Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 19, 2023, 10:29 a.m.	May 19, 2023, 10:31 a.m.

Size	9.8KB
Type	C++ source, ASCII text, with CRLF line terminators
MD5	`81424820bdf139b1fe3de3faa4e98ae6`
SHA256	`514cd71508ca9b3f35afe09a943e97c547e9caeda12cd9083b1d3982068d692b`
CRC32	`E3487B3E`
ssdeep	`192:BQiSRKxM+2lboe/eFlFN9qoJLlFobU2pf6kXP:BQik68lpx`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\runlastrun.ps1
1680
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\_e5azbew.cmdline"
  2112
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESC5CC.tmp" "c:\Users\test22\AppData\Local\Temp\CSCC5BC.tmp"
    2180

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (25 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\runlastrun.ps1:237 char:28 console_handle: 0x00000047	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + $Response=Invoke-WebRequest <<<< -Method GET -Uri $URI -UseBasicParsing console_handle: 0x00000053	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x0000005f	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: ommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: Exception calling "Decompress" with "1" argument(s): "Object reference not set console_handle: 0x0000009f	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: to an instance of an object." console_handle: 0x000000ab	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\runlastrun.ps1:241 char:49 console_handle: 0x000000b7	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + $decompress_bytes = [gs.SafeQuickLZ]::Decompress <<<< ($bytes) console_handle: 0x000000c3	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000000cf	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x000000db	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: Multiple ambiguous overloads found for "Load" and the argument count: "1". console_handle: 0x00000023	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\runlastrun.ps1:242 char:47 console_handle: 0x0000002f	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + $assembly = [System.Reflection.Assembly]::Load <<<< ($decompress_bytes) console_handle: 0x0000003b	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodException console_handle: 0x00000047	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + FullyQualifiedErrorId : MethodCountCouldNotFindBest console_handle: 0x00000053	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: You cannot call a method on a null-valued expression. console_handle: 0x00000073	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\runlastrun.ps1:243 char:37 console_handle: 0x0000007f	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + foreach ($type in $assembly.GetTypes <<<< ()) console_handle: 0x0000008b	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + CategoryInfo : InvalidOperation: (GetTypes:String) [], RuntimeE console_handle: 0x00000097	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: xception console_handle: 0x000000a3	1	1
WriteConsoleW May 19, 2023, 7:41 a.m.	buffer: + FullyQualifiedErrorId : InvokeMethodOnNull console_handle: 0x000000af	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 52 events)

Time & API	Arguments	Status	Return
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e74070 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5e90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5ed0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5f10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 19, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b5d90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 19, 2023, 7:41 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 19, 2023, 7:41 a.m.	stacktrace: 0x5240e3e system+0x1318d0 @ 0x715e18d0 system+0x13136d @ 0x715e136d system+0x131277 @ 0x715e1277 system+0x130fda @ 0x715e0fda system+0x130f91 @ 0x715e0f91 system+0x130a6f @ 0x715e0a6f system+0x13091e @ 0x715e091e system+0x14c562 @ 0x715fc562 system+0x19a8c2 @ 0x7164a8c2 system+0x19a79e @ 0x7164a79e system+0x19a6b1 @ 0x7164a6b1 system+0x19a4bf @ 0x7164a4bf system+0x198a79 @ 0x71648a79 system+0x19861c @ 0x7164861c system+0x18d1fe @ 0x7163d1fe system+0x193c2f @ 0x71643c2f system+0x193b12 @ 0x71643b12 system+0x18fe09 @ 0x7163fe09 system+0x18f8c7 @ 0x7163f8c7 mscorlib+0x216e76 @ 0x726e6e76 mscorlib+0x2202ff @ 0x726f02ff mscorlib+0x216df4 @ 0x726e6df4 CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72fd1b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x72fe8dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x72ff6a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x72ff6a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x72ff6a7d DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x73073191 CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x7302192f CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x730218cb CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x730217f1 CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x7302197d DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x73072f62 DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7307303c GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x7313805a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 83 78 04 00 0f 95 c0 0f b6 c0 89 45 c0 83 7d c0 exception.instruction: cmp dword ptr [eax + 4], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x60400f5 registers.esp: 99020228 registers.edi: 51264204 registers.eax: 0 registers.ebp: 99020384 registers.edx: 0 registers.ebx: 1 registers.esi: 52678040 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 19, 2023, 7:41 a.m.

stacktrace:

0x5240e3e
system+0x1318d0 @ 0x715e18d0
system+0x13136d @ 0x715e136d
system+0x131277 @ 0x715e1277
system+0x130fda @ 0x715e0fda
system+0x130f91 @ 0x715e0f91
system+0x130a6f @ 0x715e0a6f
system+0x13091e @ 0x715e091e
system+0x14c562 @ 0x715fc562
system+0x19a8c2 @ 0x7164a8c2
system+0x19a79e @ 0x7164a79e
system+0x19a6b1 @ 0x7164a6b1
system+0x19a4bf @ 0x7164a4bf
system+0x198a79 @ 0x71648a79
system+0x19861c @ 0x7164861c
system+0x18d1fe @ 0x7163d1fe
system+0x193c2f @ 0x71643c2f
system+0x193b12 @ 0x71643b12
system+0x18fe09 @ 0x7163fe09
system+0x18f8c7 @ 0x7163f8c7
mscorlib+0x216e76 @ 0x726e6e76
mscorlib+0x2202ff @ 0x726f02ff
mscorlib+0x216df4 @ 0x726e6df4
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72fd1b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x72fe8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x72ff6a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x72ff6a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x72ff6a7d
DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x73073191
CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x7302192f
CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x730218cb
CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x730217f1
CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x7302197d
DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x73072f62
DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7307303c
GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x7313805a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 83 78 04 00 0f 95 c0 0f b6 c0 89 45 c0 83 7d c0
exception.instruction: cmp dword ptr [eax + 4], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x60400f5
registers.esp: 99020228
registers.edi: 51264204
registers.eax: 0
registers.ebp: 99020384
registers.edx: 0
registers.ebx: 1
registers.esi: 52678040
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 89 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05430000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x061c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05434000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05435000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05436000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05437000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05438000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05256000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05257000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05258000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05259000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0525a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0525b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0525c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0525d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0525e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0525f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fcd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fcf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2023, 7:41 a.m.	process_identifier: 1680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fd7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	c:\Users\test22\AppData\Local\Temp\_e5azbew.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\_e5azbew.dll

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

ESET-NOD32	PowerShell/TrojanDownloader.Agent.GPA
Avast	Script:SNH-gen [Trj]
Tencent	Win32.Trojan-Downloader.Downloader.Rwhl
McAfee-GW-Edition	Artemis!Trojan
Google	Detected
Rising	Downloader.Agent/PS!8.1250D (TOPIS:E0:fYmA5nldMPD)
Ikarus	Trojan-Downloader.PowerShell.Agent
AVG	Script:SNH-gen [Trj]

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\_e5azbew.cmdline"

Deletes executed files from disk (2 events)

file	c:\Users\test22\AppData\Local\Temp\CSCC5BC.tmp
file	C:\Users\test22\AppData\Local\Temp\RESC5CC.tmp

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\_e5azbew.cmdline"

runlastrun.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All