??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
Behavioral task
behavioral1
Sample
20d7da8337d75ef19a259221e8c19dd6ec5d3018556a5d49c8044073807e8a12.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
20d7da8337d75ef19a259221e8c19dd6ec5d3018556a5d49c8044073807e8a12.dll
Resource
win10v2004-20220812-en
Target
20d7da8337d75ef19a259221e8c19dd6ec5d3018556a5d49c8044073807e8a12
Size
536KB
MD5
69e40e260b8892965c05575693839657
SHA1
140794103156ea64c2b0baae4c110ba166d53f97
SHA256
20d7da8337d75ef19a259221e8c19dd6ec5d3018556a5d49c8044073807e8a12
SHA512
220746077119175977df2a9e85f9084a55184c6eceb669ca81d2558e5b2f6777ececf768dadd51a607a599442550a70e5676755b2254ba52d6b90a20c6fb8086
SSDEEP
12288:6+73OWCSMBwr/ciFrVZ21RiLtaCdrXRJNx/t+1zzxvsRlEk:6wdC5w761RiLtFrhJ/l6zza5
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
StrRetToBufA
CoCreateInstance
SHGetMalloc
FindNextFileW
GetModuleHandleA
GetProcAddress
VirtualProtect
?uncaught_exception@std@@YA_NXZ
_vsnprintf_s
WSAAsyncSelect
FindWindowA
RegQueryValueExA
??0smss@@QAE@XZ
??1smss@@QAE@XZ
??4smss@@QAEAAV0@ABV0@@Z
?rsacnReslut@@YAXXZ
scanMiddle
scanbegin
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ