Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 17, 2023, 4:36 p.m.	July 17, 2023, 4:39 p.m.

Size	1.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e168038ddb8d3f31511af2dc0d5c4f04`
SHA256	`71cf66848d25787a84b362dd72318cf0b0b8061cdab732d3f19b6ea2770c94e4`
CRC32	`55D77F9B`
ssdeep	`49152:qkQTA8u/Fk2shGEna9j8iPYujGuiQf4vC18ZURyR46BziFfX:qaD/kkEa9j/Z5f4GcURyR46hiFv`
PDB Path
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check MALWARE_Win_VT_RedLine - Detects RedLine infostealer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UltraVNC_Zero - UltraVNC IsPE32 - (no description)

WhiteCrypt (1).exe "C:\Users\test22\AppData\Local\Temp\WhiteCrypt (1).exe"
3048

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 17, 2023, 4:37 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 17, 2023, 4:36 p.m.			0	0
IsDebuggerPresent July 17, 2023, 4:36 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey July 17, 2023, 4:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1348 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 4:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1348 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 4:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d3f18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 4:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d3f18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 4:36 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d3e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 17, 2023, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d3e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 17, 2023, 4:36 p.m.		1	1	0

One or more processes crashed (50 out of 455 events)

Time & API	Arguments	Status
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: whitecrypt (1)+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350172 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 4	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4354016 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14518	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4358112 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14486	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4362208 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14454	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4366304 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14422	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4370400 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14390	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4374496 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14358	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4378592 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14326	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4382688 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14294	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4386784 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14262	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4390880 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14230	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4394976 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14198	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4399072 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14166	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4403168 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14134	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4407264 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14102	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4411360 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14070	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4415456 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14038	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4419552 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 14006	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4423648 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13974	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4427744 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13942	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4431840 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13910	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4435936 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13878	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4440032 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13846	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4444128 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13814	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4448224 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13782	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4452320 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13750	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4456416 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13718	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4460512 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13686	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4464608 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13654	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4468704 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13622	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4472800 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13590	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4476896 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13558	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4480992 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13526	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4485088 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13494	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4489184 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13462	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4493280 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13430	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4497376 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13398	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4501472 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13366	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4505568 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13334	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4509664 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13302	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4513760 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13270	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4517856 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13238	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4521952 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13206	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4526048 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13174	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4530144 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13142	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4534240 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13110	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4538336 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13078	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4542432 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13046	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4546528 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 13014	1
__exception__ July 17, 2023, 4:36 p.m.	stacktrace: whitecrypt (1)+0xf054 @ 0x40f054 whitecrypt (1)+0xf0a0 @ 0x40f0a0 whitecrypt (1)+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt (1)+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt (1).exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4550624 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 14 registers.ebx: 0 registers.esi: 33357856 registers.ecx: 12982	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 55 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02690000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02941000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02942000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02943000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02944000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e95000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02931000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02938000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02939000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e7d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fcf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:36 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e7e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 17, 2023, 4:37 p.m.	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_ComputerSystem

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001c7000', u'virtual_address': u'0x00026000', u'entropy': 7.999881366127605, u'name': u'.rsrc', u'virtual_size': u'0x001c6e5c'}

entropy

7.99988136613

description

A section with a high entropy has been found

entropy

0.93094629156

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 17, 2023, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	Select * from Win32_ComputerSystem

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusW July 17, 2023, 4:37 p.m.	service_handle: 0x008262d0 service_type: 48 service_status: 3		0	0

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress July 17, 2023, 4:37 p.m.	ordinal: 0 function_address: 0x0018eedc function_name: wine_get_unix_file_name module: kernel32 module_address: 0x74e70000		3221225785	0

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Bkav	W32.AIDetectMalware
McAfee	Artemis!E168038DDB8D
Malwarebytes	MachineLearning/Anomalous.100%
Alibaba	Trojan:MSIL/Kryptik.05cef802
BitDefenderTheta	Gen:NN.ZexaF.36318.6r2@aK3@LUf
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AJDM
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.MSIL.Zapchast.akmsc
Avast	Win32:Malware-gen
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Gridinsoft	Trojan.Win32.Kryptik.cl
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	Trojan.MSIL.Zapchast.akmsc
GData	Win32.Trojan-Stealer.Cordimik.0Z0HGX
Google	Detected
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0DGG23
Rising	Trojan.Generic@AI.100 (RDML:EWjjtHPN+WTEc5+nIkGHOA)
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AJDM!tr
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (W)

WhiteCrypt (1).exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All