Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 13, 2021, 7:49 a.m.	July 13, 2021, 7:51 a.m.

Size	9.4KB
Type	ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
MD5	`2227974643a64d245e5eb933648c5fa1`
SHA256	`0c4e169242783fb8285c4128b380648c0b68c8749be043aa78abeb49fed2e5b5`
CRC32	`1621F2B3`
ssdeep	`192:H05eO7g7VMwJvfCScP7GCrRmU7kye0nsb7i3GO0+BuJ8NkLH49y:Ez+WccPdlWp0OA8QuaAY9y`
Yara	Rich_Text_Format_Zero - Rich Text Format Signature Zero

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "aDxKfzx" C:\Users\test22\AppData\Local\Temp\................................................w.wiz
2532
- WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n /f "C:\Users\test22\AppData\Local\Temp\................................................w.wiz"
  2656
  - splwow64.exe C:\Windows\splwow64.exe 12288
    2972

Name	Response	Post-Analysis Lookup
secureme.ddns.net	A 185.244.26.232	185.244.26.232

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.244.26.232	Active	Moloch
198.12.107.11	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (11 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0
IsDebuggerPresent July 13, 2021, 7:49 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptGenKey July 13, 2021, 7:49 a.m.	crypto_handle: 0x0086e948 algorithm_identifier: 0x00006610 () flags: 1 key: f ¶UviqAi65¼¡Åk½ßÝÒr;×ÔZÃù provider_handle: 0x0085b540	1	1
CryptExportKey July 13, 2021, 7:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0086e948 flags: 0 crypto_export_handle: 0x008ce940 blob_type: 1	1	1
CryptExportKey July 13, 2021, 7:49 a.m.	buffer: f¤ûðôþØ±r¾gª× G%¼®&1?¹9vúÁme²aÚ[dÈäeÆMåM×(S`Ohc²n£\|yGÐòKaqònÎZGéðj)¸JéC\|³Guj4nBñÚ2»9B-6süwvAcáÒÞÓÎ crypto_handle: 0x0086e948 flags: 0 crypto_export_handle: 0x008ce940 blob_type: 1	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (4 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}\DigitalProductID
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}\DigitalProductID
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}\DigitalProductID
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}\DigitalProductID

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 13, 2021, 7:49 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 13, 2021, 7:49 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x75671414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x75f4b727 registers.esp: 3785392 registers.edi: 1969486352 registers.eax: 3785392 registers.ebp: 3785472 registers.edx: 2130566132 registers.ebx: 9018988 registers.esi: 2147944126 registers.ecx: 189861772	1	0	0
__exception__ July 13, 2021, 7:49 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x7562b641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x7562b5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x7562b172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x7562a66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x756aa68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x756877e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x756714b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x75f4b727 registers.esp: 3785084 registers.edi: 1969486352 registers.eax: 3785084 registers.ebp: 3785164 registers.edx: 2130566132 registers.ebx: 9018484 registers.esi: 2147944122 registers.ecx: 189861772	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 13, 2021, 7:49 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x75671414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706be
exception.offset: 46887
exception.address: 0x75f4b727
registers.esp: 3785392
registers.edi: 1969486352
registers.eax: 3785392
registers.ebp: 3785472
registers.edx: 2130566132
registers.ebx: 9018988
registers.esi: 2147944126
registers.ecx: 189861772

__exception__

July 13, 2021, 7:49 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x7562b641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x7562b5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x7562b172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x7562a66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x756aa68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x756877e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x756714b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x75f4b727
registers.esp: 3785084
registers.edi: 1969486352
registers.eax: 3785084
registers.ebp: 3785164
registers.edx: 2130566132
registers.ebx: 9018484
registers.esi: 2147944122
registers.ecx: 189861772

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://198.12.107.11/ftp/vbc.exe

Connects to a Dynamic DNS Domain (1 event)

domain

secureme.ddns.net

Performs some HTTP requests (1 event)

request

GET http://198.12.107.11/ftp/vbc.exe

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2f891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e4c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70f27000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7242f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70cad000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ff20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75b38000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b72000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ac59000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ac59000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03b60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02330000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x5fff0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755f6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75eb4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75eb3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75eb5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75eb3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6a9b3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 7:49 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66674000 process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (3 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process WINWORD.EXE with pid 2656 crashed
__exception__ July 13, 2021, 7:49 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x75671414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x75f4b727 registers.esp: 3785392 registers.edi: 1969486352 registers.eax: 3785392 registers.ebp: 3785472 registers.edx: 2130566132 registers.ebx: 9018988 registers.esi: 2147944126 registers.ecx: 189861772	1	0	0
__exception__ July 13, 2021, 7:49 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x7562b641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x7562b5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x7562b172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x7562a66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x756aa68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x756877e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x756714b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68 wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5 DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8 DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27 DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436 _GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee _GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5 DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4 _GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8 _GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416 _GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388 _GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237 DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7 DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17 DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6 FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602 wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x75f4b727 registers.esp: 3785084 registers.edi: 1969486352 registers.eax: 3785084 registers.ebp: 3785164 registers.edx: 2130566132 registers.ebx: 9018484 registers.esi: 2147944122 registers.ecx: 189861772	1	0	0

Application Crash

Process WINWORD.EXE with pid 2656 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

July 13, 2021, 7:49 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad
OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x75671414
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

__exception__

July 13, 2021, 7:49 a.m.

stacktrace:

RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x7548374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x7572f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x7549414b
WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x7572c8e2
CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x756298ad
CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x7562b641
CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x7562b5ed
CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x7562b172
CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x7562a66e
ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x756aa68c
ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x756877e6
OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x756714b7
ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75687b68
wdGetApplicationObject+0x692e4 wdCommandDispatch-0xec808 wwlib+0xb0515a @ 0x72d4515a
DllGetLCID+0x46ee14 wdGetApplicationObject-0x41f66c wwlib+0x67c80a @ 0x728bc80a
DllGetLCID+0x431abf wdGetApplicationObject-0x45c9c1 wwlib+0x63f4b5 @ 0x7287f4b5
DllGetLCID+0x41dc02 wdGetApplicationObject-0x47087e wwlib+0x62b5f8 @ 0x7286b5f8
DllGetLCID+0x41c431 wdGetApplicationObject-0x47204f wwlib+0x629e27 @ 0x72869e27
DllGetLCID+0x46bf56 wdGetApplicationObject-0x42252a wwlib+0x67994c @ 0x728b994c
DllGetLCID+0x46ba40 wdGetApplicationObject-0x422a40 wwlib+0x679436 @ 0x728b9436
_GetAllocCounters@0+0x1ed526 DllGetLCID-0x9708 wwlib+0x2042ee @ 0x724442ee
_GetAllocCounters@0+0x1bc92 DllGetLCID-0x1daf9c wwlib+0x32a5a @ 0x72272a5a
DllGetLCID+0x492af wdGetApplicationObject-0x8451d1 wwlib+0x256ca5 @ 0x72496ca5
DllGetLCID+0x3bdb6 wdGetApplicationObject-0x8526ca wwlib+0x2497ac @ 0x724897ac
DllGetLCID+0x1f98de wdGetApplicationObject-0x694ba2 wwlib+0x4072d4 @ 0x726472d4
_GetAllocCounters@0+0x6fbf0 DllGetLCID-0x18703e wwlib+0x869b8 @ 0x722c69b8
_GetAllocCounters@0+0x6f64e DllGetLCID-0x1875e0 wwlib+0x86416 @ 0x722c6416
_GetAllocCounters@0+0x6f5c0 DllGetLCID-0x18766e wwlib+0x86388 @ 0x722c6388
_GetAllocCounters@0+0x6f46f DllGetLCID-0x1877bf wwlib+0x86237 @ 0x722c6237
DllGetLCID+0xafc7 wdGetApplicationObject-0x8834b9 wwlib+0x2189bd @ 0x724589bd
DllGetLCID+0xacb1 wdGetApplicationObject-0x8837cf wwlib+0x2186a7 @ 0x724586a7
DllGetLCID+0xab15 wdGetApplicationObject-0x88396b wwlib+0x21850b @ 0x7245850b
DllGetLCID+0x34c0b5 wdGetApplicationObject-0x5423cb wwlib+0x559aab @ 0x72799aab
DllGetLCID+0x321 wdGetApplicationObject-0x88e15f wwlib+0x20dd17 @ 0x7244dd17
DllGetClassObject+0x29ea _GetAllocCounters@0-0xee02 wwlib+0x7fc6 @ 0x72247fc6
FMain+0x245 DllGetClassObject-0x2a0 wwlib+0x533c @ 0x7224533c
wdCommandDispatch-0x964 winword+0x1602 @ 0x2f891602
wdCommandDispatch-0x9cc winword+0x159a @ 0x2f89159a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x800706ba
exception.offset: 46887
exception.address: 0x75f4b727
registers.esp: 3785084
registers.edi: 1969486352
registers.eax: 3785084
registers.ebp: 3785164
registers.edx: 2130566132
registers.ebx: 9018484
registers.esi: 2147944122
registers.ecx: 189861772

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Creates hidden or system file (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile July 13, 2021, 7:49 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000398 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0
NtCreateFile July 13, 2021, 7:49 a.m.	create_disposition: 5 (FILE_OVERWRITE_IF) file_handle: 0x00000410 filepath: C:\Users\test22\AppData\Local\Temp\~$..............................................w.wiz desired_access: 0x40100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$..............................................w.wiz create_options: 4194400 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 2 (FILE_CREATED) share_access: 0 ()	1	0	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

198.12.107.11

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (10 events)

dead_host	192.168.56.102:49178
dead_host	192.168.56.102:49179
dead_host	192.168.56.102:49176
dead_host	192.168.56.102:49177
dead_host	192.168.56.102:49182
dead_host	192.168.56.102:49183
dead_host	185.244.26.232:9292
dead_host	192.168.56.102:49180
dead_host	192.168.56.102:49181
dead_host	192.168.56.102:49175

................................................w.wiz

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All