Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 29, 2021, 4:24 p.m.	Sept. 29, 2021, 4:27 p.m.

Size	1.4MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`25492a4aa466acceafbff245d285951d`
SHA256	`31f33078ee56172d1ea5994a50c488b4b4140be8519128a17f7b75ade4bee31a`
CRC32	`E9C78CBE`
ssdeep	`24576:eqgvGA6l5UfquF44Nc3Y/1/ChWsnVTpNEkEQ562Q7:rYGiC463G8H0b7`
PDB Path	F:\kT2Knmpk\SiVr6yPD\nP4VFkE0LHR8\UKo4b64g\c6CaPPLYt8dl\PSQ2Q\jcYwYQqc\O28E\z2GjofxUl9\KR\13lCzXnT.pdb
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?KmeHCeEZQd_fuPPcQKge@@YG_NXZ
1116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?QOmviswgcN_vMdZtPEhyY@@YG_NXZ
2428
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?ZpEbgvlA_fyCRTxpEt@@YG_NXZ
260
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?VkjaEoQAJt_WeOvySCjxdWblaCoVYn@@YG_NXZ
1452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?aeWfWWxQRQ_OvOrhdkOslZrwghUkkckkEQFNa@@YG_NXZ
2620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?cHgWVBHFsc_ySRQxbJAYAYMfUtUXjcSflMrJZBzEP@@YG_NXZ
1468
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?fqxmUOBP_MNgUaVYxfiiSpKf@@YG_NXZ
2256
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?gKKtepXvfK_gBVMOWOtEnsbDEEtrXwHOyWZtxz@@YG_NXZ
1188
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?iMQjPeNjkH_hJBIoSAYmxolSMtTpxhqOaah@@YG_NXZ
1836
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?pFgmxhSwZ_IoCnLUNdzhIKXOcZspkLGGxvdzL@@YG_NXZ
2648
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?rnvHsfBUW_zleVawIYv@@YG_NXZ
2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?sHxCGRcqY_uOicOniLtIVpm@@YG_NXZ
3032
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?sNRsOiOupb_NEQELXcYDqMwTUSq@@YG_NXZ
1912
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?taXuqcAxFN_VqLUzsGsAZBWjJhzCLZVya@@YG_NXZ
2780
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?ultGAAJBVf_sgKxdYNEAqjdOVFOwXlpFrXpralMhV@@YG_NXZ
288
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,?zdzgTFCHxd_hCiqpuSQApFEnvlRXbDqEkrbREsM@@YG_NXZ
1936
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,DllRegisterServer
1040
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,EtrfJalMqMPWTrfPp
2576
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,IoCnLUNdzhIKXOcZspkLGGxvdzL
1572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,MNgUaVYxfiiSpKf
2440
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,NEQELXcYDqMwTUSq
2536
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,OvOrhdkOslZrwghUkkckkEQFNa
1308
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,VqLUzsGsAZBWjJhzCLZVya
1320
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,WeOvySCjxdWblaCoVYn
232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,fuPPcQKge
2296
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,fyCRTxpEt
3220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,gBVMOWOtEnsbDEEtrXwHOyWZtxz
3360
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\1.dll,hCiqpuSQApFEnvlRXbDqEkrbREsM
3600

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (21 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 29, 2021, 4:24 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:24 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:24 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:24 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:25 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:24 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:24 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:25 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:24 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:25 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:25 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:25 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:27 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:25 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:26 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:25 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:26 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:26 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:26 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:26 p.m.			0	0
IsDebuggerPresent Sept. 29, 2021, 4:27 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

F:\kT2Knmpk\SiVr6yPD\nP4VFkE0LHR8\UKo4b64g\c6CaPPLYt8dl\PSQ2Q\jcYwYQqc\O28E\z2GjofxUl9\KR\13lCzXnT.pdb

Allocates read-write-execute memory (usually to unpack itself) (50 out of 157 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:25 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:25 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:25 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:25 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:25 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:25 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 4:24 p.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a04000 process_handle: 0xffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\cmd.exe

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

Cyren	W32/Injector.ALP.gen!Eldorado
ESET-NOD32	a variant of Win32/Kryptik.HMQJ
Cynet	Malicious (score: 100)

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 29, 2021, 4:27 p.m.	status_code: 0x00000000 process_identifier: 3420 process_handle: 0x000000fc		0	0
NtTerminateProcess Sept. 29, 2021, 4:27 p.m.	status_code: 0x00000000 process_identifier: 3420 process_handle: 0x000000fc	1	0	0

1.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All