Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 12, 2023, 8:36 a.m.	June 12, 2023, 8:38 a.m.

Size	254.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`63585f2e36f932a92014e4c6f95fd74d`
SHA256	`fcfa6d90c34693b61a6ac6879176a67597e003ab433e131a82b6befa5e8c1e75`
CRC32	`2EC42C6C`
ssdeep	`6144:6B/MHi3tcfAA4hqtjRR5iZxyMK9PTBYdqCU4MN:6BUC36TVmZxyMK9PTq`
PDB Path	C:\Users\è°·å \Desktop\2022è¿ç¨ç®¡çgfi\cangku\WinOsClientProject\Release\ä¸çº¿æ¨¡å.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library anti_vm_detect - Possibly employs anti-virtualization techniques Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Antivirus - Contains references to security software IsPE32 - (no description) Generic_Malware_Zero - Generic Malware

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,SignalChromeElf
1532
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,Version
2068
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,GetInstallDetailsPayload
1688
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,load
2164
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,run
2260
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\output_32.dll,
2380

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
193.134.208.217	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 12, 2023, 8:36 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:36 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:36 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:36 a.m.			0	0
IsDebuggerPresent June 12, 2023, 8:36 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\è°·å \Desktop\2022è¿ç¨ç®¡çgfi\cangku\WinOsClientProject\Release\ä¸çº¿æ¨¡å.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 12, 2023, 8:36 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 90 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7449b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74380000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74311000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ed1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7449b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74380000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7449b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74380000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74351000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74311000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ed1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ec1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 12, 2023, 8:36 a.m.	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d71000 process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

A process attempted to delay the analysis task. (1 event)

description

rundll32.exe tried to sleep 590 seconds, actually delayed analysis time by 590 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW June 12, 2023, 8:36 a.m.	total_number_of_free_bytes: 9934692352 free_bytes_available: 9934692352 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW June 12, 2023, 8:36 a.m.	total_number_of_free_bytes: 9934692352 free_bytes_available: 9934692352 root_path: C:\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW June 12, 2023, 8:36 a.m.	total_number_of_free_bytes: 9934692352 free_bytes_available: 9934692352 root_path: C:\ total_number_of_bytes: 34252779520	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (12 events)

Time & API	Arguments	Status	Return
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: pw.exe process_identifier: 1712	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: taskhost.exe process_identifier: 1944	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: SearchProtocolHost.exe process_identifier: 1932	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: SearchFilterHost.exe process_identifier: 1256	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: rundll32.exe process_identifier: 1688	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: rundll32.exe process_identifier: 1532	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: rundll32.exe process_identifier: 2164	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: rundll32.exe process_identifier: 2260	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: svchost.exe process_identifier: 2676	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: mscorsvw.exe process_identifier: 2720	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: mscorsvw.exe process_identifier: 2748	1	1
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796	1	1

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 108 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x000002f4 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000310 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0
Process32NextW June 12, 2023, 8:36 a.m.	snapshot_handle: 0x00000354 process_name: sppsvc.exe process_identifier: 2796		0	0

Communicates with host for which no DNS query was performed (1 event)

host

193.134.208.217

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

193.134.208.217:6000

output_32.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All