AccessibleObjectFromWindow
LresultFromObject
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Static task
static1
Behavioral task
behavioral1
Sample
6729be401eb23017b85c357194720ed8aac2c65d470ff74505d9bd9068eaad0d.dll
Resource
win7-20220310-en
Target
6729be401eb23017b85c357194720ed8aac2c65d470ff74505d9bd9068eaad0d
Size
8.4MB
MD5
c243e95112cf3f78a08b10746279049e
SHA1
2bd84db1ceb13c6a47de90d95d07ffda75ecbaf5
SHA256
6729be401eb23017b85c357194720ed8aac2c65d470ff74505d9bd9068eaad0d
SHA512
1327b201c80859dc8e83cbf9db576c95a2ddcd2966253cd80d1b474c7b8166c91ab66ce08974d2233d594a632bdfc3febc93e12697aae0e49e3348d1e3e30830
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
timeGetTime
DocumentPropertiesW
GetSaveFileNameW
ImageList_GetImageInfo
Shell_NotifyIconW
CopyImage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
GetFileVersionInfoSizeW
SysFreeString
RegSetValueExW
NetWkstaGetInfo
strncmp
GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gethostbyaddr
IsEqualGUID
Pie
WTSSendMessageW
AccessibleObjectFromWindow
LresultFromObject
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ