Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 23, 2023, 9:26 a.m.	Sept. 23, 2023, 9:35 a.m.

Size	8.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c4d37e5aeffecf5dd8728a71d204dca1`
SHA256	`0535bbb2e909ae5e024d8db74b49e43c12981c3d6bdd1974c7bc56f73e58ad08`
CRC32	`0BA608C5`
ssdeep	`196608:+/P/gs9mxaW9bLzD7x3lYlHOrOnsUE4ZDYtNP9/B74eHn2FouzDPsW039pXIE23l:gmFrUlHM4eNP9/OeH2FpPsNlBu`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file MALWARE_Win_VT_RedLine - Detects RedLine infostealer UltraVNC_Zero - UltraVNC PE_Header_Zero - PE File Signature IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check

WhiteCrypt.exe "C:\Users\test22\AppData\Local\Temp\WhiteCrypt.exe"
2668

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 23, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 23, 2023, 9:26 a.m.			0	0
IsDebuggerPresent Sept. 23, 2023, 9:26 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 23, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0034ce90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0034ce90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0034ced0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0034ced0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0034cf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0034cf90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 23, 2023, 9:26 a.m.		1	1	0

One or more processes crashed (50 out of 2187 events)

Time & API	Arguments	Status
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: whitecrypt+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350172 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 4	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4354016 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69943	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4358112 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69911	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4362208 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69879	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4366304 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69847	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4370400 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69815	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4374496 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69783	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4378592 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69751	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4382688 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69719	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4386784 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69687	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4390880 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69655	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4394976 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69623	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4399072 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69591	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4403168 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69559	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4407264 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69527	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4411360 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69495	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4415456 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69463	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4419552 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69431	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4423648 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69399	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4427744 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69367	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4431840 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69335	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4435936 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69303	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4440032 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69271	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4444128 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69239	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4448224 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69207	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4452320 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69175	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4456416 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69143	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4460512 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69111	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4464608 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69079	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4468704 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69047	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4472800 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 69015	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4476896 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68983	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4480992 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68951	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4485088 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68919	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4489184 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68887	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4493280 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68855	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4497376 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68823	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4501472 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68791	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4505568 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68759	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4509664 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68727	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4513760 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68695	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4517856 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68663	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4521952 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68631	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4526048 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68599	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4530144 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68567	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4534240 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68535	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4538336 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68503	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4542432 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68471	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4546528 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68439	1
__exception__ Sept. 23, 2023, 9:26 a.m.	stacktrace: whitecrypt+0xf054 @ 0x40f054 whitecrypt+0xf0a0 @ 0x40f0a0 whitecrypt+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: whitecrypt+0xeff0 exception.address: 0x40eff0 exception.module: WhiteCrypt.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4550624 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 21 registers.ebx: 0 registers.esi: 40894496 registers.ecx: 68407	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 53 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03af0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03d10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03972000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cd1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0397a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0397c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cd3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0398c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cd4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x039ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x039a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x039a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03996000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0399a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03997000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0398d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c89000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x08191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0819c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0819e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0819f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0398e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06771000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06772000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06773000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06774000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06775000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06776000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06777000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06778000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 23, 2023, 9:26 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06779000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_ComputerSystem

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0088b000', u'virtual_address': u'0x00026000', u'entropy': 7.999981020999588, u'name': u'.rsrc', u'virtual_size': u'0x0088af28'}

entropy

7.999981021

description

A section with a high entropy has been found

entropy

0.984802431611

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 23, 2023, 9:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	Select * from Win32_ComputerSystem

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusW Sept. 23, 2023, 9:26 a.m.	service_handle: 0x003aa920 service_type: 48 service_status: 3		0	0

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Sept. 23, 2023, 9:26 a.m.	ordinal: 0 function_address: 0x0018eed4 function_name: wine_get_unix_file_name module: kernel32 module_address: 0x755b0000		3221225785	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.Common.54DD09EF
MicroWorld-eScan	Trojan.Generic.34146605
Sangfor	Trojan.Msil.Agent.Va8k
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Trojan:MSIL/Kryptik.a55cf82f
Arcabit	Trojan.Generic.D209092D
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AJDM
Cynet	Malicious (score: 100)
Kaspersky	Trojan.MSIL.Agent.qwipeh
BitDefender	Trojan.Generic.34146605
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.FalseSign.Pzfl
Emsisoft	Trojan.Generic.34146605 (B)
VIPRE	Trojan.Generic.34146605
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
FireEye	Trojan.Generic.34146605
Sophos	Mal/Generic-S
MAX	malware (ai score=83)
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan.MSIL.Agent.qwipeh
GData	Trojan.Generic.34146605
Google	Detected
McAfee	Redline-FVSP!C4D37E5AEFFE
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0CIL23
Rising	Trojan.Generic@AI.96 (RDML:9dSreeMF7H7XN1KpfTPslw)
Ikarus	Trojan.MSIL.Crypt
Fortinet	MSIL/Kryptik.AJDM!tr
BitDefenderTheta	Gen:NN.ZexaF.36722.@t2@aKKiAWe
AVG	Win32:Malware-gen
Cybereason	malicious.dd4922
DeepInstinct	MALICIOUS

WhiteCrypt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All