Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
49a1ebef7b3885b8be72ad48dd0dcbcac4dd4ed8de10a1954db49a95a800b276.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
49a1ebef7b3885b8be72ad48dd0dcbcac4dd4ed8de10a1954db49a95a800b276.dll
Resource
win10v2004-20220812-en
Target
49a1ebef7b3885b8be72ad48dd0dcbcac4dd4ed8de10a1954db49a95a800b276
Size
17KB
MD5
13d91750122528c90cd49eb8888f7bf0
SHA1
3ff8625c4435673b6dbac0dae01f4e224e47fbdf
SHA256
49a1ebef7b3885b8be72ad48dd0dcbcac4dd4ed8de10a1954db49a95a800b276
SHA512
7ece5f55f10c498ab275a26692b02c4769e454e07ec2fb23d982b0caec98f2326e6c04c609987abab4e13d5819c7bc14342e3f3ddb888c2f29082ff890783450
SSDEEP
384:v+HdrAlxhnm8tP+qotiQTLtHlFFuYaHqVslJB5LeJc:vEdrmhN+tAQ1FBaKVsLfeJc
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ