2021, 5:46 p.m.	stacktrace: 0x1c67704 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 79 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1c67704 registers.r14: 1 registers.r15: 2 registers.rcx: 48 registers.rsi: 4295046240 registers.r10: 0 registers.rbx: 4663104 registers.rsp: 2413256 registers.r11: 2424080 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 8796092879440 registers.r12: 0 registers.rbp: 2413376 registers.rdi: 132760 registers.rax: 29783808 registers.r13: 0	1
__exception__ June 18, 2021, 5:46 p.m.	stacktrace: 0x1be7704 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 79 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1be7704 registers.r14: 1 registers.r15: 2 registers.rcx: 48 registers.rsi: 4291966048 registers.r10: 0 registers.rbx: 2483536 registers.rsp: 1036728 registers.r11: 1047552 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 0 registers.rbp: 1036848 registers.rdi: 67620 registers.rax: 29259520 registers.r13: 0	1
__exception__ June 18, 2021, 5:39 p.m.	stacktrace: 0x1c67704 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 79 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x1c67704 registers.r14: 1 registers.r15: 2 registers.rcx: 48 registers.rsi: 4293735520 registers.r10: 0 registers.rbx: 1124208 registers.rsp: 2675064 registers.r11: 2685888 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 0 registers.rbp: 2675184 registers.rdi: 264628 registers.rax: 29783808 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (47 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 18, 2021, 5:26 p.m.	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:26 p.m.	process_identifier: 2252 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:26 p.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002430000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002440000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3148 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:45 p.m.	process_identifier: 3796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3272 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3272 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3340 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002430000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 1996 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 3108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 2592 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4432 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 1036 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 1036 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000027e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:47 p.m.	process_identifier: 4832 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:46 p.m.	process_identifier: 4856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 18, 2021, 5:47 p.m.	process_identifier: 4856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000025c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:39 p.m.	process_identifier: 4268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 18, 2021, 5:39 p.m.	process_identifier: 4548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1

A process attempted to delay the analysis task. (2 events)

description	wordpad.exe tried to sleep 360 seconds, actually delayed analysis time by 360 seconds
description	mspaint.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\63A4.tmp\63B5.tmp\63B6.bat

Creates a suspicious process (1 event)

cmdline

"C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\63A4.tmp\63B5.tmp\63B6.bat C:\Users\test22\AppData\Local\Temp\SystemCrasher_ByDaniel.exe"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 18, 2021, 5:26 p.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd parameters: /c "C:\Users\test22\AppData\Local\Temp\63A4.tmp\63B5.tmp\63B6.bat C:\Users\test22\AppData\Local\Temp\SystemCrasher_ByDaniel.exe" filepath: C:\Windows\System32\cmd	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002c800', u'virtual_address': u'0x00022000', u'entropy': 7.741085923650761, u'name': u'.rsrc', u'virtual_size': u'0x0002c640'}

entropy

7.74108592365

description

A section with a high entropy has been found

entropy

0.602368866328

description

Overall entropy of this PE file is high

Yara rule detected in process memory (50 out of 1156 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	net user YOUR PC IS TRASHED BY DANIEL /add
cmdline	net user 30298 /add
cmdline	net user DANIEL TROJAN /add
cmdline	"C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\63A4.tmp\63B5.tmp\63B6.bat C:\Users\test22\AppData\Local\Temp\SystemCrasher_ByDaniel.exe"
cmdline	C:\Windows\System32\cmd /c "C:\Users\test22\AppData\Local\Temp\63A4.tmp\63B5.tmp\63B6.bat C:\Users\test22\AppData\Local\Temp\SystemCrasher_ByDaniel.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (50 out of 76 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1116 resumed a thread in remote process 2252
Process injection	Process 2252 resumed a thread in remote process 2044
Process injection	Process 2252 resumed a thread in remote process 1572
Process injection	Process 2252 resumed a thread in remote process 668
Process injection	Process 2252 resumed a thread in remote process 2448
Process injection	Process 2252 resumed a thread in remote process 2724
Process injection	Process 2252 resumed a thread in remote process 1768
Process injection	Process 2252 resumed a thread in remote process 2988
Process injection	Process 2252 resumed a thread in remote process 3256
Process injection	Process 2252 resumed a thread in remote process 3408
Process injection	Process 2252 resumed a thread in remote process 3812
Process injection	Process 2252 resumed a thread in remote process 3944
Process injection	Process 2252 resumed a thread in remote process 4076
Process injection	Process 2252 resumed a thread in remote process 3284
Process injection	Process 2252 resumed a thread in remote process 3532
Process injection	Process 2252 resumed a thread in remote process 3608
Process injection	Process 2252 resumed a thread in remote process 4072
Process injection	Process 2252 resumed a thread in remote process 3852
Process injection	Process 2252 resumed a thread in remote process 3744
Process injection	Process 2252 resumed a thread in remote process 3564
Process injection	Process 2252 resumed a thread in remote process 4028
Process injection	Process 2252 resumed a thread in remote process 3856
Process injection	Process 2252 resumed a thread in remote process 1996
Process injection	Process 2252 resumed a thread in remote process 1124
Process injection	Process 2252 resumed a thread in remote process 2592
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000001f0 suspend_count: 1 process_identifier: 2252	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x000000000000006c suspend_count: 0 process_identifier: 2044	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x000000000000006c suspend_count: 0 process_identifier: 1572	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000000d0 suspend_count: 0 process_identifier: 668	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000000d0 suspend_count: 0 process_identifier: 2448	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000000d0 suspend_count: 0 process_identifier: 2724	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000000d0 suspend_count: 0 process_identifier: 1768	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000000d0 suspend_count: 0 process_identifier: 2988	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000000d0 suspend_count: 0 process_identifier: 3256	1	0	0
NtResumeThread June 18, 2021, 5:26 p.m.	thread_handle: 0x00000000000000d0 suspend_count: 0 process_identifier: 3408	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x0000000000000124 suspend_count: 0 process_identifier: 3812	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x0000000000000124 suspend_count: 0 process_identifier: 3944	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x0000000000000124 suspend_count: 0 process_identifier: 4076	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x0000000000000124 suspend_count: 0 process_identifier: 3284	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x0000000000000124 suspend_count: 0 process_identifier: 3532	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 0 process_identifier: 3608	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 0 process_identifier: 4072	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x000000000000020c suspend_count: 0 process_identifier: 3852	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x000000000000020c suspend_count: 0 process_identifier: 3744	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x000000000000020c suspend_count: 0 process_identifier: 3564	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x000000000000020c suspend_count: 0 process_identifier: 4028	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x000000000000020c suspend_count: 0 process_identifier: 3856	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 0 process_identifier: 1996	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 0 process_identifier: 1124	1	0	0
NtResumeThread June 18, 2021, 5:27 p.m.	thread_handle: 0x0000000000000218 suspend_count: 0 process_identifier: 2592	1	0	0

Created a process named as a common system process (6 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 18, 2021, 5:26 p.m.	thread_identifier: 2448 thread_handle: 0x000000000000006c process_identifier: 1572 current_directory: filepath: C:\Windows\explorer.exe track: 1 command_line: explorer filepath_r: C:\Windows\explorer.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000068	1	1
CreateProcessInternalW June 18, 2021, 5:26 p.m.	thread_identifier: 3412 thread_handle: 0x00000000000000d0 process_identifier: 3408 current_directory: filepath: C:\Windows\explorer.exe track: 1 command_line: explorer filepath_r: C:\Windows\explorer.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000000000000a8	1	1
CreateProcessInternalW June 18, 2021, 5:27 p.m.	thread_identifier: 2420 thread_handle: 0x00000000000000c4 process_identifier: 4072 current_directory: filepath: C:\Windows\explorer.exe track: 1 command_line: explorer filepath_r: C:\Windows\explorer.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000124	1	1
CreateProcessInternalW June 18, 2021, 5:27 p.m.	thread_identifier: 2416 thread_handle: 0x00000000000000c8 process_identifier: 1124 current_directory: filepath: C:\Windows\explorer.exe track: 1 command_line: explorer filepath_r: C:\Windows\explorer.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x000000000000020c	1	1
CreateProcessInternalW June 18, 2021, 5:27 p.m.	thread_identifier: 4784 thread_handle: 0x000000000000020c process_identifier: 4780 current_directory: filepath: C:\Windows\explorer.exe track: 1 command_line: explorer filepath_r: C:\Windows\explorer.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000218	1	1
CreateProcessInternalW June 18, 2021, 5:28 p.m.	thread_identifier: 4796 thread_handle: 0x000000000000011c process_identifier: 4708 current_directory: filepath: C:\Windows\explorer.exe track: 1 command_line: explorer filepath_r: C:\Windows\explorer.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000218	1	1

SystemCrasher_ByDaniel.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All