CancelDll
LoadDll
Behavioral task
behavioral1
Sample
4951f2d935cdc913df698c59063bf8bb0fdf9e0d58e9f7f981f5f1e23200e56d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4951f2d935cdc913df698c59063bf8bb0fdf9e0d58e9f7f981f5f1e23200e56d.dll
Resource
win10v2004-20220812-en
Target
4951f2d935cdc913df698c59063bf8bb0fdf9e0d58e9f7f981f5f1e23200e56d
Size
60KB
MD5
297b48c1b6000b37b76c6ce6ff490470
SHA1
5a650434eaadeb5efb0c6c19938958a114b4fefc
SHA256
4951f2d935cdc913df698c59063bf8bb0fdf9e0d58e9f7f981f5f1e23200e56d
SHA512
7c5375470dd1e3177fc808f5c52310b9b890b6aedce6fe754f40bbec7ce24783379ac9d9f8d9d86786d76f22cb7f8be2cc7465740c86b0bdfff4a0688c3adb8d
SSDEEP
1536:EdNs9O6qwtr2YWk5sX011MPnLwEmhkQkgpDZwWrN7BAceP:EdNs9O6rrlWUsE0PEJftpdpJi1
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ