Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 17, 2023, 1:21 p.m.	July 17, 2023, 1:23 p.m.

Size	3.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`09ab5b40d8ea72b0fc02000284e22169`
SHA256	`257f4f173d326f1d6434afc11fa462d4b861e0ad078173f1642e02c7318255af`
CRC32	`89577BDA`
ssdeep	`98304:QaweQ/fMnA/uuR6NSfxSVFBq0TjgAgxdj2zAqg0VYu6T:QzPSA/uKO/TI12zAMwT`
PDB Path
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check MALWARE_Win_VT_RedLine - Detects RedLine infostealer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UltraVNC_Zero - UltraVNC IsPE32 - (no description)

an.exe "C:\Users\test22\AppData\Local\Temp\an.exe"
1740
- 1.exe "C:\Windows\Temp\1.exe"
  2160
certreq.exe "C:\Windows\system32\certreq.exe"
2364

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 17, 2023, 1:21 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 17, 2023, 1:21 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 17, 2023, 1:21 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 17, 2023, 1:21 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 17, 2023, 1:21 p.m.			0	0
IsDebuggerPresent July 17, 2023, 1:21 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (13 events)

Time & API	Arguments	Status	Return
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b860d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b860d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b86110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b86110 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b86210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b86210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b86210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b86210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b86210 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b862d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b862d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b862d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00b862d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 17, 2023, 1:21 p.m.		1	1	0

One or more processes crashed (50 out of 850 events)

Time & API	Arguments	Status
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: an+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350244 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 12	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4353968 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 27108	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4358064 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 27076	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4362160 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 27044	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4366256 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 27012	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4370352 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26980	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4374448 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26948	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4378544 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26916	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4382640 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26884	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4386736 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26852	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4390832 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26820	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4394928 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26788	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4399024 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26756	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4403120 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26724	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4407216 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26692	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4411312 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26660	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4415408 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26628	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4419504 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26596	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4423600 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26564	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4427696 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26532	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4431792 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26500	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4435888 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26468	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4439984 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26436	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4444080 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26404	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4448176 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26372	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4452272 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26340	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4456368 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26308	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4460464 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26276	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4464560 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26244	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4468656 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26212	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4472752 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26180	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4476848 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26148	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4480944 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26116	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4485040 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26084	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4489136 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26052	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4493232 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 26020	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4497328 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25988	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4501424 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25956	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4505520 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25924	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4509616 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25892	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4513712 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25860	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4517808 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25828	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4521904 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25796	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4526000 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25764	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4530096 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25732	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4534192 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25700	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4538288 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25668	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4542384 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25636	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4546480 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25604	1
__exception__ July 17, 2023, 1:21 p.m.	stacktrace: an+0xf054 @ 0x40f054 an+0xf0a0 @ 0x40f0a0 an+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: an+0xefff exception.address: 0x40efff exception.module: an.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4550576 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 107 registers.ebx: 0 registers.esi: 35651616 registers.ecx: 25572	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 55 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02cd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e2d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00916000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0091a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00917000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e2e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d75000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e4f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d76000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d77000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05d78000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 1740 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x060ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

1.exe tried to sleep 171 seconds, actually delayed analysis time by 171 seconds

Creates executable files on the filesystem (1 event)

file	C:\Windows\Temp\1.exe

Drops a binary and executes it (1 event)

file	C:\Windows\Temp\1.exe

Executes one or more WMI queries (1 event)

wmi	SELECT * FROM Win32_Processor

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 17, 2023, 1:21 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 28672 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02130000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00350800', u'virtual_address': u'0x00026000', u'entropy': 7.9999247548703485, u'name': u'.rsrc', u'virtual_size': u'0x00350794'}

entropy

7.99992475487

description

A section with a high entropy has been found

entropy

0.961745536979

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 17, 2023, 1:21 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Detects Avast Antivirus through the presence of a library (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetDllHandle July 17, 2023, 1:21 p.m.	module_name: snxhk.dll module_address: 0x00000000 stack_pivoted: 0		3221225781	0
LdrGetDllHandle July 17, 2023, 1:21 p.m.	module_name: snxhk.dll module_address: 0x00000000 stack_pivoted: 0		3221225781	0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
FireEye	Generic.mg.09ab5b40d8ea72b0
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.fc292f
BitDefenderTheta	Gen:NN.ZexaF.36318.Ct0@auMPq@
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.FRS
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	not-a-virus:VHO:RiskTool.Win32.BitCoinMiner.gen
F-Secure	Heuristic.HEUR/AGEN.1327060
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1327060
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	not-a-virus:VHO:RiskTool.Win32.BitCoinMiner.gen
Cylance	unsafe
Rising	Trojan.Generic@AI.99 (RDML:RyrOfRz0bYj4BbsXZWSe8Q)
MaxSecure	Trojan.Malware.300983.susgen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)

an.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All