Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 7, 2023, 6:24 p.m.	July 7, 2023, 6:26 p.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`876283f1527fa588ad861dc2b6cc1b08`
SHA256	`a099a79fb63215ee05064ffaf9fdbdc3b624f7738e7d2140078cc7bcbd81d19a`
CRC32	`AF933C18`
ssdeep	`24576:iYVeGFNjhp+qJBzrYW9pivo5gG3xIFzADL78rFtNxm1R+H2AkfhwXlpQ:iElNf+qn/9pLV8zi7qFHxmn+tia`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

Evolion%20Launcher.exe "C:\Users\test22\AppData\Local\Temp\Evolion%20Launcher.exe"
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 7, 2023, 6:24 p.m.			0	0
IsDebuggerPresent July 7, 2023, 6:24 p.m.			0	0
IsDebuggerPresent July 7, 2023, 6:24 p.m.			0	0
IsDebuggerPresent July 7, 2023, 6:24 p.m.			0	0
IsDebuggerPresent July 7, 2023, 6:24 p.m.			0	0
IsDebuggerPresent July 7, 2023, 6:24 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (48 events)

Time & API	Arguments	Status	Return
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004610e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004610e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004610e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004610e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461060 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004610e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461120 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461120 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461120 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004611e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004611a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004611a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004614a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004614a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461220 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461720 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004615e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004615a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004612a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00461560 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004614e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbbe0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbc60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbce0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbd60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbd60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbd60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbe60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dbd20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dc160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dc160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dc2a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dc2a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dc160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 7, 2023, 6:24 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004dc160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 7, 2023, 6:24 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 54 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7363b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02300000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ed71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ed4e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7331b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ebca000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9b4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ea82000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e7c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e5f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73111000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb11000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00911000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00915000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00926000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 7, 2023, 6:24 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dc51000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00147200', u'virtual_address': u'0x00002000', u'entropy': 7.9894301782786625, u'name': u'.text', u'virtual_size': u'0x00147090'}

entropy

7.98943017828

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00007800', u'virtual_address': u'0x0014a000', u'entropy': 7.840273732538471, u'name': u'.rsrc', u'virtual_size': u'0x0000764c'}

entropy

7.84027373254

description

A section with a high entropy has been found

entropy

0.999626587005

description

Overall entropy of this PE file is high

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

MicroWorld-eScan	Gen:Variant.Lazy.330171
FireEye	Gen:Variant.Lazy.330171
VIPRE	Gen:Variant.Lazy.330171
Cynet	Malicious (score: 100)
Arcabit	Trojan.Lazy.D509BB
Elastic	malicious (high confidence)
APEX	Malicious
BitDefender	Gen:Variant.Lazy.330171
Emsisoft	Gen:Variant.Lazy.330171 (B)
GData	Gen:Variant.Lazy.330171
BitDefenderTheta	Gen:NN.ZemsilF.36302.tn0@aimXmng
ALYac	Gen:Variant.Lazy.330171
MAX	malware (ai score=80)
VBA32	Downloader.MSIL.Pabin.Heur
SentinelOne	Static AI - Suspicious PE
CrowdStrike	win/malicious_confidence_100% (W)

Evolion%20Launcher.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All