?InstallSectionA@@YGPAFE<V
?CopyMonitorExW@@YGPAEPAI<V
?LoadListItemNew@@YGPAGEPAHE<V
?LoadMutexEx@@YGPAFDGPAGN<V
?AddScreenEx@@YGHPAM<V
?PutFilePath@@YGMMN<V
Static task
static1
Behavioral task
behavioral1
Sample
51f490dcf5375c53dc5bf9f9774e21b3b2fa8c5d28f465808068b9e757364bce.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
51f490dcf5375c53dc5bf9f9774e21b3b2fa8c5d28f465808068b9e757364bce.dll
Resource
win10v2004-20220812-en
Target
51f490dcf5375c53dc5bf9f9774e21b3b2fa8c5d28f465808068b9e757364bce
Size
81KB
MD5
61d828bd518617ffde1b11510e74f2de
SHA1
14c339de2cf02a3c48f48ef53a17636d0e2d8fb9
SHA256
51f490dcf5375c53dc5bf9f9774e21b3b2fa8c5d28f465808068b9e757364bce
SHA512
88c23a857ebe28da2cb29d95d51759aa3af220a196e6f697e966a9ce64bacd524d24c432c1fcf9ca862a5c7c4093353a093fe1b0c81570f507fb73debe12df24
SSDEEP
1536:FX/s5ydxo3GNlK48vDLZbvm9aNaXmeNfHImL9mQJQD:FX/98uZ+J8aSL9os4qQ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
KeRemoveByKeyDeviceQueue
ZwOpenSymbolicLinkObject
KeWaitForSingleObject
IofCallDriver
RtlCharToInteger
PsCreateSystemThread
SeOpenObjectAuditAlarm
IoUpdateShareAccess
IoConnectInterrupt
ZwSetVolumeInformationFile
ZwOpenProcess
IoAllocateWorkItem
CcMdlReadComplete
RtlFreeAnsiString
PsImpersonateClient
KeBugCheck
KdDisableDebugger
KeSetTimerEx
ExAcquireFastMutexUnsafe
ZwDeviceIoControlFile
FsRtlNotifyInitializeSync
SeQueryAuthenticationIdToken
CcPurgeCacheSection
RtlFindUnicodePrefix
SeTokenIsAdmin
SeReleaseSubjectContext
ExRaiseAccessViolation
IoCreateStreamFileObjectLite
DbgBreakPoint
FsRtlIsTotalDeviceFailure
ExRegisterCallback
RtlUpcaseUnicodeString
MmMapLockedPages
IoCheckShareAccess
KeClearEvent
RtlCopyString
KeInitializeTimer
IoIsOperationSynchronous
ProbeForWrite
RtlEqualUnicodeString
RtlAddAccessAllowedAceEx
RtlTimeToSecondsSince1970
IoDeleteDevice
IoWriteErrorLogEntry
RtlCopyUnicodeString
IoRegisterDeviceInterface
CcMdlWriteComplete
ZwCreateDirectoryObject
KeQuerySystemTime
CcFastCopyWrite
RtlClearAllBits
IoAllocateMdl
KeDelayExecutionThread
DbgPrompt
IoAcquireVpbSpinLock
ZwReadFile
RtlCreateAcl
RtlWriteRegistryValue
KeSetBasePriorityThread
ZwOpenSection
ExAllocatePoolWithQuotaTag
IoMakeAssociatedIrp
CcCanIWrite
IoGetDeviceProperty
IoGetLowerDeviceObject
KeInsertQueue
CcPreparePinWrite
IoReleaseVpbSpinLock
IoBuildSynchronousFsdRequest
ExSetTimerResolution
MmProbeAndLockPages
RtlFindLongestRunClear
IoGetRelatedDeviceObject
RtlUnicodeToOemN
MmUnlockPages
IoSetDeviceInterfaceState
SeTokenIsRestricted
CcGetFileObjectFromBcb
VerSetConditionMask
RtlTimeFieldsToTime
MmBuildMdlForNonPagedPool
PsChargeProcessPoolQuota
ZwFreeVirtualMemory
FsRtlCheckLockForWriteAccess
ZwQueryVolumeInformationFile
ZwNotifyChangeKey
ExSetResourceOwnerPointer
RtlCreateRegistryKey
RtlDeleteElementGenericTable
MmPageEntireDriver
KeCancelTimer
RtlClearBits
FsRtlFreeFileLock
ZwCreateKey
IoReadPartitionTable
RtlFillMemoryUlong
KeQueryInterruptTime
SeSinglePrivilegeCheck
IoInitializeIrp
KeSaveFloatingPointState
RtlDeleteNoSplay
RtlEqualString
ObGetObjectSecurity
KeUnstackDetachProcess
RtlInitString
MmFreeMappingAddress
IoBuildPartialMdl
RtlEnumerateGenericTable
RtlValidSid
KeQueryActiveProcessors
SePrivilegeCheck
KeInsertQueueDpc
IoRegisterFileSystem
IoSetPartitionInformation
FsRtlIsFatDbcsLegal
IoQueryFileInformation
IoStartTimer
IoAllocateErrorLogEntry
ZwDeleteValueKey
RtlLengthSecurityDescriptor
RtlCompareString
KeSynchronizeExecution
FsRtlNotifyUninitializeSync
SeLockSubjectContext
ZwSetSecurityObject
MmSizeOfMdl
RtlFreeUnicodeString
RtlSubAuthoritySid
RtlCreateUnicodeString
KeInitializeDpc
KeReleaseMutex
IoCheckQuotaBufferValidity
IoSetTopLevelIrp
IoSetThreadHardErrorMode
ObMakeTemporaryObject
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
ExAllocatePoolWithTag
ZwQueryKey
RtlInitializeBitMap
RtlCopyLuid
IoInitializeTimer
IoGetDeviceObjectPointer
PsReturnPoolQuota
SeFreePrivileges
ProbeForRead
SeUnlockSubjectContext
ZwOpenKey
RtlSetDaclSecurityDescriptor
RtlCopySid
RtlFindSetBits
IoCreateDevice
PoSetSystemState
ExDeletePagedLookasideList
RtlOemToUnicodeN
CcUnpinRepinnedBcb
CcPinRead
PsGetCurrentProcess
ZwQueryObject
MmUnlockPagableImageSection
RtlValidSecurityDescriptor
MmUnmapLockedPages
IoReleaseRemoveLockAndWaitEx
IoReportResourceForDetection
FsRtlFastCheckLockForRead
IoGetTopLevelIrp
KeLeaveCriticalRegion
PsGetThreadProcessId
ZwWriteFile
MmAddVerifierThunks
IoCreateFile
IoStopTimer
IoSetHardErrorOrVerifyDevice
FsRtlAllocateFileLock
KeRestoreFloatingPointState
MmAllocateMappingAddress
KeRemoveQueueDpc
KeInitializeDeviceQueue
KeBugCheckEx
ExFreePool
RtlCreateSecurityDescriptor
MmSecureVirtualMemory
PsGetCurrentProcessId
IoWMIRegistrationControl
CcMapData
IoGetDeviceInterfaces
RtlAppendStringToString
IoAllocateAdapterChannel
FsRtlIsDbcsInExpression
IoDeleteSymbolicLink
IoGetAttachedDeviceReference
KeWaitForMultipleObjects
RtlFindLeastSignificantBit
ExRaiseStatus
RtlSetAllBits
KeReadStateTimer
RtlUnicodeStringToOemString
KeRemoveQueue
KeResetEvent
IoIsSystemThread
MmForceSectionClosed
KeRundownQueue
KeDeregisterBugCheckCallback
KeGetCurrentThread
RtlMultiByteToUnicodeN
CcUnpinData
MmMapUserAddressesToPage
IoWMIWriteEvent
MmSetAddressRangeModified
KeAttachProcess
IoFreeMdl
RtlVerifyVersionInfo
WmiQueryTraceInformation
RtlInt64ToUnicodeString
RtlInitializeUnicodePrefix
RtlGetCallersAddress
RtlCheckRegistryKey
RtlDelete
IoGetDiskDeviceObject
PsLookupThreadByThreadId
CcUninitializeCacheMap
MmCanFileBeTruncated
MmFreePagesFromMdl
RtlDowncaseUnicodeString
ObfReferenceObject
IoSetDeviceToVerify
SeAssignSecurity
PsGetProcessId
IoWritePartitionTableEx
IoFreeIrp
RtlRemoveUnicodePrefix
MmAllocatePagesForMdl
IoCheckEaBufferValidity
KeStackAttachProcess
IoGetStackLimits
IoCreateStreamFileObject
ExLocalTimeToSystemTime
IoFreeErrorLogEntry
ExAllocatePool
DbgBreakPointWithStatus
IoFreeWorkItem
IoGetCurrentProcess
IoReportDetectedDevice
CcRepinBcb
IoReadPartitionTableEx
CcRemapBcb
IoSetShareAccess
PoUnregisterSystemState
ZwFsControlFile
RtlFindLastBackwardRunClear
RtlVolumeDeviceToDosName
PsGetVersion
KeSetEvent
ZwOpenFile
ObQueryNameString
ExDeleteNPagedLookasideList
ObCreateObject
?InstallSectionA@@YGPAFE<V
?CopyMonitorExW@@YGPAEPAI<V
?LoadListItemNew@@YGPAGEPAHE<V
?LoadMutexEx@@YGPAFDGPAGN<V
?AddScreenEx@@YGHPAM<V
?PutFilePath@@YGMMN<V
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ