Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 8, 2021, 4:49 p.m.	Oct. 8, 2021, 4:51 p.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`21d3a09d6c4451c6e326a5361ecb290f`
SHA256	`4b8143fc8d8d9ffc0efdc2eaf1e66a15c3ff56cd7e53429083f5fb908f5b9c67`
CRC32	`BFAEEAA2`
ssdeep	`12288:0a+04DyL9pD3n+0Sape4q4xAceA8svAuzlh5AKutVZPl:3c+L7D3+1+dqIAtJDuxXAptVJl`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) NPKI_Zero - File included NPKI

mavzx.exe "C:\Users\test22\AppData\Local\Temp\mavzx.exe"
620

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 8, 2021, 4:48 p.m.			0	0
IsDebuggerPresent Oct. 8, 2021, 4:48 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 8, 2021, 4:48 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (29 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:48 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72142000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 8, 2021, 4:49 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2932 process_handle: 0x000002a4
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2932 process_handle: 0x000002a4	1
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 1808 process_handle: 0x000002dc
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 1808 process_handle: 0x000002dc	1
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2724 process_handle: 0x000002a0
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2724 process_handle: 0x000002a0	1
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2656 process_handle: 0x000002c8
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2656 process_handle: 0x000002c8	1
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2472 process_handle: 0x000002e0
NtTerminateProcess Oct. 8, 2021, 4:49 p.m.	status_code: 0xffffffff process_identifier: 2472 process_handle: 0x000002e0	1

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2932 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0	3221225496
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1808 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8	3221225496
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2724 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec	3221225496
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2656 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c4	3221225496
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2472 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000290	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 620 manipulating memory of non-child process 2932
Process injection	Process 620 manipulating memory of non-child process 1808
Process injection	Process 620 manipulating memory of non-child process 2724
Process injection	Process 620 manipulating memory of non-child process 2656
Process injection	Process 620 manipulating memory of non-child process 2472
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2932 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0	3221225496	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1808 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8	3221225496	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2724 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec	3221225496	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2656 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c4	3221225496	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2472 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000290	3221225496	0

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Elastic	malicious (high confidence)
Cybereason	malicious.e1e7d9
Cyren	W32/MSIL_Kryptik.FUW.gen!Eldorado
Symantec	Scr.Malcode!gdn30
ESET-NOD32	a variant of MSIL/Kryptik.ADBG
APEX	Malicious
Paloalto	generic.ml
Kaspersky	VHO:Backdoor.MSIL.Androm.gen
DrWeb	BackDoor.SpyBotNET.25
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tm
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_93%
Fortinet	MSIL/GenKryptik.FLPG!tr
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 8, 2021, 4:48 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 620	1	0
NtResumeThread Oct. 8, 2021, 4:48 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 620	1	0
NtResumeThread Oct. 8, 2021, 4:48 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 620	1	0
CreateProcessInternalW Oct. 8, 2021, 4:49 p.m.	thread_identifier: 2672 thread_handle: 0x000002d8 process_identifier: 2932 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mavzx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\mavzx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002c0	1	1
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000002d8	1	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2932 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c0		3221225496
CreateProcessInternalW Oct. 8, 2021, 4:49 p.m.	thread_identifier: 2408 thread_handle: 0x000002a4 process_identifier: 1808 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mavzx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\mavzx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002e8	1	1
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000002a4	1	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1808 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8		3221225496
CreateProcessInternalW Oct. 8, 2021, 4:49 p.m.	thread_identifier: 2200 thread_handle: 0x000002dc process_identifier: 2724 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mavzx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\mavzx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002ec	1	1
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000002dc	1	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2724 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec		3221225496
CreateProcessInternalW Oct. 8, 2021, 4:49 p.m.	thread_identifier: 2832 thread_handle: 0x000002a0 process_identifier: 2656 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mavzx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\mavzx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002c4	1	1
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000002a0	1	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2656 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c4		3221225496
CreateProcessInternalW Oct. 8, 2021, 4:49 p.m.	thread_identifier: 2000 thread_handle: 0x000002c8 process_identifier: 2472 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\mavzx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\mavzx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000290	1	1
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000002c8	1	0
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 2472 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000290		3221225496

mavzx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All