Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 17, 2021, 8 a.m.	Nov. 17, 2021, 8:19 a.m.

Size	461.6KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`c276da8a99182e5a827024ee1fe1074e`
SHA256	`728443337cbea859758c80ee09fa0f47de9346b7e2dddf0e69c911f8aba2a74c`
CRC32	`0F5C47D7`
ssdeep	`6144:UYD2HJTwbR5aOPjZRS8muMnYrlsXnBmYSYCT0uBohlfX37GFuQ47bxoqGhz10Pub:UYxaOPrSMhrldYCzo3bFbeP1Gub`
Yara	Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,DllUnregisterServer
2416
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,DllUnregisterServer
  2752
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ServiceResume
2504
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ServiceResume
  2792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,DllRegisterServer
2328
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,DllRegisterServer
  2892
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ServiceSuspend
2596
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ServiceSuspend
  2932
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ajjttwdrhx
2692
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ajjttwdrhx
  3060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,aldiednw
2856
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,aldiednw
  2284
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,cjehjyqrvwwu
3052
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,cjehjyqrvwwu
  2552
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,cjsbkzwhilgeoxo
2412
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,cjsbkzwhilgeoxo
  2676
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,dfzhojx
2688
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,dfzhojx
  2204
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,fdxaaidqtas
2928
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,fdxaaidqtas
  2520
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ftreudcmbs
2364
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ftreudcmbs
  2116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,gcdejqtbubuh
2628
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,gcdejqtbubuh
  2484
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,gqqiyeoguo
2980
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,gqqiyeoguo
  2816
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,hyenoqhmbrua
2888
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,hyenoqhmbrua
  2824
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ihijiavixtn
2200
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ihijiavixtn
  2340
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ijzptiuzbhdogzk
2960
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ijzptiuzbhdogzk
  3272
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,jruqxbd
3172
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,jruqxbd
  3336
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,mobdsrvxjwftx
3368
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,mobdsrvxjwftx
  3488
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ncgbknudt
3500
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ncgbknudt
  3772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,otujoknwzuc
3644
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,otujoknwzuc
  3852
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,qkkpfbmpgkrix
3736
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,qkkpfbmpgkrix
  4024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,tizamkqejqjez
3892
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,tizamkqejqjez
  2952
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,vygplyhbhmp
4000
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,vygplyhbhmp
  3484
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,xbzuwlcjy
3084
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,xbzuwlcjy
  3460
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,xcvgbxauyammqayhq
3132
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,xcvgbxauyammqayhq
  3608
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ydekhkuxwmz
3340
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,ydekhkuxwmz
  3848
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\luko9.dll,
3792

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (26 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 7:53 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	REGISTRY
resource name	TYPELIB

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Nov. 17, 2021, 7:53 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 1998422456 registers.r15: 38956752 registers.rcx: 1997503120 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1997503120 registers.rsp: 2224920 registers.r11: 3277984 registers.r8: 64 registers.r9: 2225512 registers.rdx: 64 registers.r12: 1998414488 registers.rbp: 2225184 registers.rdi: 0 registers.rax: 0 registers.r13: 1998430392	1
__exception__ Nov. 17, 2021, 7:53 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 1998422456 registers.r15: 38825680 registers.rcx: 1997503120 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1997503120 registers.rsp: 2553144 registers.r11: 4003024 registers.r8: 64 registers.r9: 2553736 registers.rdx: 64 registers.r12: 1998414488 registers.rbp: 2553408 registers.rdi: 0 registers.rax: 0 registers.r13: 1998430392	1
__exception__ Nov. 17, 2021, 7:53 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 1998422456 registers.r15: 37908176 registers.rcx: 1997503120 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1997503120 registers.rsp: 1111832 registers.r11: 3343520 registers.r8: 64 registers.r9: 1112424 registers.rdx: 64 registers.r12: 1998414488 registers.rbp: 1112096 registers.rdi: 0 registers.rax: 0 registers.r13: 1998430392	1
__exception__ Nov. 17, 2021, 7:53 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 1998422456 registers.r15: 39153360 registers.rcx: 1997503120 registers.rsi: 0 registers.r10: 3221225715 registers.rbx: 1997503120 registers.rsp: 2028360 registers.r11: 4396224 registers.r8: 64 registers.r9: 2028952 registers.rdx: 64 registers.r12: 1998414488 registers.rbp: 2028624 registers.rdi: 0 registers.rax: 0 registers.r13: 1998430392	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 528 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 region_size: 102400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e25000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076daa000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e19000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076deb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dac000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d94000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d94000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d99000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076db2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076df1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076db1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076df2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e00000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dec000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076e1f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d92000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076deb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 17, 2021, 7:53 a.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076dda000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00014000', u'virtual_address': u'0x00064000', u'entropy': 7.652330961780087, u'name': u'.rsrc', u'virtual_size': u'0x00013e10'}

entropy

7.65233096178

description

A section with a high entropy has been found

luko9

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All