Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 19, 2021, 7:05 p.m.	Aug. 19, 2021, 7:19 p.m.

Size	388.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`1618f8ae8ee070d71010a20d21b5e856`
SHA256	`0848a10d6f7db8ad7f03be296b2a307a82554446d8a172fe0a0503309c08aeb0`
CRC32	`01BE59A7`
ssdeep	`6144:vW3hPbF9A3hAfKKC64zROB6NBbTN+qGfhI6zSRZKhoRli2fFzs:vWRjAhAfKbRO6NBbTMp/STKhoHi2fFzs`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\redtank.png.dll,klust
2648
- wermgr.exe C:\Windows\system32\wermgr.exe
  1512
  - svchost.exe C:\Windows\system32\svchost.exe
    2332
  - svchost.exe C:\Windows\system32\svchost.exe
    752
  - svchost.exe C:\Windows\system32\svchost.exe
    2672
  - svchost.exe C:\Windows\system32\svchost.exe
    1332
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\redtank.png.dll,
2076

Name	Response	Post-Analysis Lookup
150.134.208.175.b.barracudacentral.org	A 127.0.0.2	127.0.0.2
150.134.208.175.zen.spamhaus.org
ident.me	A 176.58.123.25	176.58.123.25
150.134.208.175.cbl.abuseat.org

IP Address	Status	Action
105.27.205.34	Active	Moloch
164.124.101.2	Active	Moloch
176.58.123.25	Active	Moloch
179.189.229.254	Active	Moloch
185.56.175.122	Active	Moloch
194.146.249.137	Active	Moloch
216.166.148.187	Active	Moloch
221.147.172.5	Active	Moloch
5.152.175.57	Active	Moloch
60.51.47.65	Active	Moloch
65.152.201.203	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49205 -> 105.27.205.34:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49203 -> 176.58.123.25:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 105.27.205.34:443 -> 192.168.56.101:49205	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 176.58.123.25:443 -> 192.168.56.101:49203	2026743	ET HUNTING Observed Suspicious SSL Cert (External IP Lookup - ident .me)	Device Retrieving External IP Address Detected
TCP 192.168.56.101:49209 -> 221.147.172.5:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 221.147.172.5:443 -> 192.168.56.101:49209	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.101:49218 -> 5.152.175.57:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49202 -> 179.189.229.254:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 5.152.175.57:443 -> 192.168.56.101:49218	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 179.189.229.254:443 -> 192.168.56.101:49202	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.101:49208 -> 60.51.47.65:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 60.51.47.65:443 -> 192.168.56.101:49208	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.101:49212 -> 185.56.175.122:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 185.56.175.122:443 -> 192.168.56.101:49212	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49205 105.27.205.34:443	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	30:21:9a:cd:06:f2:ba:20:f6:0b:3c:54:ec:08:35:d0:9d:4b:e8:50
TLSv1 192.168.56.101:49203 176.58.123.25:443	C=US, O=Let's Encrypt, CN=R3	CN=ident.me	62:e4:7c:dd:ef:07:8a:03:72:62:75:3b:4f:07:34:df:6d:b1:7e:23
TLSv1 192.168.56.101:49209 221.147.172.5:443	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	30:21:9a:cd:06:f2:ba:20:f6:0b:3c:54:ec:08:35:d0:9d:4b:e8:50
TLSv1 192.168.56.101:49218 5.152.175.57:443	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	C=US, ST=IL, L=Chicago, O=Internet Widgits Pty Ltd	30:21:9a:cd:06:f2:ba:20:f6:0b:3c:54:ec:08:35:d0:9d:4b:e8:50
TLSv1 192.168.56.101:49202 179.189.229.254:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	b5:21:a8:16:d5:97:b1:67:f6:60:a5:cb:20:27:76:ec:3c:9d:3b:02
TLSv1 192.168.56.101:49208 60.51.47.65:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02
TLSv1 192.168.56.101:49212 185.56.175.122:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 19, 2021, 6:58 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 19, 2021, 7:05 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

The executable uses a known packer (1 event)

packer

Armadillo v1.xx - v2.xx

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

One or more processes crashed (5 events)

Time & API	Arguments	Status
__exception__ Aug. 19, 2021, 6:58 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd hook_in_monitor+0x45 lde-0x133 @ 0x744142ea New_ntdll_LdrGetProcedureAddress+0x43 New_ntdll_LdrLoadDll-0x156 @ 0x7442f7f3 GetProcAddress+0x60 GetModuleHandleA-0x80 kernelbase+0x4190 @ 0x7fefd6d4190 SvchostPushServiceGlobals+0x471 WinHttpQueryOption-0x1a7b winhttp+0x1eb99 @ 0x7fef9f6eb99 SvchostPushServiceGlobals+0x4fb WinHttpQueryOption-0x19f1 winhttp+0x1ec23 @ 0x7fef9f6ec23 WinHttpConnect+0x1ab WinHttpGetDefaultProxyConfiguration-0x1615 winhttp+0x13fe7 @ 0x7fef9f63fe7 exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x771d9a5a registers.r14: 1994795888 registers.r15: 26070750 registers.rcx: 0 registers.rsi: 851196256 registers.r10: 0 registers.rbx: 0 registers.rsp: 1500976 registers.r11: 0 registers.r8: 5 registers.r9: 1951127552 registers.rdx: 2 registers.r12: 2805120 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 443	1
__exception__ Aug. 19, 2021, 6:58 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd hook_in_monitor+0x45 lde-0x133 @ 0x744142ea New_ntdll_NtAllocateVirtualMemory+0x34 New_ntdll_NtClose-0x162 @ 0x7442fc86 VirtualAllocExNuma+0x66 VirtualAllocEx-0x2a kernelbase+0x33096 @ 0x7fefd703096 VirtualAllocEx+0x16 WriteProcessMemory-0x1a kernelbase+0x330d6 @ 0x7fefd7030d6 VirtualAllocEx+0x11 VerLanguageNameW-0xf kernel32+0x4bbe1 @ 0x76e8bbe1 0xa0d5c exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x771d9a5a registers.r14: 851194400 registers.r15: 851377248 registers.rcx: 24 registers.rsi: 3 registers.r10: 0 registers.rbx: 3 registers.rsp: 1496552 registers.r11: -128 registers.r8: 3 registers.r9: 1951132416 registers.rdx: 3 registers.r12: 40 registers.rbp: 0 registers.rdi: 1496944 registers.rax: 4 registers.r13: 0	1
__exception__ Aug. 19, 2021, 6:59 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd hook_in_monitor+0x45 lde-0x133 @ 0x744142ea New_ntdll_NtAllocateVirtualMemory+0x34 New_ntdll_NtClose-0x162 @ 0x7442fc86 VirtualAllocExNuma+0x66 VirtualAllocEx-0x2a kernelbase+0x33096 @ 0x7fefd703096 VirtualAllocEx+0x16 WriteProcessMemory-0x1a kernelbase+0x330d6 @ 0x7fefd7030d6 VirtualAllocEx+0x11 VerLanguageNameW-0xf kernel32+0x4bbe1 @ 0x76e8bbe1 0xa0d5c exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x771d9a5a registers.r14: 851193568 registers.r15: 851377120 registers.rcx: 24 registers.rsi: 3 registers.r10: 0 registers.rbx: 3 registers.rsp: 1496552 registers.r11: -128 registers.r8: 3 registers.r9: 1951132416 registers.rdx: 3 registers.r12: 40 registers.rbp: 0 registers.rdi: 1496944 registers.rax: 4 registers.r13: 0	1
__exception__ Aug. 19, 2021, 6:59 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd hook_in_monitor+0x45 lde-0x133 @ 0x744142ea New_ntdll_NtAllocateVirtualMemory+0x34 New_ntdll_NtClose-0x162 @ 0x7442fc86 VirtualAllocExNuma+0x66 VirtualAllocEx-0x2a kernelbase+0x33096 @ 0x7fefd703096 VirtualAllocEx+0x16 WriteProcessMemory-0x1a kernelbase+0x330d6 @ 0x7fefd7030d6 VirtualAllocEx+0x11 VerLanguageNameW-0xf kernel32+0x4bbe1 @ 0x76e8bbe1 0xa0d5c exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x771d9a5a registers.r14: 851194496 registers.r15: 851377632 registers.rcx: 24 registers.rsi: 3 registers.r10: 0 registers.rbx: 3 registers.rsp: 1496552 registers.r11: -128 registers.r8: 3 registers.r9: 1951132416 registers.rdx: 3 registers.r12: 40 registers.rbp: 0 registers.rdi: 1496944 registers.rax: 4 registers.r13: 0	1
__exception__ Aug. 19, 2021, 6:59 p.m.	stacktrace: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd New_ntdll_RtlDispatchException+0xfa New_ntdll_RtlRemoveVectoredContinueHandler-0x8d @ 0x74436d97 KiUserExceptionDispatcher+0x2e KiRaiseUserExceptionDispatcher-0x45 ntdll+0x51278 @ 0x77211278 RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a @ 0x771d9a5a RtlVirtualUnwind+0x37 RtlRestoreContext-0x19 kernel32+0x4b5e7 @ 0x76e8b5e7 stacktrace+0x1d1 memdup-0x62 @ 0x744205bd hook_in_monitor+0x45 lde-0x133 @ 0x744142ea New_ntdll_NtAllocateVirtualMemory+0x34 New_ntdll_NtClose-0x162 @ 0x7442fc86 VirtualAllocExNuma+0x66 VirtualAllocEx-0x2a kernelbase+0x33096 @ 0x7fefd703096 VirtualAllocEx+0x16 WriteProcessMemory-0x1a kernelbase+0x330d6 @ 0x7fefd7030d6 VirtualAllocEx+0x11 VerLanguageNameW-0xf kernel32+0x4bbe1 @ 0x76e8bbe1 0xa0d5c exception.instruction_r: 48 8b 01 4a 89 44 c6 78 4d 85 e4 74 08 4b 89 8c exception.symbol: RtlVirtualUnwind+0x14a RtlCheckForOrphanedCriticalSections-0x356 ntdll+0x19a5a exception.instruction: mov rax, qword ptr [rcx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 105050 exception.address: 0x771d9a5a registers.r14: 841783312 registers.r15: 851377760 registers.rcx: 24 registers.rsi: 3 registers.r10: 0 registers.rbx: 3 registers.rsp: 1496888 registers.r11: -128 registers.r8: 3 registers.r9: 1951132416 registers.rdx: 3 registers.r12: 40 registers.rbp: 0 registers.rdi: 1497280 registers.rax: 4 registers.r13: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (26 events)

suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/b6LNAyociBwuWyQPTryUfUogSUQp0QA/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/user/test22/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5CArh-Cat8CLSDN%5Cwfredtankmf.dmo/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/NAT%20status/client%20is%20behind%20NAT/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://105.27.205.34/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/pwgrabb64/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/VfcG57GJVdJPXjUbD/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/user/test22/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/NAT%20status/client%20is%20behind%20NAT/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/10/62/DTHXTBVHNHHFNTTPH/7/
suspicious_features	Connection to IP address	suspicious_request	GET https://221.147.172.5/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/pwgrabc64/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/2ZPXt9YscNmrMG1rVFPmfY08/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/user/test22/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/NAT%20status/client%20is%20behind%20NAT/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/TYtN4uS9vzAQl4jbxpHvhP3TRn1fv/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/10/62/TZVNJHBFVZX/7/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/10/62/HNFXZPJHLZVXLFBRPVF/7/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/23/100019/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/DNSBL/listed/0/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/1/hziJCxHymvb2gHXq6TiBkB8T/
suspicious_features	Connection to IP address	suspicious_request	GET https://5.152.175.57/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/networkDll64/

Performs some HTTP requests (27 events)

request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/file/
request	GET https://ident.me/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/b6LNAyociBwuWyQPTryUfUogSUQp0QA/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/user/test22/0/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/path/C:%5CUsers%5Ctest22%5CAppData%5CRoaming%5CArh-Cat8CLSDN%5Cwfredtankmf.dmo/0/
request	GET https://179.189.229.254/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/NAT%20status/client%20is%20behind%20NAT/0/
request	GET https://105.27.205.34/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/pwgrabb64/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/file/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/VfcG57GJVdJPXjUbD/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/user/test22/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/NAT%20status/client%20is%20behind%20NAT/0/
request	GET https://60.51.47.65/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/10/62/DTHXTBVHNHHFNTTPH/7/
request	GET https://221.147.172.5/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/pwgrabc64/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/file/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/2ZPXt9YscNmrMG1rVFPmfY08/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/exc/E:%200xc0000005%20A:%200x00000000771D9A5A/0/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/user/test22/0/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/NAT%20status/client%20is%20behind%20NAT/0/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/0/Windows%207%20x64%20SP1/1107/175.208.134.150/727F639DF1E9560A2743CB69221BB85D3D1D1CBDEE638318DB0A9F2C35331CAD/TYtN4uS9vzAQl4jbxpHvhP3TRn1fv/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/10/62/TZVNJHBFVZX/7/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/10/62/HNFXZPJHLZVXLFBRPVF/7/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/23/100019/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/14/DNSBL/listed/0/
request	GET https://185.56.175.122/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/1/hziJCxHymvb2gHXq6TiBkB8T/
request	GET https://5.152.175.57/rob122/TEST22-PC_W617601.B23CDF3A63F73C73BEBFBB32BF39432B/5/networkDll64/

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ce1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73751000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b10000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a91000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a01000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729c4000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a92000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73731000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 278528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 6:57 p.m.	process_identifier: 1512 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0

A process attempted to delay the analysis task. (1 event)

description

wermgr.exe tried to sleep 127 seconds, actually delayed analysis time by 127 seconds

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe
cmdline	C:\Windows\system32\svchost.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 19, 2021, 7:05 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00a61000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 19, 2021, 6:58 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00047000', u'virtual_address': u'0x00018000', u'entropy': 7.1201923075070805, u'name': u'.rsrc', u'virtual_size': u'0x00046260'}

entropy

7.12019230751

description

A section with a high entropy has been found

entropy

0.739583333333

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 19, 2021, 6:58 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (32 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (8 events)

Time & API	Arguments	Status
NtTerminateProcess Aug. 19, 2021, 7:05 p.m.	status_code: 0x00000000 process_identifier: 2744 process_handle: 0x00000114
NtTerminateProcess Aug. 19, 2021, 7:05 p.m.	status_code: 0x00000000 process_identifier: 2744 process_handle: 0x00000114	1
NtTerminateProcess Aug. 19, 2021, 6:58 p.m.	status_code: 0x00000000 process_identifier: 2800 process_handle: 0x0000000000000420
NtTerminateProcess Aug. 19, 2021, 6:58 p.m.	status_code: 0x00000000 process_identifier: 2800 process_handle: 0x0000000000000420	1
NtTerminateProcess Aug. 19, 2021, 6:59 p.m.	status_code: 0x00000000 process_identifier: 2780 process_handle: 0x0000000000000430
NtTerminateProcess Aug. 19, 2021, 6:59 p.m.	status_code: 0x00000000 process_identifier: 2780 process_handle: 0x0000000000000430	1
NtTerminateProcess Aug. 19, 2021, 6:59 p.m.	status_code: 0x00000000 process_identifier: 3052 process_handle: 0x0000000000000444
NtTerminateProcess Aug. 19, 2021, 6:59 p.m.	status_code: 0x00000000 process_identifier: 3052 process_handle: 0x0000000000000444	1

Communicates with host for which no DNS query was performed (9 events)

host	105.27.205.34
host	179.189.229.254
host	185.56.175.122
host	194.146.249.137
host	216.166.148.187
host	221.147.172.5
host	5.152.175.57
host	60.51.47.65
host	65.152.201.203

Allocates execute permission to another process indicative of possible code injection (50 out of 839 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 774144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000180000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1

Potential code injection by writing to the memory of another process (50 out of 1263 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: UAVVWSHì`Hl$`HäðHùë0H¨ÇGXHOÿW0HHWA¸ÿÿÿÿE3ÉÿWkGX D$\D$\ø uWHw`HkFHD$PHD$PH=u\HFHLV@L^8H^0LN(LF HNHVHD$8LT$0L\$(H\$ ëpD$\øÅ3Àé\ÿÿÿHD$PH=«uPHFPH^HLV@L^8Lv0LN(LF HNHVHD$@H\$8LT$0L\$(Lt$ ÿH ¸éóþÿÿH\|$PtHD$PHø9uLF HNHVÿëÌÿëÈHD$PHøuHNÿëµHD$PHø&GÿÿÿHNHVÿëHÇ¨HHWE3ÀE3ÉÿWHÿW(HÇHOÿW(HÇG3ÉÿW83ÀHå[_^A^]ÃÌÌÌÌÌÌUVHì(Hl$ HäðHuPHöt@HEHM@HVpLFxLÉHHH¶HNÿV0HNºÿÿÿÿÿV He^]Ã base_address: 0x0000000000110000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!ww base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: H¹H¸ÿà base_address: 0x00000000ff2c246c process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: VERSION.dll base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: oåvG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: GetFileVersionInfoA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævxüþG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: VerQueryValueA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævxüþG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: GetFileVersionInfoSizeA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævxüþG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: KERNEL32.dll base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: oåvG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: GetLastError base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: HeapFree base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: HeapSize base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: HeapReAlloc base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: HeapAlloc base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: GetProcessHeap base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: lstrlenA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: lstrcpyA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: EnterCriticalSection base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: LeaveCriticalSection base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: InitializeCriticalSection base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1

Resumed a suspended thread in a remote process potentially indicative of process injection (8 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1512 resumed a thread in remote process 2332
Process injection	Process 1512 resumed a thread in remote process 752
Process injection	Process 1512 resumed a thread in remote process 2672
Process injection	Process 1512 resumed a thread in remote process 1332
NtResumeThread Aug. 19, 2021, 6:58 p.m.	thread_handle: 0x00000000000003fc suspend_count: 1 process_identifier: 2332	1	0	0
NtResumeThread Aug. 19, 2021, 6:59 p.m.	thread_handle: 0x0000000000000418 suspend_count: 1 process_identifier: 752	1	0	0
NtResumeThread Aug. 19, 2021, 6:59 p.m.	thread_handle: 0x00000000000000dc suspend_count: 1 process_identifier: 2672	1	0	0
NtResumeThread Aug. 19, 2021, 6:59 p.m.	thread_handle: 0x0000000000000444 suspend_count: 1 process_identifier: 1332	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 2162 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 19, 2021, 7:05 p.m.	thread_identifier: 2084 thread_handle: 0x00000110 process_identifier: 2744 current_directory: C:\Windows\system32 filepath: track: 1 command_line: C:\Windows\system32\cmd.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000114	1	1
CreateProcessInternalW Aug. 19, 2021, 7:05 p.m.	thread_identifier: 1316 thread_handle: 0x00000114 process_identifier: 1512 current_directory: C:\Windows\system32 filepath: track: 1 command_line: C:\Windows\system32\wermgr.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000110	1	1
CreateProcessInternalW Aug. 19, 2021, 6:58 p.m.	thread_identifier: 2088 thread_handle: 0x00000000000003fc process_identifier: 2332 current_directory: filepath: track: 1 command_line: C:\Windows\system32\svchost.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000110000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: UAVVWSHì`Hl$`HäðHùë0H¨ÇGXHOÿW0HHWA¸ÿÿÿÿE3ÉÿWkGX D$\D$\ø uWHw`HkFHD$PHD$PH=u\HFHLV@L^8H^0LN(LF HNHVHD$8LT$0L\$(H\$ ëpD$\øÅ3Àé\ÿÿÿHD$PH=«uPHFPH^HLV@L^8Lv0LN(LF HNHVHD$@H\$8LT$0L\$(Lt$ ÿH ¸éóþÿÿH\|$PtHD$PHø9uLF HNHVÿëÌÿëÈHD$PHøuHNÿëµHD$PHø&GÿÿÿHNHVÿëHÇ¨HHWE3ÀE3ÉÿWHÿW(HÇHOÿW(HÇG3ÉÿW83ÀHå[_^A^]ÃÌÌÌÌÌÌUVHì(Hl$ HäðHuPHöt@HEHM@HVpLFxLÉHHH¶HNÿV0HNºÿÿÿÿÿV He^]Ã base_address: 0x0000000000110000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000120000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!ww base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: H¹H¸ÿà base_address: 0x00000000ff2c246c process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtResumeThread Aug. 19, 2021, 6:58 p.m.	thread_handle: 0x00000000000003fc suspend_count: 1 process_identifier: 2332	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 774144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000180000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0x0000000000000404	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x0000000180000000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x0000000000000404	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: VERSION.dll base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: oåvG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: GetFileVersionInfoA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævxüþG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: VerQueryValueA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævxüþG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: GetFileVersionInfoSizeA base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævxüþG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: KERNEL32.dll base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: oåvG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: GetLastError base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: HeapFree base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: ,ëv +æv/æv Ùävð@wÀ/!w0!wwH base_address: 0x0000000000120000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: HeapSize base_address: 0x0000000000470000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1
NtAllocateVirtualMemory Aug. 19, 2021, 6:58 p.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000404	1	0
WriteProcessMemory Aug. 19, 2021, 6:58 p.m.	buffer: 6ævävG base_address: 0x0000000000480000 process_identifier: 2332 process_handle: 0x0000000000000404	1	1

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 events)

dead_host	216.166.148.187:443
dead_host	194.146.249.137:443

redtank.png

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All