Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 3, 2023, 9:31 a.m.	May 3, 2023, 9:39 a.m.

Size	5.7MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`1c87be3086b35f72e87666036310df86`
SHA256	`3278651feaa6ef551f129a85d9e530f693a5dbf91b900024ee7533eff03efd38`
CRC32	`D902738E`
ssdeep	`49152:qbjVOzG9vosBswUBzcIDd85mSCDrCp6/J2BAHh4w96Y/lprU3mP4VnsQeuRGIAhk:ajJ9vosBQ/d85m9D+6/kBtt+88hHE`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library Generic_Malware_Zero - Generic Malware

v1.exe "C:\Users\test22\AppData\Local\Temp\v1.exe"
2576

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.themida

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d v1+0x51fe20 @ 0x184fe20 v1+0x51fdeb @ 0x184fdeb HeapWalk-0x1ce0 kernel32+0x0 @ 0x76c10000 0x1cf9f8 0x1cf9f8 0x1cf9f8 SetProcessShutdownParameters+0xa0 BaseGetProcessExePath-0x70 kernelbase+0x16460 @ 0x7fefd506460 v1+0x35937c @ 0x168937c 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa 0x23c1a076d814aa exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 42141 exception.address: 0x7fefd4fa49d registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 1994472144 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899024 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1899032 registers.rdi: 21610496 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2 @ 0x76d80bd2 exception.instruction_r: 48 cf 48 83 ec 30 4c 8b c4 48 81 ec d0 04 00 00 exception.symbol: RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2 exception.instruction: iretq exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 330706 exception.address: 0x76d80bd2 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1
__exception__ May 3, 2023, 9:24 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1897200 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1899112 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1996142187 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 2737 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000010000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000011000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000012000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000013000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000014000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000015000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000016000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000017000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000018000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000019000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000001a000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000001b000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000001c000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000001d000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000001e000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000001f000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000020000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000021000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000022000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000023000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000024000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000025000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000026000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000027000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000028000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000029000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000002a000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000002b000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000002c000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000002d000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000002e000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000002f000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000030000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000031000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000032000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000033000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000034000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000035000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000036000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000037000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000038000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000039000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000003a000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000003b000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000003c000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000003d000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000003e000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000003f000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000040000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000041000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800

Foreign language identified in PE resource (3 events)

name

RT_MENU

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x001681cc

size

0x00000308

name

RT_MENU

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x001681cc

size

0x00000308

name

RT_VERSION

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00168514

size

0x00000300

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00147000', u'virtual_address': u'0x00002000', u'entropy': 7.39852535402304, u'name': u'.text', u'virtual_size': u'0x00148000'}

entropy

7.39852535402

description

A section with a high entropy has been found

entropy

0.224183734682

description

Overall entropy of this PE file is high

DEP was bypassed by marking part of the stack executable by the process v1.exe (8 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001cc000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001cd000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001ce000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001cf000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001cc000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001cd000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001ce000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory May 3, 2023, 9:24 a.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000001cf000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ May 3, 2023, 9:24 a.m.	tid: 2580 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.Lazy.4!c
MicroWorld-eScan	Gen:Variant.Lazy.333237
FireEye	Generic.mg.1c87be3086b35f72
ALYac	Gen:Variant.Lazy.333237
Cylance	unsafe
VIPRE	Gen:Variant.Lazy.333237
Sangfor	Trojan.Win32.Agent.Vx9r
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Trojan.Lazy.D515B5
Elastic	malicious (high confidence)
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Lazy.333237
Avast	Win64:Evo-gen [Trj]
Emsisoft	Gen:Variant.Lazy.333237 (B)
TrendMicro	Trojan.Win64.PRIVATELOADER.YXDEBZ
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Generic
Gridinsoft	Spy.Win64.Vidar.bot
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Lazy.333237
Google	Detected
McAfee	Artemis!1C87BE3086B3
MAX	malware (ai score=85)
Malwarebytes	Spyware.Vidar
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win64.PRIVATELOADER.YXDEBZ
Rising	Trojan.Vidar!8.114A8 (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
AVG	Win64:Evo-gen [Trj]
DeepInstinct	MALICIOUS

v1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All