Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 25, 2023, 6:50 p.m.	July 25, 2023, 6:54 p.m.

Size	3.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e114ee8f34fd485647c0512aef82153b`
SHA256	`242f11561bddce2000654c9883ce4953ae8783eee3afa005c63cbfe0851327dd`
CRC32	`C5C2877D`
ssdeep	`12288:R6QFPuY0PSzWUAPSzWUIeRNq0tnJGqSEy/voMEYAL8e:jPuldUmdUnRRwqF+oMEnQe`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

scanjo4564864654.exe "C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe"
184
- Powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe.exe'
  2068
- scanjo4564864654.exe "C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe"
  2364

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 25, 2023, 5:53 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 5:53 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 5:53 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 5:53 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 25, 2023, 5:53 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 5:53 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 25, 2023, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 25, 2023, 5:54 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 25, 2023, 5:53 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:53 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:53 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0
IsDebuggerPresent July 25, 2023, 5:54 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321ac8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322088 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321c88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322308 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322508 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 25, 2023, 5:53 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00321f88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 25, 2023, 5:53 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 25, 2023, 5:53 p.m.	stacktrace: 0x811911 0x81182a 0x811760 0x8116e0 0x811623 0x8115c7 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x74080f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9 0x81128b DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x74080f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9 0x811237 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x73fb564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x73f8be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x73f8b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x73f8b726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x73f8bf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x73f8bce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x73f4cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x73f4cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x74038841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x73fb14e9 mscorlib+0x2d36ad @ 0x728936ad mscorlib+0x308f2d @ 0x728c8f2d 0x811179 0x810a01 0x8109c6 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x73f570df LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x73fa412e mscorlib+0x2f1c22 @ 0x728b1c22 mscorlib+0x2f1b99 @ 0x728b1b99 mscorlib+0x2f0814 @ 0x728b0814 mscorlib+0x307407 @ 0x728c7407 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74081f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7408416a exception.instruction_r: 83 78 04 00 0f 85 4b 2b 00 00 c7 85 dc fd ff ff exception.instruction: cmp dword ptr [eax + 4], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x812b24 registers.esp: 4771364 registers.edi: 4772804 registers.eax: 0 registers.ebp: 4772816 registers.edx: 0 registers.ebx: 4773200 registers.esi: 3372 registers.ecx: 7367096	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 25, 2023, 5:53 p.m.

stacktrace:

0x811911
0x81182a
0x811760
0x8116e0
0x811623
0x8115c7
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x74080f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9
0x81128b
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x74080f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f4bcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f32ae9
0x811237
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f59df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f59e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f59efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f59fa2
LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x73fb564b
CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x73f8be63
CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x73f8b998
CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x73f8b726
CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x73f8bf68
CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x73f8bce4
DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x73f4cca4
DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x73f4cd37
DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x74038841
LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x73fb14e9
mscorlib+0x2d36ad @ 0x728936ad
mscorlib+0x308f2d @ 0x728c8f2d
0x811179
0x810a01
0x8109c6
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95
CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x73f570df
LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x73fa412e
mscorlib+0x2f1c22 @ 0x728b1c22
mscorlib+0x2f1b99 @ 0x728b1b99
mscorlib+0x2f0814 @ 0x728b0814
mscorlib+0x307407 @ 0x728c7407
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74081f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7408416a

exception.instruction_r: 83 78 04 00 0f 85 4b 2b 00 00 c7 85 dc fd ff ff
exception.instruction: cmp dword ptr [eax + 4], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x812b24
registers.esp: 4771364
registers.edi: 4772804
registers.eax: 0
registers.ebp: 4772816
registers.edx: 0
registers.ebx: 4773200
registers.esi: 3372
registers.ecx: 7367096

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 181 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00627000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00811000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00812000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e5e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x047e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x047e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x047e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x047e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0216f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x047e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x047ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 184 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x047eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb81000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb82000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02651000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02652000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 25, 2023, 5:54 p.m.	total_number_of_free_bytes: 9928318976 free_bytes_available: 9928318976 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe.exe'

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 25, 2023, 5:53 p.m.	thread_identifier: 2072 thread_handle: 0x00000240 process_identifier: 2068 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000023c	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00055200', u'virtual_address': u'0x00002000', u'entropy': 7.977518950105133, u'name': u'.text', u'virtual_size': u'0x00055054'}

entropy

7.97751895011

description

A section with a high entropy has been found

entropy

0.666993143976

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW July 25, 2023, 5:53 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 25, 2023, 5:53 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW July 25, 2023, 5:54 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (11 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Remote Administration toolkit using webcam	rule	RAT_WebCam
description	Run a KeyLogger	rule	KeyLogger

Terminates another process (4 events)

Time & API	Arguments	Status
NtTerminateProcess July 25, 2023, 5:53 p.m.	status_code: 0xffffffff process_identifier: 2236 process_handle: 0x00000260
NtTerminateProcess July 25, 2023, 5:53 p.m.	status_code: 0xffffffff process_identifier: 2236 process_handle: 0x00000260	1
NtTerminateProcess July 25, 2023, 5:54 p.m.	status_code: 0xffffffff process_identifier: 2288 process_handle: 0x00000268
NtTerminateProcess July 25, 2023, 5:54 p.m.	status_code: 0xffffffff process_identifier: 2288 process_handle: 0x00000268	1

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: ea121214f0c1e113d5c5195cc03bc9940bb30337
buffer	Buffer with sha1: bcd9e586612754d97d1d97de00431a420eeda353
buffer	Buffer with sha1: 10e6e05b908adb72667d06c961e9b352b9381466

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2236 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254		3221225496
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2288 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c		3221225496
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2364 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	1	0

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 184 manipulating memory of non-child process 2236
Process injection	Process 184 manipulating memory of non-child process 2288
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2236 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	3221225496	0
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2288 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c	3221225496	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¿üºdà\|î @ à@O ØÀ H.textô{ \| `.rsrcØ ~@@.relocÀ@B base_address: 0x00400000 process_identifier: 2364 process_handle: 0x00000264	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: 8Ph Dè¢êD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion1.0.0.08InternalNameXClient.exe(LegalCopyright @OriginalFilenameXClient.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0040a000 process_identifier: 2364 process_handle: 0x00000264	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: ð; base_address: 0x0040c000 process_identifier: 2364 process_handle: 0x00000264	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2364 process_handle: 0x00000264	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¿üºdà\|î @ à@O ØÀ H.textô{ \| `.rsrcØ ~@@.relocÀ@B base_address: 0x00400000 process_identifier: 2364 process_handle: 0x00000264	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW July 25, 2023, 5:54 p.m.	thread_identifier: 0 callback_function: 0x00600852 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000	1	1573245	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 184 called NtSetContextThread to modify thread in remote process 2364
NtSetContextThread July 25, 2023, 5:54 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4234222 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000268 process_identifier: 2364	1	0	0

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (7 events)

Time & API	Arguments	Status	Return
CryptHashData July 25, 2023, 5:54 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006c22d0 flags: 0	1	1
CryptHashData July 25, 2023, 5:54 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006c22d0 flags: 0	1	1
CryptHashData July 25, 2023, 5:54 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006c22d0 flags: 0	1	1
CryptHashData July 25, 2023, 5:54 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006c22d0 flags: 0	1	1
CryptHashData July 25, 2023, 5:54 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006c22d0 flags: 0	1	1
CryptHashData July 25, 2023, 5:54 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006c22d0 flags: 0	1	1
CryptHashData July 25, 2023, 5:54 p.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x006c22d0 flags: 0	1	1

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 184 resumed a thread in remote process 2364
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2364	1	0	0

Creates a suspicious Powershell process (1 event)

option

-executionpolicy bypass

value

Attempts to bypass execution policy

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

FireEye	Generic.mg.e114ee8f34fd4856
Malwarebytes	Malware.AI.1998692961
CrowdStrike	win/malicious_confidence_90% (D)
BitDefenderTheta	Gen:NN.ZemsilF.36318.ap3@auZzRmb
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Kryptik.DSR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GLMF
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
Avast	Win32:RATX-gen [Trj]
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Inject4.57973
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Avira	TR/Dropper.Gen
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	HEUR:Backdoor.MSIL.Remcos.gen
Google	Detected
Cylance	unsafe
Panda	Trj/GdSda.A
Rising	Backdoor.Remcos!8.B89E (TFE:C:ocXBbaitTMT)
Fortinet	MSIL/Kryptik.AJAC!tr
AVG	Win32:RATX-gen [Trj]
Cybereason	malicious.112c6d
DeepInstinct	MALICIOUS

Executed a process and injected code into it, probably while unpacking (30 events)

Time & API	Arguments	Status	Return
NtResumeThread July 25, 2023, 5:53 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 184	1	0
NtResumeThread July 25, 2023, 5:53 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 184	1	0
NtResumeThread July 25, 2023, 5:53 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 184	1	0
CreateProcessInternalW July 25, 2023, 5:53 p.m.	thread_identifier: 2072 thread_handle: 0x00000240 process_identifier: 2068 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe.exe' filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000023c	1	1
CreateProcessInternalW July 25, 2023, 5:53 p.m.	thread_identifier: 2240 thread_handle: 0x00000258 process_identifier: 2236 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000254	1	1
NtGetContextThread July 25, 2023, 5:53 p.m.	thread_handle: 0x00000258	1	0
NtAllocateVirtualMemory July 25, 2023, 5:53 p.m.	process_identifier: 2236 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254		3221225496
CreateProcessInternalW July 25, 2023, 5:53 p.m.	thread_identifier: 2292 thread_handle: 0x00000260 process_identifier: 2288 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000025c	1	1
NtGetContextThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000260	1	0
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2288 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000025c		3221225496
CreateProcessInternalW July 25, 2023, 5:54 p.m.	thread_identifier: 2368 thread_handle: 0x00000268 process_identifier: 2364 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\scanjo4564864654.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000264	1	1
NtGetContextThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000268	1	0
NtAllocateVirtualMemory July 25, 2023, 5:54 p.m.	process_identifier: 2364 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000264	1	0
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¿üºdà\|î @ à@O ØÀ H.textô{ \| `.rsrcØ ~@@.relocÀ@B base_address: 0x00400000 process_identifier: 2364 process_handle: 0x00000264	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: base_address: 0x00402000 process_identifier: 2364 process_handle: 0x00000264	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: 8Ph Dè¢êD4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¤StringFileInfo000004b0,FileDescription 0FileVersion1.0.0.08InternalNameXClient.exe(LegalCopyright @OriginalFilenameXClient.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0040a000 process_identifier: 2364 process_handle: 0x00000264	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: ð; base_address: 0x0040c000 process_identifier: 2364 process_handle: 0x00000264	1	1
WriteProcessMemory July 25, 2023, 5:54 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2364 process_handle: 0x00000264	1	1
NtSetContextThread July 25, 2023, 5:54 p.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4234222 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000268 process_identifier: 2364	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 2364	1	0
NtResumeThread July 25, 2023, 5:53 p.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 2068	1	0
NtResumeThread July 25, 2023, 5:53 p.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 2068	1	0
NtResumeThread July 25, 2023, 5:53 p.m.	thread_handle: 0x000003a8 suspend_count: 1 process_identifier: 2068	1	0
NtResumeThread July 25, 2023, 5:53 p.m.	thread_handle: 0x00000420 suspend_count: 1 process_identifier: 2068	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2364	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2364	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x000001c0 suspend_count: 1 process_identifier: 2364	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2364	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000248 suspend_count: 1 process_identifier: 2364	1	0
NtResumeThread July 25, 2023, 5:54 p.m.	thread_handle: 0x00000264 suspend_count: 1 process_identifier: 2364	1	0

scanjo4564864654.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All