SmartHawk

5.2

中危

该样本未表现出任何异常！

重新分析

下载样本

975d73d4863a0b51e77a23c81f9e3e6918dbc609be19546a35cc6104f47b0a81

ace9f8d923e8157064f6a8a84fa7e39c.exe

分析耗时

84s

最近分析

文件大小

715.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks if process is being debugged by a debugger (50 out of 113 个事件)

Time & API	Arguments	Status	Return	Repeated
1620928441.193875 IsDebuggerPresent		failed	0	0
1620928441.193875 IsDebuggerPresent		failed	0	0
1620928443.303875 IsDebuggerPresent		failed	0	0
1620928443.803875 IsDebuggerPresent		failed	0	0
1620928444.318875 IsDebuggerPresent		failed	0	0
1620928444.803875 IsDebuggerPresent		failed	0	0
1620928445.318875 IsDebuggerPresent		failed	0	0
1620928445.803875 IsDebuggerPresent		failed	0	0
1620928446.318875 IsDebuggerPresent		failed	0	0
1620928446.803875 IsDebuggerPresent		failed	0	0
1620928447.318875 IsDebuggerPresent		failed	0	0
1620928447.803875 IsDebuggerPresent		failed	0	0
1620928448.318875 IsDebuggerPresent		failed	0	0
1620928448.803875 IsDebuggerPresent		failed	0	0
1620928449.318875 IsDebuggerPresent		failed	0	0
1620928449.803875 IsDebuggerPresent		failed	0	0
1620928450.318875 IsDebuggerPresent		failed	0	0
1620928450.803875 IsDebuggerPresent		failed	0	0
1620928451.318875 IsDebuggerPresent		failed	0	0
1620928451.803875 IsDebuggerPresent		failed	0	0
1620928452.318875 IsDebuggerPresent		failed	0	0
1620928452.803875 IsDebuggerPresent		failed	0	0
1620928453.318875 IsDebuggerPresent		failed	0	0
1620928453.803875 IsDebuggerPresent		failed	0	0
1620928454.318875 IsDebuggerPresent		failed	0	0
1620928454.803875 IsDebuggerPresent		failed	0	0
1620928455.318875 IsDebuggerPresent		failed	0	0
1620928455.803875 IsDebuggerPresent		failed	0	0
1620928456.318875 IsDebuggerPresent		failed	0	0
1620928456.803875 IsDebuggerPresent		failed	0	0
1620928457.318875 IsDebuggerPresent		failed	0	0
1620928457.803875 IsDebuggerPresent		failed	0	0
1620928458.318875 IsDebuggerPresent		failed	0	0
1620928458.803875 IsDebuggerPresent		failed	0	0
1620928459.318875 IsDebuggerPresent		failed	0	0
1620928459.803875 IsDebuggerPresent		failed	0	0
1620928460.318875 IsDebuggerPresent		failed	0	0
1620928460.803875 IsDebuggerPresent		failed	0	0
1620928461.318875 IsDebuggerPresent		failed	0	0
1620928461.803875 IsDebuggerPresent		failed	0	0
1620928462.318875 IsDebuggerPresent		failed	0	0
1620928462.803875 IsDebuggerPresent		failed	0	0
1620928463.318875 IsDebuggerPresent		failed	0	0
1620928463.803875 IsDebuggerPresent		failed	0	0
1620928464.318875 IsDebuggerPresent		failed	0	0
1620928464.803875 IsDebuggerPresent		failed	0	0
1620928465.318875 IsDebuggerPresent		failed	0	0
1620928465.803875 IsDebuggerPresent		failed	0	0
1620928466.318875 IsDebuggerPresent		failed	0	0
1620928466.803875 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620928441.272875 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 91 个事件)

Time & API	Arguments	Status	Return
1620928440.272875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00440000	success	0
1620928440.272875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00460000	success	0
1620928440.756875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00ac0000	success	0
1620928440.756875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b80000	success	0
1620928440.928875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success	0
1620928441.193875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00ac0000	success	0
1620928441.193875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00af0000	success	0
1620928441.193875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045a000	success	0
1620928441.193875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success	0
1620928441.193875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00452000	success	0
1620928441.678875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a2000	success	0
1620928441.912875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c5000	success	0
1620928441.912875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004cb000	success	0
1620928441.912875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c7000	success	0
1620928442.193875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a3000	success	0
1620928442.287875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ac000	success	0
1620928442.475875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa0000	success	0
1620928442.803875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a4000	success	0
1620928443.428875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a5000	success	0
1620928443.475875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a7000	success	0
1620928443.553875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ba000	success	0
1620928443.553875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b7000	success	0
1620928443.693875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b6000	success	0
1620928443.756875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa1000	success	0
1620928444.068875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa4000	success	0
1620928444.100875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a8000	success	0
1620928485.115875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa5000	success	0
1620928485.131875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b81000	success	0
1620928485.193875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa6000	success	0
1620928485.350875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045c000	success	0
1620928485.365875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa7000	success	0
1620928485.428875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a9000	success	0
1620928485.428875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa8000	success	0
1620928485.443875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aa9000	success	0
1620928485.490875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 286720 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05420400	failed	3221225550
1620928492.303875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aaa000	success	0
1620928492.303875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04f00000	success	0
1620928492.318875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aab000	success	0
1620928492.381875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aac000	success	0
1620928492.615875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aad000	success	0
1620928492.631875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aae000	success	0
1620928492.975875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00aaf000	success	0
1620928493.022875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05200000	success	0
1620928493.022875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05201000	success	0
1620928493.022875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05420178	failed	3221225550
1620928493.037875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x054201a0	failed	3221225550
1620928493.037875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x054201c8	failed	3221225550
1620928493.037875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x054201f0	failed	3221225550
1620928493.037875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05420218	failed	3221225550
1620928493.037875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05466d4e	failed	3221225550

A process attempted to delay the analysis task. (1 个事件)

description

ace9f8d923e8157064f6a8a84fa7e39c.exe tried to sleep 149 seconds, actually delayed analysis time by 149 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.616098711616374

section

{'size_of_data': '0x00086a00', 'virtual_address': '0x00002000', 'entropy': 7.616098711616374, 'name': '.text', 'virtual_size': '0x00086904'}

description

A section with a high entropy has been found

entropy

0.7536738978306508

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620928442.928875 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1620928493.928875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1380 process_handle: 0x0000d5bc	failed
1620928493.928875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1380 process_handle: 0x0000d5bc	success
1620928494.334875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1244 process_handle: 0x000092c4	failed
1620928494.334875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1244 process_handle: 0x000092c4	success
1620928494.740875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1404 process_handle: 0x00004064	failed
1620928494.740875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1404 process_handle: 0x00004064	success
1620928495.178875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1868 process_handle: 0x00008294	failed
1620928495.178875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1868 process_handle: 0x00008294	success
1620928495.600875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2168 process_handle: 0x000084a0	failed
1620928495.600875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2168 process_handle: 0x000084a0	success

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	203.208.41.66

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1620928493.553875 NtAllocateVirtualMemory	process_identifier: 1380 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000074fc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928494.037875 NtAllocateVirtualMemory	process_identifier: 1244 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00005330 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928494.443875 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000eb28 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928494.865875 NtAllocateVirtualMemory	process_identifier: 1868 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000f0b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928495.303875 NtAllocateVirtualMemory	process_identifier: 2168 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000020a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2440 manipulating memory of non-child process 1380
Process injection	Process 2440 manipulating memory of non-child process 1244
Process injection	Process 2440 manipulating memory of non-child process 1404
Process injection	Process 2440 manipulating memory of non-child process 1868
Process injection	Process 2440 manipulating memory of non-child process 2168
1620928493.553875 NtAllocateVirtualMemory	process_identifier: 1380 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000074fc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1620928494.037875 NtAllocateVirtualMemory	process_identifier: 1244 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00005330 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1620928494.443875 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000eb28 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1620928494.865875 NtAllocateVirtualMemory	process_identifier: 1868 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000f0b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1620928495.303875 NtAllocateVirtualMemory	process_identifier: 2168 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000020a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Executed a process and injected code into it, probably while unpacking (22 个事件)

Time & API	Arguments	Status	Return
1620928441.193875 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2440	success	0
1620928441.209875 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 2440	success	0
1620928441.287875 NtResumeThread	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2440	success	0
1620928443.178875 NtResumeThread	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 2440	success	0
1620928443.225875 NtResumeThread	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2440	success	0
1620928493.068875 NtResumeThread	thread_handle: 0x0000c448 suspend_count: 1 process_identifier: 2440	success	0
1620928493.084875 NtResumeThread	thread_handle: 0x0000fafc suspend_count: 1 process_identifier: 2440	success	0
1620928493.553875 CreateProcessInternalW	thread_identifier: 3008 thread_handle: 0x00010d34 process_identifier: 1380 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000074fc inherit_handles: 0	success	1
1620928493.553875 NtGetContextThread	thread_handle: 0x00010d34	success	0
1620928493.553875 NtAllocateVirtualMemory	process_identifier: 1380 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000074fc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928494.037875 CreateProcessInternalW	thread_identifier: 2652 thread_handle: 0x0000d5bc process_identifier: 1244 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00005330 inherit_handles: 0	success	1
1620928494.037875 NtGetContextThread	thread_handle: 0x0000d5bc	success	0
1620928494.037875 NtAllocateVirtualMemory	process_identifier: 1244 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00005330 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928494.443875 CreateProcessInternalW	thread_identifier: 1816 thread_handle: 0x000092c4 process_identifier: 1404 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000eb28 inherit_handles: 0	success	1
1620928494.443875 NtGetContextThread	thread_handle: 0x000092c4	success	0
1620928494.443875 NtAllocateVirtualMemory	process_identifier: 1404 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000eb28 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928494.865875 CreateProcessInternalW	thread_identifier: 2968 thread_handle: 0x00004064 process_identifier: 1868 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000f0b8 inherit_handles: 0	success	1
1620928494.865875 NtGetContextThread	thread_handle: 0x00004064	success	0
1620928494.865875 NtAllocateVirtualMemory	process_identifier: 1868 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000f0b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1620928495.303875 CreateProcessInternalW	thread_identifier: 2632 thread_handle: 0x00008294 process_identifier: 2168 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ace9f8d923e8157064f6a8a84fa7e39c.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000020a8 inherit_handles: 0	success	1
1620928495.303875 NtGetContextThread	thread_handle: 0x00008294	success	0
1620928495.303875 NtAllocateVirtualMemory	process_identifier: 2168 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000020a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-10 10:33:08

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
203.208.41.66	443	192.168.56.101	49196

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53238	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.