AccessibleObjectFromWindow
LresultFromObject
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll
Resource
win7-20220310-en
Target
3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
Size
10.0MB
MD5
59431e5b73b362bf13f6cbc8f593f465
SHA1
927fb2c5ac6da16214209d28264d850e7228ed7a
SHA256
3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
SHA512
cfd086fa39be7be0f725b3998545bdf3d6ff9a012187cc4505ac7f1f79770cfcf01295f93e6e8984f5aece57d4b4cdeaf1545bedcae2ecb9957ca42feb75b72e
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
timeGetTime
DocumentPropertiesW
ImageList_GetImageInfo
SHGetFolderPathW
CopyImage
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
GetFileVersionInfoSizeW
SysFreeString
RegSetValueExW
NetWkstaGetInfo
strncmp
GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gethostbyaddr
IsEqualGUID
Pie
WTSSendMessageW
AccessibleObjectFromWindow
LresultFromObject
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ