DllInstall
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
a5989c480ec6506247325652a1f3cb415934675de3877270ae0f65edd9b14d13.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a5989c480ec6506247325652a1f3cb415934675de3877270ae0f65edd9b14d13.dll
Resource
win10v2004-20220812-en
Target
a5989c480ec6506247325652a1f3cb415934675de3877270ae0f65edd9b14d13.dll
Size
766KB
MD5
520ee511034717f5499fb66f9c0b76a5
SHA1
3a33de9a84bbc76161895178e3d13bcd28f7d8fe
SHA256
a5989c480ec6506247325652a1f3cb415934675de3877270ae0f65edd9b14d13
SHA512
71aa0b3c175ac0ac90e837e649cdc7013262cf62265ba02f3ecdcbd7bbc8a20574fecfa21189572039ad4cafc3b41c5a12ad26ad9bafd4d1f70bfd931a7737be
SSDEEP
12288:bMzdMxHXTL+RGjMY9Hrc6yOHXOpcAFVWfKxob/ytkYag:bMZaBL/dXOp3FcfKxo7Ca
resource | yara_rule |
---|---|
sample | family_egregor |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetCommandLineW
VirtualAlloc
Sleep
LoadLibraryW
GetProcAddress
CreateFileW
VirtualQuery
VirtualFree
VirtualProtect
GetCurrentProcess
FlushInstructionCache
IsBadReadPtr
LoadLibraryA
FreeLibrary
lstrcmpA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetProcessHeap
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringA
OutputDebugStringW
CloseHandle
WaitForSingleObjectEx
CreateThread
WriteConsoleW
EncodePointer
DecodePointer
DllInstall
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ