Static task
static1
Behavioral task
behavioral1
Sample
618849cb9db45d2d2779eb437ab3939f7c59628a3d4de964022539ce5a4c3c4a.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
618849cb9db45d2d2779eb437ab3939f7c59628a3d4de964022539ce5a4c3c4a.dll
Resource
win10v2004-20220901-en
General
-
Target
618849cb9db45d2d2779eb437ab3939f7c59628a3d4de964022539ce5a4c3c4a
-
Size
73KB
-
MD5
0e97ed3bdde9f9fdc00de6f1c4367cfd
-
SHA1
cacb982d049040fe17e9d3003bf0dd2b366c679d
-
SHA256
618849cb9db45d2d2779eb437ab3939f7c59628a3d4de964022539ce5a4c3c4a
-
SHA512
431599bcde84642ae65c88cfd24d6d2220504c17b94ef8e6d273e7468491e7af00a341ae4ac35452520135506c6dfdd0de4a941758f711028ad3f67023f06b52
-
SSDEEP
1536:pS7XuAWRcbqFb2gII73A/3HKlANH2P47vN:pSzjWRcb6b25L/6lANH2PYvN
Malware Config
Signatures
Files
-
618849cb9db45d2d2779eb437ab3939f7c59628a3d4de964022539ce5a4c3c4a.dll windows x86
0d08f8076cd2ce7c2b6d7b7bc2d3d9a7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PoRequestPowerIrp
MmMapIoSpace
KeSetEvent
RtlInitUnicodeString
RtlCharToInteger
KeInitializeMutex
RtlCompareString
ZwMakeTemporaryObject
ZwEnumerateValueKey
PsLookupThreadByThreadId
MmIsAddressValid
RtlIntegerToUnicodeString
MmMapLockedPagesSpecifyCache
FsRtlIsTotalDeviceFailure
DbgBreakPointWithStatus
RtlFindLeastSignificantBit
KeRemoveEntryDeviceQueue
RtlEqualString
KeWaitForMultipleObjects
ExDeleteNPagedLookasideList
ProbeForRead
RtlInitString
ObReferenceObjectByHandle
RtlEqualUnicodeString
hal
HalAcquireDisplayOwnership
KeQueryPerformanceCounter
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 812B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ