Closed gcmoreira closed 1 year ago
Thanks for the heads up - will look into it.
doomed is right - this is a mui issue not a cape issue. hasherezade offers a nice explanation: https://github.com/hasherezade/libpeconv/issues/44
To prove this, instead of submitting notepad or calc, try submitting a batch file that launches them. Then cape has no problem monitoring these exes run from their proper location:
https://capesandbox.com/analysis/354918 https://capesandbox.com/analysis/354919
Prerequisites
Please answer the following questions for yourself before submitting an issue.
Expected Behavior
calc.exe
up and running in the screenshot.notepad.exe
up and running in the screenshot.Current Behavior
None of them seems to work.
Failure Information (for bugs)
As per the
Behavioral Analysis
they finish within the second it was executed. I tested them in a local (updated) environment but also double-checked that the same results happen in your environment, see the following results:Steps to Reproduce
calc.exe
andnotepad.exe
fromc:\windows\sytem32
on the same win7 or win10 guest machine. Both .exe are PE 32 bit so it doesn't matter.Context
I tested them in a local updated environment but also double-checked that the same results happen in yours.
Local setup
$ python3 utils/community.py -waf
Failure Logs
Please check the result links above.