DllRegisterServer
Initi
Behavioral task
behavioral1
Sample
d3930b2494f45bb2c169124d4a39308303b9e8e87043afc54327c1e2a378e4e0.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d3930b2494f45bb2c169124d4a39308303b9e8e87043afc54327c1e2a378e4e0.dll
Resource
win10v2004-20220901-en
Target
d3930b2494f45bb2c169124d4a39308303b9e8e87043afc54327c1e2a378e4e0.exe
Size
5.3MB
MD5
158a8fee1a87324edb596e920e7d474e
SHA1
d33a41cf65580e0e455871e63b6562572dc15577
SHA256
d3930b2494f45bb2c169124d4a39308303b9e8e87043afc54327c1e2a378e4e0
SHA512
5029b63f941b1ff1b4c67a1309ef7b82a3a1fc4039bbfd20c7b91b31b7113d93c328cc39d91cc2d868560959ded7caea044db354b84a766e1c250bcf10d317e4
SSDEEP
98304:+59tOYSZw3491EtsGwcRQQo4J+gq2VrWunSfKl/E3iySxRJhXhWx8F7xKL:+XcY291E4vQo4J+gS9fKUSxRnciFA
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CryptAcquireContextW
GetLastError
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
WTSSendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
DllRegisterServer
Initi
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ