scanCook
scanbegin
Behavioral task
behavioral1
Sample
9254ce4b8ea984d5dee23637778fa5e547b321b90c6c523e814a7830c424d0aa.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9254ce4b8ea984d5dee23637778fa5e547b321b90c6c523e814a7830c424d0aa.dll
Resource
win10v2004-20220812-en
Target
9254ce4b8ea984d5dee23637778fa5e547b321b90c6c523e814a7830c424d0aa
Size
468KB
MD5
09b35226179b816c083fb16364cebe62
SHA1
35d6c746e93bc2297b810ef3d1359f645023ba25
SHA256
9254ce4b8ea984d5dee23637778fa5e547b321b90c6c523e814a7830c424d0aa
SHA512
d64ee9fb187f2e524c021ef8f9ced986c00b050f37cf7f91b3980d4f8e42cf2d4b21a16530cd610900f783dfd06ac531140310832643ab3dc335f25d0041352f
SSDEEP
12288:HvSDLUophoETnj2DaJ2nq7Mzdm0YA/eGAta31W1Cs:Hv47oETjMaJ2WRDws
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CreateProcessW
GetModuleHandleA
GetProcAddress
VirtualProtect
?uncaught_exception@std@@YA_NXZ
?what@exception@std@@UBEPBDXZ
WSAAsyncSelect
CoCreateInstance
SetTimer
OpenProcessToken
GetModuleFileNameExA
scanCook
scanbegin
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ