Is the error from the extracted binary expected?

[ctxis]

Is the error from the extracted binary expected?

[kevoreilly]

I'm not sure I follow but the sample from the link won't run - just tested it on Win7x64. It's true though that the error message "Unable to execute the initial process, analysis aborted" isn't immediately obvious. It's rare that an extracted binary will run itself though - where was it extracted from?

[redsand]

I just wanted to make sure that this was the expected behavior and that it was properly documented. This extraction came from a WannaCry variant.

[kevoreilly]

Actually the most informative line from the log is:

ERROR: Failed to execute process from path "" with arguments "None" (Error: 14001)

This error code is returned by Windows, and means "The application has failed to start because its side-by-side configuration is incorrect" which is what you get when you try and run it manually.

[kevoreilly]

It would be cool to have a reverse lookup for these error codes though and print the meanings in the log instead,

[kevoreilly]

(On another note this means the WannaCry Yara signature needs updating!)