Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 2, 2023, 9:36 a.m.	Oct. 2, 2023, 9:38 a.m.

Size	6.5MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`a7ee1f4bf11bdfab2327d098c6583af1`
SHA256	`d74686c87f0777d1e8c4fcc18b40fe3ce97d6e531e23b6665037e5599b72aa32`
CRC32	`C6C1D8FC`
ssdeep	`196608:XdatXBkprOtdefgVeIXcIv/W5yYtjR1kJA3iaAim:NaVB2rOtTVew5/W5n1LkJA3i3`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)

WWW14_64.exe "C:\Users\test22\AppData\Local\Temp\WWW14_64.exe"
2560

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section
section	.vmp#0
section	.themida
section	.vmp#1
section	.vmp#2
section	.vmp#3

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d www14_64+0x68f642 @ 0x14030f642 www14_64+0x68f60d @ 0x14030f60d HeapWalk-0x1ce0 kernel32+0x0 @ 0x76c10000 0x15f8d8 0x15f8d8 0x15f8d8 LoadBitmapA+0x50 EmptyClipboard-0x2d8 user32+0x1e0e8 @ 0x769ce0e8 www14_64+0x4ca862 @ 0x14014a862 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 0x237bb000000030 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 42141 exception.address: 0x7fefd4fa49d registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 1994472144 registers.r10: 0 registers.rbx: 32 registers.rsp: 1439984 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1439992 registers.rdi: 5368860672 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2 @ 0x76d80bd2 exception.instruction_r: 48 cf 48 83 ec 30 4c 8b c4 48 81 ec d0 04 00 00 exception.symbol: RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2 exception.instruction: iretq exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 330706 exception.address: 0x76d80bd2 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1
__exception__ Oct. 2, 2023, 9:36 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 0 registers.r15: 0 registers.rcx: 1438160 registers.rsi: 0 registers.r10: 0 registers.rbx: 32 registers.rsp: 1440072 registers.r11: 514 registers.r8: 0 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 1993721121 registers.rdi: 0 registers.rax: 1995683371 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 16487 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d78280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d79280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d7a280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d7b280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d7c280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d7d280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d7e280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d7f280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d80280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d82280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d83280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d84280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d85280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d86280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d87280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d88280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d89280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d8a280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d8b280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d8c280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d8d280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d8e280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d8f280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d90280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d91280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d92280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d93280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d94280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d95280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d96280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d97280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d98280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d99280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9a280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9b280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9c280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9d280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9f280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da0280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da1280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da2280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da3280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da4280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da5280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da6280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da7280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da8280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076da9280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00664000', u'virtual_address': u'0x009d9000', u'entropy': 7.920668319140754, u'name': u'.vmp#3', u'virtual_size': u'0x00663fe8'}

entropy

7.92066831914

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00012e00', u'virtual_address': u'0x0103e000', u'entropy': 7.0364449668927245, u'name': u'.rsrc', u'virtual_size': u'0x00012ca6'}

entropy

7.03644496689

description

A section with a high entropy has been found

entropy

0.999622470553

description

Overall entropy of this PE file is high

The executable is likely packed with VMProtect (4 events)

section	.vmp#0	description	Section name indicates VMProtect
section	.vmp#1	description	Section name indicates VMProtect
section	.vmp#2	description	Section name indicates VMProtect
section	.vmp#3	description	Section name indicates VMProtect

DEP was bypassed by marking part of the stack executable by the process WWW14_64.exe (8 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015c000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015d000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015e000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015f000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015c000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015d000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015e000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800
NtAllocateVirtualMemory Oct. 2, 2023, 9:36 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000015f000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	-1073741800

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ Oct. 2, 2023, 9:36 a.m.	tid: 2564 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetectMalware.64
Lionic	Trojan.Win32.Tedy.4!c
tehtris	Generic.Malware
DrWeb	Trojan.Siggen21.33432
MicroWorld-eScan	Gen:Variant.Tedy.446835
FireEye	Generic.mg.a7ee1f4bf11bdfab
McAfee	Artemis!A7EE1F4BF11B
Malwarebytes	Spyware.RedLineStealer
Sangfor	Trojan.Win32.Save.a
BitDefender	Trojan.GenericKD.69542504
Cyren	W64/ABRisk.SDZG-6584
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/Packed.VMProtect.J suspicious
APEX	Malicious
Kaspersky	Trojan.Win32.Scar.tqop
Alibaba	Trojan:Win32/VMProtect.46261d5f
ViRobot	Trojan.Win.Z.Tedy.6781952
Rising	Trojan.Znyonm!8.18A3A (CLOUD)
Emsisoft	Trojan.GenericKD.69542504 (B)
F-Secure	Trojan.TR/Scar.hzatx
TrendMicro	TrojanSpy.Win64.REDLINE.YXDI3Z
McAfee-GW-Edition	BehavesLike.Win64.Generic.vc
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	TR/Scar.hzatx
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.Sabsik
Gridinsoft	Malware.Win64.Gen.bot
Microsoft	Trojan:Win32/Znyonm
ZoneAlarm	Trojan.Win32.Scar.tqop
GData	Trojan.GenericKD.69542504
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5498863
ALYac	Gen:Variant.Tedy.446835
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win64.REDLINE.YXDI3Z
Tencent	Win32.Trojan.Scar.Ximw
MaxSecure	Trojan.Malware.218725380.susgen
Fortinet	Adware/TrojanSpy_Win64_REDLINE
AVG	Win64:PWSX-gen [Trj]
Avast	Win64:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

WWW14_64.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All