Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 29, 2021, 6:17 p.m.	Oct. 29, 2021, 6:20 p.m.

Size	503.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5273a14914db4656593872056f2ced12`
SHA256	`b2663af445ff18476795d3462841a45488a9f2fd53c92d0c798e2e24892e10ae`
CRC32	`7D6AFAE9`
ssdeep	`12288:m0ZSD/e3bUmyXtX53Q9Ny7T+jL4o1xrxuD9D3a8Z:IDwmA9U3yL/sD9DK8Z`
PDB Path	TokenTy.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

rundll32.exe "C:\Users\test22\AppData\Local\Temp\rundll32.exe"
1892

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 29, 2021, 6:17 p.m.			0	0
IsDebuggerPresent Oct. 29, 2021, 6:17 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

TokenTy.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 29, 2021, 6:17 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74162000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74092000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a3b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a52000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738ea000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x708d1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00881000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70721000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00883000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:17 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ff71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00884000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00885000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00886000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fd21000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0007ce00', u'virtual_address': u'0x00002000', u'entropy': 7.605854140405367, u'name': u'.text', u'virtual_size': u'0x0007cc44'}

entropy

7.60585414041

description

A section with a high entropy has been found

entropy

0.994029850746

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 29, 2021, 6:18 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2736 process_handle: 0x00000290
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2736 process_handle: 0x00000290	1
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 3064 process_handle: 0x0000029c
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 3064 process_handle: 0x0000029c	1
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2756 process_handle: 0x000002a4
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2756 process_handle: 0x000002a4	1
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2368 process_handle: 0x000002ac
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2368 process_handle: 0x000002ac	1
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2412 process_handle: 0x000002b4
NtTerminateProcess Oct. 29, 2021, 6:18 p.m.	status_code: 0xffffffff process_identifier: 2412 process_handle: 0x000002b4	1

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2736 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280	3221225496
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 3064 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294	3221225496
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2756 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000298	3221225496
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2368 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a0	3221225496
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2412 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1892 manipulating memory of non-child process 2736
Process injection	Process 1892 manipulating memory of non-child process 3064
Process injection	Process 1892 manipulating memory of non-child process 2756
Process injection	Process 1892 manipulating memory of non-child process 2368
Process injection	Process 1892 manipulating memory of non-child process 2412
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2736 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280	3221225496	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 3064 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294	3221225496	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2756 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000298	3221225496	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2368 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a0	3221225496	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2412 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8	3221225496	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Symantec	Scr.Malcode!gdn30
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
FireEye	Generic.mg.5273a14914db4656
SentinelOne	Static AI - Malicious PE
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
McAfee	Artemis!5273A14914DB
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34236.Fq0@a4ROhZb
CrowdStrike	win/malicious_confidence_90% (W)

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 29, 2021, 6:17 p.m.	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 1892	1	0
NtResumeThread Oct. 29, 2021, 6:17 p.m.	thread_handle: 0x000001b4 suspend_count: 1 process_identifier: 1892	1	0
NtResumeThread Oct. 29, 2021, 6:17 p.m.	thread_handle: 0x00000204 suspend_count: 1 process_identifier: 1892	1	0
CreateProcessInternalW Oct. 29, 2021, 6:18 p.m.	thread_identifier: 2732 thread_handle: 0x00000274 process_identifier: 2736 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\rundll32.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\rundll32.exe stack_pivoted: 0 creation_flags: 134742020 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000280	1	1
NtGetContextThread Oct. 29, 2021, 6:18 p.m.	thread_handle: 0x00000274	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2736 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000280		3221225496
CreateProcessInternalW Oct. 29, 2021, 6:18 p.m.	thread_identifier: 2712 thread_handle: 0x00000290 process_identifier: 3064 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\rundll32.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\rundll32.exe stack_pivoted: 0 creation_flags: 134742020 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000294	1	1
NtGetContextThread Oct. 29, 2021, 6:18 p.m.	thread_handle: 0x00000290	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 3064 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000294		3221225496
CreateProcessInternalW Oct. 29, 2021, 6:18 p.m.	thread_identifier: 2764 thread_handle: 0x0000029c process_identifier: 2756 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\rundll32.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\rundll32.exe stack_pivoted: 0 creation_flags: 134742020 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000298	1	1
NtGetContextThread Oct. 29, 2021, 6:18 p.m.	thread_handle: 0x0000029c	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2756 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000298		3221225496
CreateProcessInternalW Oct. 29, 2021, 6:18 p.m.	thread_identifier: 1268 thread_handle: 0x000002a4 process_identifier: 2368 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\rundll32.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\rundll32.exe stack_pivoted: 0 creation_flags: 134742020 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a0	1	1
NtGetContextThread Oct. 29, 2021, 6:18 p.m.	thread_handle: 0x000002a4	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2368 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a0		3221225496
CreateProcessInternalW Oct. 29, 2021, 6:18 p.m.	thread_identifier: 2408 thread_handle: 0x000002ac process_identifier: 2412 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\rundll32.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\rundll32.exe stack_pivoted: 0 creation_flags: 134742020 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a8	1	1
NtGetContextThread Oct. 29, 2021, 6:18 p.m.	thread_handle: 0x000002ac	1	0
NtAllocateVirtualMemory Oct. 29, 2021, 6:18 p.m.	process_identifier: 2412 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002a8		3221225496

rundll32.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All