TMethodImplementationIntercept
__dbk_fcall_wrapper
a3cb8bek0gx2yq34508xulv
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
iwcfbelmib.dll
Resource
win7-20220715-en
Target
iwcfbelmib.glf
Size
8.9MB
MD5
64407b3d50b351fb556850b5004ab591
SHA1
7ea3ed01bb26aaa7a90edd1c4fceea2de7ecebe1
SHA256
204f4aed39fc7625256f5f48812d8881c7f79b692bac0b0a484aba93205e061a
SHA512
25c0343283bb2097d135918c2eb61c8828575b4bef97a831577a321364ded073808c8588e391d681566974ef5ac192dd36ecaa4e05befddeb0b0e11833ef9e96
SSDEEP
196608:L/iXL4w4ygSB4O8wKy46/mL3HrszAzT5Ettp+MekmbRQQ5rJ7onpU:LQdfBV8wKK/uHYzAzdEl+MeLVQQ5rJcp
Processes:
resource | yara_rule |
---|---|
sample | themida |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
TMethodImplementationIntercept
__dbk_fcall_wrapper
a3cb8bek0gx2yq34508xulv
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ