rundll_entryW
Static task
static1
Behavioral task
behavioral1
Sample
6d901907980bad2d3ba92ccf961613a4199373723e7ef51ef70821c8bd401000.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6d901907980bad2d3ba92ccf961613a4199373723e7ef51ef70821c8bd401000.dll
Resource
win10v2004-20220812-en
General
-
Target
6d901907980bad2d3ba92ccf961613a4199373723e7ef51ef70821c8bd401000
-
Size
400KB
-
MD5
0c0819d795138513dc3608e5cd39a920
-
SHA1
468f193ce6fcb55c18f3cc09909842c8fe3b6691
-
SHA256
6d901907980bad2d3ba92ccf961613a4199373723e7ef51ef70821c8bd401000
-
SHA512
b451fe4046d210496788f550c913afdc719850bea683bf2436e2332084df3f1b2c472a8cb5acdb22524d449eb60a3e40a09b8e74867b613e6673cc1ab8dfbccb
-
SSDEEP
6144:8focQprVispJWhW5qbCbHb7B6xc5vOyP5HUQjz0xkzz:8fGVi0WhJeb77B6y5vDz3
Malware Config
Signatures
Files
-
6d901907980bad2d3ba92ccf961613a4199373723e7ef51ef70821c8bd401000.dll windows x86
62c710c2a5167999c4ae6d49874cadb6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OpenProcess
SetLastError
CloseHandle
WaitForSingleObject
FlushViewOfFile
ReleaseMutex
CreateFileMappingW
MapViewOfFileEx
CreateMutexW
OpenMutexW
OpenFileMappingW
UnmapViewOfFile
CreateEventW
CreateThread
SetEvent
TerminateThread
ResetEvent
GetTickCount
SetErrorMode
GetModuleFileNameW
GetLastError
GetCurrentProcess
DuplicateHandle
GetCurrentThreadId
OpenEventW
Sleep
GetCurrentDirectoryW
IsBadCodePtr
InterlockedIncrement
InterlockedExchangeAdd
WaitForMultipleObjects
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
AttachConsole
GetPrivateProfileIntW
GetACP
MoveFileW
OutputDebugStringW
OutputDebugStringA
MultiByteToWideChar
GetLocalTime
CreateFileW
GetFileSize
WriteFile
IsBadWritePtr
CreateProcessW
IsBadReadPtr
DisableThreadLibraryCalls
GetCurrentProcessId
GetTempPathW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetFileAttributesW
InterlockedDecrement
GetCommandLineA
RaiseException
RtlUnwind
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
WideCharToMultiByte
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
VirtualAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
GetModuleHandleA
advapi32
InitializeSecurityDescriptor
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
SetSecurityDescriptorDacl
shell32
ShellExecuteExW
CommandLineToArgvW
Exports
Exports
Sections
.text Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 252KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE