| Time & API |
Arguments |
Status |
Return |
Repeated |
1620119623.678952
CreateProcessInternalW
|
thread_identifier:
784
thread_handle:
0x00000168
process_identifier:
472
current_directory:
filepath:
track:
1
command_line:
C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\172b81fe3eb9fe6127c30f5aa1d9fd61.exe
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x0000016c
inherit_handles:
0
|
success
|
1 |
0
|
1620119623.678952
NtGetContextThread
|
thread_handle:
0x00000168
|
success
|
0 |
0
|
1620119623.678952
NtUnmapViewOfSection
|
process_identifier:
472
region_size:
214466560
process_handle:
0x0000016c
base_address:
0x6aec8b55
|
failed
|
3221225497 |
0
|
1620119623.678952
NtUnmapViewOfSection
|
process_identifier:
472
region_size:
214466560
process_handle:
0x0000016c
base_address:
0x6aec8b55
|
failed
|
3221225497 |
0
|
1620119623.678952
NtUnmapViewOfSection
|
process_identifier:
472
region_size:
214466560
process_handle:
0x0000016c
base_address:
0x6aec8b55
|
failed
|
3221225497 |
0
|
1620119623.678952
NtUnmapViewOfSection
|
process_identifier:
472
region_size:
4096
process_handle:
0x0000016c
base_address:
0x00400000
|
success
|
0 |
0
|
1620119623.678952
NtUnmapViewOfSection
|
process_identifier:
472
region_size:
2004156416
process_handle:
0x0000016c
base_address:
0x00400000
|
failed
|
3221225497 |
0
|
1620119623.678952
NtAllocateVirtualMemory
|
process_identifier:
472
region_size:
151552
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0x0000016c
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
base_address:
0x00400000
|
success
|
0 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
MZP ÿÿ ¸ @ º ´ Í!¸LÍ!This program must be run under Win32
$7 PE L ^B* à T ´¦ ° @ P @ @ CODE Ð `DATA ¨5 ° 6 @ ÀBSS ± ð Ò À.idata Ò @ À.reloc Ô @ P.rsrc @ î @ P P ð @ P
process_handle:
0x0000016c
base_address:
0x00400000
|
success
|
1 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
process_handle:
0x0000016c
base_address:
0x00401000
|
success
|
1 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
process_handle:
0x0000016c
base_address:
0x0041b000
|
success
|
1 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
process_handle:
0x0000016c
base_address:
0x0041f000
|
failed
|
0 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
process_handle:
0x0000016c
base_address:
0x00421000
|
success
|
1 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
process_handle:
0x0000016c
base_address:
0x00422000
|
success
|
1 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
zC
process_handle:
0x0000016c
base_address:
0x00424000
|
success
|
1 |
0
|
1620119623.678952
WriteProcessMemory
|
process_identifier:
472
buffer:
@
process_handle:
0x0000016c
base_address:
0x7efde008
|
success
|
1 |
0
|
1620119623.678952
NtSetContextThread
|
thread_handle:
0x00000168
registers.eip:
4302516
registers.esp:
1638384
registers.edi:
0
registers.eax:
4302516
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
process_identifier:
472
|
success
|
0 |
0
|
1620119624.037952
NtResumeThread
|
thread_handle:
0x00000168
suspend_count:
1
process_identifier:
472
|
success
|
0 |
0
|
1620149102.632374
CreateProcessInternalW
|
thread_identifier:
192
thread_handle:
0x0000009c
process_identifier:
2272
current_directory:
filepath:
track:
1
command_line:
explorer.exe
filepath_r:
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
process_handle:
0x000000a0
inherit_handles:
0
|
success
|
1 |
0
|
1620149102.632374
NtGetContextThread
|
thread_handle:
0x0000009c
|
success
|
0 |
0
|
1620149102.632374
WriteProcessMemory
|
process_identifier:
2272
buffer:
UåìVWSè [ë d¡0 @ @ px uõè GetProcAddress Vèy { è
LoadLibraryA Vÿ{ è UnmapViewOfFile Vÿ{ è
VirtualAlloc Vÿ{ è VirtualFree Vÿ{ è OpenFileMappingA Vÿ{ è MapViewOfFile Vÿ{ è CloseHandle Vÿ{ Pj jÿ Eìj j j jPÿ
ÀtfEðÆp<NPMü4uøÆÎvuôñÁQj@h 0 Qj ÿ YÇuðó¤Pè Pÿuðÿ ÿuìÿ XÇ}üÇWEøÿÐÉøÿÿÿÿÉÃUåVWS} Éÿ1Àò®÷Ñuv<VxUZ ];}u Qó¦t YÃ@;BuéëYMÎJ$A· B ðë1À[_^É Uå`}<¤
Àt<E_4+]
Ût/
Ét+0x)ùï
ÿtîÑïÀ·
Òt
æUò)@@OuêëÑaÉ FE3EF337_section
process_handle:
0x000000a0
base_address:
0x00cb0efa
|
success
|
1 |
0
|
1620149102.866374
NtResumeThread
|
thread_handle:
0x0000009c
suspend_count:
1
process_identifier:
2272
|
success
|
0 |
0
|
1620149103.600499
NtResumeThread
|
thread_handle:
0x00000128
suspend_count:
1
process_identifier:
2272
|
success
|
0 |
0
|