search

Rurik / Noriben

Noriben - Portable, Simple, Malware Analysis Sandbox
Other
1.1k stars 223 forks source link

New issue - VM running Windows 11 Pro #56

Closed oasec1 closed 1 year ago

oasec1 commented 1 year ago

Here is the error that is being displayed upon execution. Python version- python-3.11.2 32bit

[*] Running cmdline: "c:\tools"\procmon.exe" /BackingFile "Noriben_20_Feb_2311_47_843808.pml" /Quiet /Minimized /LoadConfig "c:\noriben\ProcmonConfiguration.PMC" Traceback (most recent call last): File "c:\noriben\noriben.py", line 1591, in main() File "c:\noriben\noriben.py", line 1524, in main launch_procmon_capture(procmonexe, pml_file, pmc_file) File "c:\noriben\noriben.py", line 976, in launch_procmon_capture subprocess.Popen(cmdline) File "C:\Users\oasec\AppData\Local\Programs\Python\Python311-32\Lib\subprocess.py", line 1024, in init__ self._execute_child(args, executable, preexec_fn, close_fds, File "C:\Users\oasec\AppData\Local\Programs\Python\Python311-32\Lib\subprocess.py", line 1493, in _execute_child hp, ht, pid, tid = _winapi.CreateProcess(executable, args, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ PermissionError: [WinError 5] Access is denied

Once again thanks for such a great tool! Robert

Rurik commented 1 year ago

That is odd. Are you able to run the command line directly as it is there? Maybe the double quotes in the procmon path are causing problems?

"c:\tools"\procmon.exe" /BackingFile "test.pml" /Quiet /Minimized /LoadConfig "c:\noriben\ProcmonConfiguration.PMC"

oasec1 commented 1 year ago

No it wasn't run manually from an administrator command prompt.

On Tue, Feb 21, 2023, 5:27 PM Brian Baskin @.***> wrote:

That is odd. Are you able to run the command line directly as it is there? Maybe the double quotes in the procmon path are causing problems?

"c:\tools"\procmon.exe" /BackingFile "test.pml" /Quiet /Minimized /LoadConfig "c:\noriben\ProcmonConfiguration.PMC"

— Reply to this email directly, view it on GitHub https://github.com/Rurik/Noriben/issues/56#issuecomment-1439171666, or unsubscribe https://github.com/notifications/unsubscribe-auth/AA7UFOW5XJLG5BSFLU65IWLWYU6MDANCNFSM6AAAAAAVDG4RHQ . You are receiving this because you authored the thread.Message ID: @.***>

oasec1 commented 1 year ago

I rebooted again, and then ran it manually It is working now so my plan is to revisit the batch files for typos.

Thanks Robert

Rurik commented 1 year ago

Sounds good. I'm going to close this issue for now, but please reopen it if the problem continues.

oasec1 commented 1 year ago

Will do thanks!

On Tue, Feb 21, 2023, 8:55 PM Brian Baskin @.***> wrote:

Sounds good. I'm going to close this issue for now, but please reopen it if the problem continues.

— Reply to this email directly, view it on GitHub https://github.com/Rurik/Noriben/issues/56#issuecomment-1439326933, or unsubscribe https://github.com/notifications/unsubscribe-auth/AA7UFOVRA23PYZZ7GKWPGCDWYVWXNANCNFSM6AAAAAAVDG4RHQ . You are receiving this because you authored the thread.Message ID: @.***>