Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
5e4464b15ce944449cf057f607d704f450a25b0494f0e1b6766a7e777e091eb1.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5e4464b15ce944449cf057f607d704f450a25b0494f0e1b6766a7e777e091eb1.dll
Resource
win10v2004-20221111-en
Target
5e4464b15ce944449cf057f607d704f450a25b0494f0e1b6766a7e777e091eb1
Size
17KB
MD5
0a004a845da370a4d3f614ca36936110
SHA1
29411d8f3e05a8a5e5c29731623eac70e13cef17
SHA256
5e4464b15ce944449cf057f607d704f450a25b0494f0e1b6766a7e777e091eb1
SHA512
9ee7a95494ac876357a13711bd96b378fb8e300d202659db76f74df5b6327415f57223e5ea7f279d1328eddd61d957c0338808b8a529c57ff7fef52515c4016a
SSDEEP
384:76PSmgqPpESLcz+uzAW1/JKqvE0bULxPsR:Bmgvz+WJQsR
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ