Environment Information
Host System
Operating System: Ubuntu 22.04 LTS
Hypervisor: KVM/QEMU with libvirt
CAPEv2 Version: Latest master branch (updated on 2026-05-27)
Python (Host): Python 3.10
MongoDB: Running normally on localhost:27017
CAPE Services Status:
cape.service → active (running)
cape-rooter.service → active (running)
cape-web.service → active (running)
cape-processor.service → active (running)
Guest VM
Operating System: Windows 10 x64
Python Version: Python 3.10.6 (32-bit)
Agent Version: CAPE Agent 0.20
Initial Problem
The main issue is that dynamic analysis always ends with:
Hard Timeout reached! (Running for 320s, Limit 320s). Agent is likely unresponsive.
even for benign samples such as:
calc.exe
notepad.exe
No behavior data is generated:
jq '.behavior.processes | length' report.json
Result:
0
Current Status
After several debugging and recovery steps:
Working Components
CAPE Services
All CAPE services are now running correctly.
Guest VM responds correctly.
Agent is reachable: returns CAPE Agent response correctly.
DLL Injection
DLL injection now appears to work.
Inside guest VM:
tasklist /m version*
shows:
explorer.exe VERSION.dll
which suggests CAPE monitor DLL injection is active.
Current Remaining Issue
Although:
CAPE services are healthy
CAPE Agent connects successfully
VM is stable
DLL injection appears successful
the analysis still always ends with:
Hard Timeout reached
No behavior/process activity is produced.
CAPE Log Example
2026-05-27 06:31:34,476 [lib.cuckoo.core.guest] INFO:
Task #57: Guest is running CAPE Agent 0.20
2026-05-27 06:31:35,042 [lib.cuckoo.core.guest] INFO:
Task #57: Uploading script files to guest
2026-05-27 06:36:55,310 [lib.cuckoo.core.guest] ERROR:
Task #57: Hard Timeout reached! (Running for 320s, Limit 320s). Agent is likely unresponsive.
Security / Hardening Changes Already Applied
The following security settings were modified in the Windows guest VM.
UAC Disabled
Registry:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
Result:
EnableLUA REG_DWORD 0x0
Windows Defender Disabled
sc query WinDefend
Result:
STATE : STOPPED
Exploit Protection Disabled
The following mitigations are disabled system-wide:
DEP
OFF
ASLR
OFF
CFG
OFF
SEHOP
OFF
Heap Protection
OFF
DynamicCode restrictions
NOTSET / OFF
Child Process restrictions
NOTSET
Binary Signature Enforcement
OFF / NOTSET
Additional Recovery Actions Already Performed
Repository Reset
git reset --hard HEAD
git clean -fd
git pull
Repository updated to latest master successfully.
CAPE Dependencies Reinstalled
poetry install
completed successfully.
Storage Cleanup
Removed:
old analyses
old binaries
temporary dumps
memory dumps
Disk space issue fixed.
Previous DLL Injection Errors
Earlier, CAPE experienced DLL injection failures similar to historical GitHub issues related to:
GetProcessInitialThreadId failed
Failed to inject DLL
After updating CAPEv2 to latest master branch, DLL injection appears to work again.
Request for Assistance
I would appreciate guidance regarding:
Why CAPE analysis reaches hard timeout even though:
Agent is connected
DLL injection appears successful
VM is stable
Whether there are known issues with:
Python 3.10.6 (32-bit)
latest CAPEv2 monitor DLL
analyzer.py execution on Windows 10 x64
Recommended guest Python version/architecture for latest CAPEv2.
Environment Information
Host System
Operating System: Ubuntu 22.04 LTS
Hypervisor: KVM/QEMU with libvirt
CAPEv2 Version: Latest master branch (updated on 2026-05-27)
Python (Host): Python 3.10
MongoDB: Running normally on localhost:27017
CAPE Services Status:
cape.service → active (running)
cape-rooter.service → active (running)
cape-web.service → active (running)
cape-processor.service → active (running)
Guest VM
Operating System: Windows 10 x64
Python Version: Python 3.10.6 (32-bit)
Agent Version: CAPE Agent 0.20
Initial Problem
The main issue is that dynamic analysis always ends with:
Hard Timeout reached! (Running for 320s, Limit 320s). Agent is likely unresponsive.
even for benign samples such as:
calc.exe
notepad.exe
No behavior data is generated:
jq '.behavior.processes | length' report.json
Result:
0
Current Status
After several debugging and recovery steps:
Working Components
CAPE Services
All CAPE services are now running correctly.
Guest VM responds correctly.
Agent is reachable: returns CAPE Agent response correctly.
DLL Injection
DLL injection now appears to work.
Inside guest VM:
tasklist /m version*
shows:
explorer.exe VERSION.dll
which suggests CAPE monitor DLL injection is active.
Current Remaining Issue
Although:
CAPE services are healthy
CAPE Agent connects successfully
VM is stable
DLL injection appears successful
the analysis still always ends with:
Hard Timeout reached
No behavior/process activity is produced.
CAPE Log Example
2026-05-27 06:31:34,476 [lib.cuckoo.core.guest] INFO:
Task #57: Guest is running CAPE Agent 0.20
2026-05-27 06:31:35,042 [lib.cuckoo.core.guest] INFO:
Task #57: Uploading script files to guest
2026-05-27 06:36:55,310 [lib.cuckoo.core.guest] ERROR:
Task #57: Hard Timeout reached! (Running for 320s, Limit 320s). Agent is likely unresponsive.
Security / Hardening Changes Already Applied
The following security settings were modified in the Windows guest VM.
UAC Disabled
Registry:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
Result:
EnableLUA REG_DWORD 0x0
Windows Defender Disabled
sc query WinDefend
Result:
STATE : STOPPED
Exploit Protection Disabled
The following mitigations are disabled system-wide:
DEP
OFF
ASLR
OFF
CFG
OFF
SEHOP
OFF
Heap Protection
OFF
DynamicCode restrictions
NOTSET / OFF
Child Process restrictions
NOTSET
Binary Signature Enforcement
OFF / NOTSET
Additional Recovery Actions Already Performed
Repository Reset
git reset --hard HEAD
git clean -fd
git pull
Repository updated to latest master successfully.
CAPE Dependencies Reinstalled
poetry install
completed successfully.
Storage Cleanup
Removed:
old analyses
old binaries
temporary dumps
memory dumps
Disk space issue fixed.
Previous DLL Injection Errors
Earlier, CAPE experienced DLL injection failures similar to historical GitHub issues related to:
GetProcessInitialThreadId failed
Failed to inject DLL
After updating CAPEv2 to latest master branch, DLL injection appears to work again.
Request for Assistance
I would appreciate guidance regarding:
Why CAPE analysis reaches hard timeout even though:
Agent is connected
DLL injection appears successful
VM is stable
Whether there are known issues with:
Python 3.10.6 (32-bit)
latest CAPEv2 monitor DLL
analyzer.py execution on Windows 10 x64
Recommended guest Python version/architecture for latest CAPEv2.