Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 4, 2023, 7:40 a.m.	Oct. 4, 2023, 7:42 a.m.

Size	1.7MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`46a22f0849344f152364d921c3c28435`
SHA256	`1041ffa7fe11147bca657c7f9b58b76a63fab9bedd01e37726e7a5f9df72aed2`
CRC32	`FD39814C`
ssdeep	`24576:WwzT5gWn2HsJRx/6a9DhvhSCPhwtzZc7m6fgA7:dx/6a3vtqtu7m6`
PDB Path	C:\YKD6ikDTuu3VRqaizDSgsRakwh6Z3AQE\Loned.pdb
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check

Setup.exe "C:\Users\test22\AppData\Local\Temp\Setup.exe"
2540
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2704

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.149.146.17	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 4, 2023, 7:40 a.m.			0	0
IsDebuggerPresent Oct. 4, 2023, 7:40 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 4, 2023, 7:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00509538 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 4, 2023, 7:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00509538 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 4, 2023, 7:40 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005095b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\YKD6ikDTuu3VRqaizDSgsRakwh6Z3AQE\Loned.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 4, 2023, 7:40 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.00cfg

The executable uses a known packer (1 event)

packer

Microsoft Visual C++ V8.0 (Debug)

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72de2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7363b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734ea000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00751000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x700a1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00752000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6d5d8000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Yara rule detected in process memory (10 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Communications smtp	rule	Network_SMTP_dotNet
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Oct. 4, 2023, 7:40 a.m.	status_code: 0x00000005 process_identifier: 2668 process_handle: 0x00000118		0	0
NtTerminateProcess Oct. 4, 2023, 7:40 a.m.	status_code: 0x00000005 process_identifier: 2668 process_handle: 0x00000118	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

185.149.146.17

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2668 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000118		3221225496	0
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000011c	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2540 manipulating memory of non-child process 2668
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2668 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000118		3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÙTÆà0´ÎÓ à@ @ÓKàÞ H.textÔ³ ´ `.rsrcÞà¶@@.relocR@B base_address: 0x00400000 process_identifier: 2704 process_handle: 0x0000011c	1	1
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: ÐÐ3 base_address: 0x00458000 process_identifier: 2704 process_handle: 0x0000011c	1	1
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2704 process_handle: 0x0000011c	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÙTÆà0´ÎÓ à@ @ÓKàÞ H.textÔ³ ´ `.rsrcÞà¶@@.relocR@B base_address: 0x00400000 process_identifier: 2704 process_handle: 0x0000011c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2540 called NtSetContextThread to modify thread in remote process 2704
NtSetContextThread Oct. 4, 2023, 7:40 a.m.	registers.eip: 1995571652 registers.esp: 3931036 registers.edi: 0 registers.eax: 4510670 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000120 process_identifier: 2704	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2540 resumed a thread in remote process 2704
NtResumeThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2704	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Lazy.392282
ALYac	Gen:Variant.Lazy.392282
VIPRE	Gen:Variant.Lazy.392282
Arcabit	Trojan.Lazy.D5FC5A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-PSW.Win32.Stealerc.gen
BitDefender	Gen:Variant.Lazy.392282
Avast	Win32:SpywareX-gen [Trj]
Emsisoft	Gen:Variant.Lazy.392282 (B)
FireEye	Gen:Variant.Lazy.392282
MAX	malware (ai score=87)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan-PSW.Win32.Stealerc.gen
GData	Gen:Variant.Lazy.392282
Google	Detected
VBA32	BScope.TrojanPSW.Convagent
Panda	Trj/Genetic.gen
Rising	Trojan.SmokeLoader!1.EB4F (CLASSIC)
Ikarus	Trojan.Win32.Krypt
AVG	Win32:SpywareX-gen [Trj]
DeepInstinct	MALICIOUS

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.149.146.17:28897

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Oct. 4, 2023, 7:40 a.m.	thread_identifier: 2672 thread_handle: 0x00000114 process_identifier: 2668 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000118	1	1
NtGetContextThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000114	1	0
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2668 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000118		3221225496
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: base_address: 0x00000000 process_identifier: 2668 process_handle: 0x00000118		0
CreateProcessInternalW Oct. 4, 2023, 7:40 a.m.	thread_identifier: 2708 thread_handle: 0x00000120 process_identifier: 2704 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000011c	1	1
NtGetContextThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000120	1	0
NtAllocateVirtualMemory Oct. 4, 2023, 7:40 a.m.	process_identifier: 2704 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000011c	1	0
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÙTÆà0´ÎÓ à@ @ÓKàÞ H.textÔ³ ´ `.rsrcÞà¶@@.relocR@B base_address: 0x00400000 process_identifier: 2704 process_handle: 0x0000011c	1	1
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: base_address: 0x00402000 process_identifier: 2704 process_handle: 0x0000011c	1	1
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: base_address: 0x0044e000 process_identifier: 2704 process_handle: 0x0000011c	1	1
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: ÐÐ3 base_address: 0x00458000 process_identifier: 2704 process_handle: 0x0000011c	1	1
WriteProcessMemory Oct. 4, 2023, 7:40 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2704 process_handle: 0x0000011c	1	1
NtSetContextThread Oct. 4, 2023, 7:40 a.m.	registers.eip: 1995571652 registers.esp: 3931036 registers.edi: 0 registers.eax: 4510670 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000120 process_identifier: 2704	1	0
NtResumeThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2704	1	0
NtResumeThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 2704	1	0
NtResumeThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x000001b4 suspend_count: 1 process_identifier: 2704	1	0
NtResumeThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x000001f4 suspend_count: 1 process_identifier: 2704	1	0
NtResumeThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2704	1	0
NtGetContextThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000148	1	0
NtGetContextThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000148	1	0
NtResumeThread Oct. 4, 2023, 7:40 a.m.	thread_handle: 0x00000148 suspend_count: 1 process_identifier: 2704	1	0

Setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All