Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 6, 2023, 3:45 p.m.	July 6, 2023, 3:47 p.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cadf44b7edefc154b772ab4000d7f694`
SHA256	`c86ee2b39cc8a546a7b68127ee2a8c34c69be120dfbb4fe1e6cd5df5caa96246`
CRC32	`685B6EDF`
ssdeep	`49152:mDkUrjJgqYlkYsMhpAmijDNbHxT4GGbxwD:m4U6qxy9iHtRT4GQxi`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

setup294.exe "C:\Users\test22\AppData\Local\Temp\setup294.exe"
2556
- control.exe "C:\Windows\System32\control.exe" "C:\Users\test22\AppData\Local\Temp\a6Bo6OWP.cPL",
  2660
  - rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\test22\AppData\Local\Temp\a6Bo6OWP.cPL",
    2748
    - rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\test22\AppData\Local\Temp\a6Bo6OWP.cPL",
      2796
      - rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\test22\AppData\Local\Temp\a6Bo6OWP.cPL",
        2840

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 6, 2023, 3:45 p.m.			0	0
IsDebuggerPresent July 6, 2023, 3:45 p.m.			0	0
IsDebuggerPresent July 6, 2023, 3:45 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didat

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 6, 2023, 3:45 p.m.	stacktrace: LdrQueryImageFileKeyOption+0x290 LdrOpenImageFileOptionsKey-0x326 ntdll+0x63262 @ 0x76f73262 LdrQueryImageFileKeyOption+0xe0 LdrOpenImageFileOptionsKey-0x4d6 ntdll+0x630b2 @ 0x76f730b2 LdrResSearchResource+0xaa0 LdrResFindResourceDirectory-0x219 ntdll+0x3d7fc @ 0x76f4d7fc LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x76f4d76c LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x76f4c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7355d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x75981d2a LoadLibraryW+0x11 GetModuleFileNameW-0x14 kernel32+0x1493c @ 0x755c493c Options_RunDLLW+0xba56 SHCreatePropSheetExtArray-0x26a3 shell32+0xd73ed @ 0x748f73ed Options_RunDLLW+0xbee5 SHCreatePropSheetExtArray-0x2214 shell32+0xd787c @ 0x748f787c Control_RunDLLW+0x213 FreeIconList-0x36ef shell32+0xda0a8 @ 0x748fa0a8 Control_RunDLLW+0x2b FreeIconList-0x38d7 shell32+0xd9ec0 @ 0x748f9ec0 rundll32+0x137d @ 0xfc137d rundll32+0x1326 @ 0xfc1326 rundll32+0x1901 @ 0xfc1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8a 26 0a e4 8a 07 74 27 0a c0 74 23 83 c6 01 83 exception.symbol: _strnicmp+0x5f RtlSetLastWin32ErrorAndNtStatusFromNtStatus-0x473 ntdll+0x5c2db exception.instruction: mov ah, byte ptr [esi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 377563 exception.address: 0x76f6c2db registers.esp: 3072332 registers.edi: 1995646602 registers.eax: 2057442977 registers.ebp: 3072344 registers.edx: 8192 registers.ebx: 16730 registers.esi: 2057442977 registers.ecx: 12	1	0	0
__exception__ July 6, 2023, 3:45 p.m.	stacktrace: LdrQueryImageFileKeyOption+0x290 LdrOpenImageFileOptionsKey-0x326 ntdll+0x63262 @ 0x76f73262 LdrQueryImageFileKeyOption+0xe0 LdrOpenImageFileOptionsKey-0x4d6 ntdll+0x630b2 @ 0x76f730b2 LdrResSearchResource+0xaa0 LdrResFindResourceDirectory-0x219 ntdll+0x3d7fc @ 0x76f4d7fc LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x76f4d76c LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x76f4c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7355d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x75981d2a LoadLibraryW+0x11 GetModuleFileNameW-0x14 kernel32+0x1493c @ 0x755c493c Options_RunDLLW+0xba56 SHCreatePropSheetExtArray-0x26a3 shell32+0xd73ed @ 0x748f73ed Options_RunDLLW+0xbee5 SHCreatePropSheetExtArray-0x2214 shell32+0xd787c @ 0x748f787c Control_RunDLLW+0x213 FreeIconList-0x36ef shell32+0xda0a8 @ 0x748fa0a8 GetCurrentProcessExplicitAppUserModelID+0xb03 Control_RunDLLAsUserW-0x9 shell32+0x23563e @ 0x74a5563e rundll32+0x137d @ 0xfc137d rundll32+0x1326 @ 0xfc1326 rundll32+0x1901 @ 0xfc1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8a 26 0a e4 8a 07 74 27 0a c0 74 23 83 c6 01 83 exception.symbol: _strnicmp+0x5f RtlSetLastWin32ErrorAndNtStatusFromNtStatus-0x473 ntdll+0x5c2db exception.instruction: mov ah, byte ptr [esi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 377563 exception.address: 0x76f6c2db registers.esp: 2353620 registers.edi: 1995646602 registers.eax: 2081953441 registers.ebp: 2353632 registers.edx: 8192 registers.ebx: 16730 registers.esi: 2081953441 registers.ecx: 12	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 6, 2023, 3:45 p.m.

stacktrace:

LdrQueryImageFileKeyOption+0x290 LdrOpenImageFileOptionsKey-0x326 ntdll+0x63262 @ 0x76f73262
LdrQueryImageFileKeyOption+0xe0 LdrOpenImageFileOptionsKey-0x4d6 ntdll+0x630b2 @ 0x76f730b2
LdrResSearchResource+0xaa0 LdrResFindResourceDirectory-0x219 ntdll+0x3d7fc @ 0x76f4d7fc
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x76f4d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x76f4c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7355d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x75981d2a
LoadLibraryW+0x11 GetModuleFileNameW-0x14 kernel32+0x1493c @ 0x755c493c
Options_RunDLLW+0xba56 SHCreatePropSheetExtArray-0x26a3 shell32+0xd73ed @ 0x748f73ed
Options_RunDLLW+0xbee5 SHCreatePropSheetExtArray-0x2214 shell32+0xd787c @ 0x748f787c
Control_RunDLLW+0x213 FreeIconList-0x36ef shell32+0xda0a8 @ 0x748fa0a8
Control_RunDLLW+0x2b FreeIconList-0x38d7 shell32+0xd9ec0 @ 0x748f9ec0
rundll32+0x137d @ 0xfc137d
rundll32+0x1326 @ 0xfc1326
rundll32+0x1901 @ 0xfc1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8a 26 0a e4 8a 07 74 27 0a c0 74 23 83 c6 01 83
exception.symbol: _strnicmp+0x5f RtlSetLastWin32ErrorAndNtStatusFromNtStatus-0x473 ntdll+0x5c2db
exception.instruction: mov ah, byte ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 377563
exception.address: 0x76f6c2db
registers.esp: 3072332
registers.edi: 1995646602
registers.eax: 2057442977
registers.ebp: 3072344
registers.edx: 8192
registers.ebx: 16730
registers.esi: 2057442977
registers.ecx: 12

__exception__

July 6, 2023, 3:45 p.m.

stacktrace:

LdrQueryImageFileKeyOption+0x290 LdrOpenImageFileOptionsKey-0x326 ntdll+0x63262 @ 0x76f73262
LdrQueryImageFileKeyOption+0xe0 LdrOpenImageFileOptionsKey-0x4d6 ntdll+0x630b2 @ 0x76f730b2
LdrResSearchResource+0xaa0 LdrResFindResourceDirectory-0x219 ntdll+0x3d7fc @ 0x76f4d7fc
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x76f4d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x76f4c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7355d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x75981d2a
LoadLibraryW+0x11 GetModuleFileNameW-0x14 kernel32+0x1493c @ 0x755c493c
Options_RunDLLW+0xba56 SHCreatePropSheetExtArray-0x26a3 shell32+0xd73ed @ 0x748f73ed
Options_RunDLLW+0xbee5 SHCreatePropSheetExtArray-0x2214 shell32+0xd787c @ 0x748f787c
Control_RunDLLW+0x213 FreeIconList-0x36ef shell32+0xda0a8 @ 0x748fa0a8
GetCurrentProcessExplicitAppUserModelID+0xb03 Control_RunDLLAsUserW-0x9 shell32+0x23563e @ 0x74a5563e
rundll32+0x137d @ 0xfc137d
rundll32+0x1326 @ 0xfc1326
rundll32+0x1901 @ 0xfc1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8a 26 0a e4 8a 07 74 27 0a c0 74 23 83 c6 01 83
exception.symbol: _strnicmp+0x5f RtlSetLastWin32ErrorAndNtStatusFromNtStatus-0x473 ntdll+0x5c2db
exception.instruction: mov ah, byte ptr [esi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 377563
exception.address: 0x76f6c2db
registers.esp: 2353620
registers.edi: 1995646602
registers.eax: 2081953441
registers.ebp: 2353632
registers.edx: 8192
registers.ebx: 16730
registers.esi: 2081953441
registers.ecx: 12

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74150000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d24000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ef3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74150000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d24000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02653000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75511000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 6, 2023, 3:45 p.m.	process_identifier: 2840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72801000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\a6bo6oWP.cpl

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\a6bo6oWP.cpl

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\a6bo6oWP.cpl

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2556 resumed a thread in remote process 2660
NtResumeThread July 6, 2023, 3:45 p.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2660	1	0	0

setup294.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All