Skip to content

CAPEv2 DLL Injection / Agent Unresponsive Issue Report #135

Description

@cianni20

Environment Information
Host System
Operating System: Ubuntu 22.04 LTS
Hypervisor: KVM/QEMU with libvirt
CAPEv2 Version: Latest master branch (updated on 2026-05-27)
Python (Host): Python 3.10
MongoDB: Running normally on localhost:27017
CAPE Services Status:
cape.service → active (running)
cape-rooter.service → active (running)
cape-web.service → active (running)
cape-processor.service → active (running)
Guest VM
Operating System: Windows 10 x64
Python Version: Python 3.10.6 (32-bit)
Agent Version: CAPE Agent 0.20

Initial Problem

The main issue is that dynamic analysis always ends with:

Hard Timeout reached! (Running for 320s, Limit 320s). Agent is likely unresponsive.

even for benign samples such as:

calc.exe
notepad.exe

No behavior data is generated:

jq '.behavior.processes | length' report.json

Result:

0
Current Status

After several debugging and recovery steps:

Working Components
CAPE Services

All CAPE services are now running correctly.
Guest VM responds correctly.
Agent is reachable: returns CAPE Agent response correctly.

DLL Injection

DLL injection now appears to work.

Inside guest VM:

tasklist /m version*

shows:

explorer.exe VERSION.dll

which suggests CAPE monitor DLL injection is active.

Current Remaining Issue

Although:

CAPE services are healthy
CAPE Agent connects successfully
VM is stable
DLL injection appears successful

the analysis still always ends with:

Hard Timeout reached

No behavior/process activity is produced.
CAPE Log Example
2026-05-27 06:31:34,476 [lib.cuckoo.core.guest] INFO:
Task #57: Guest is running CAPE Agent 0.20

2026-05-27 06:31:35,042 [lib.cuckoo.core.guest] INFO:
Task #57: Uploading script files to guest

2026-05-27 06:36:55,310 [lib.cuckoo.core.guest] ERROR:
Task #57: Hard Timeout reached! (Running for 320s, Limit 320s). Agent is likely unresponsive.
Security / Hardening Changes Already Applied
The following security settings were modified in the Windows guest VM.
UAC Disabled
Registry:
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
Result:

EnableLUA REG_DWORD 0x0
Windows Defender Disabled
sc query WinDefend

Result:

STATE : STOPPED
Exploit Protection Disabled

The following mitigations are disabled system-wide:

DEP
OFF
ASLR
OFF
CFG
OFF
SEHOP
OFF
Heap Protection
OFF
DynamicCode restrictions
NOTSET / OFF
Child Process restrictions
NOTSET
Binary Signature Enforcement
OFF / NOTSET
Additional Recovery Actions Already Performed
Repository Reset
git reset --hard HEAD
git clean -fd
git pull

Repository updated to latest master successfully.

CAPE Dependencies Reinstalled
poetry install

completed successfully.

Storage Cleanup

Removed:

old analyses
old binaries
temporary dumps
memory dumps

Disk space issue fixed.
Previous DLL Injection Errors

Earlier, CAPE experienced DLL injection failures similar to historical GitHub issues related to:

GetProcessInitialThreadId failed
Failed to inject DLL

After updating CAPEv2 to latest master branch, DLL injection appears to work again.
Request for Assistance

I would appreciate guidance regarding:

Why CAPE analysis reaches hard timeout even though:
Agent is connected
DLL injection appears successful
VM is stable
Whether there are known issues with:
Python 3.10.6 (32-bit)
latest CAPEv2 monitor DLL
analyzer.py execution on Windows 10 x64
Recommended guest Python version/architecture for latest CAPEv2.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions