?CancelListItemOld@@YGPAXHHG<V
?DeleteCommandLineExA@@YGPAMPAG<V
?InvalidateWindowInfoExW@@YG_NJF<V
?CloseObjectExA@@YGPAXPADPAIGM<V
?InstallFunctionExA@@YGPAFNE<V
?InstallEventNew@@YGHHM<V
Static task
static1
Behavioral task
behavioral1
Sample
02271fc0a00f71de156605533491cf5c9fbefe99e3100c4a7d699817d47d73ce.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
02271fc0a00f71de156605533491cf5c9fbefe99e3100c4a7d699817d47d73ce.dll
Resource
win10v2004-20220812-en
Target
02271fc0a00f71de156605533491cf5c9fbefe99e3100c4a7d699817d47d73ce
Size
135KB
MD5
ab4a9e764b9b83bc98222b6f7a0ef049
SHA1
de4b8d63f9664ced52330e0d58bbd48ea2ae9890
SHA256
02271fc0a00f71de156605533491cf5c9fbefe99e3100c4a7d699817d47d73ce
SHA512
32cb0f1eb206bb6ca2966e5c984bf76ec0bfac22317b3dd04b5bdc4555e501c8309eb5d349dd7ac121447ca295b3078e0b9d0505197c114d2c643051eebe7e98
SSDEEP
3072:E0EsuqTAH/upQAWU7ZcY6x0OvLAHh/T6JciDmmUSK0x6:EHsuqkfunWU7Zp6xBAHtjiDUK
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IoAllocateWorkItem
CcMdlWriteAbort
ExGetExclusiveWaiterCount
VerSetConditionMask
ZwOpenSection
RtlInitString
IoSetPartitionInformationEx
IoDeviceObjectType
FsRtlLookupLastLargeMcbEntry
RtlxOemStringToUnicodeSize
MmFreeMappingAddress
CcFastMdlReadWait
ExRaiseDatatypeMisalignment
IoGetLowerDeviceObject
RtlVerifyVersionInfo
KeReadStateTimer
ExReinitializeResourceLite
PsGetProcessExitTime
FsRtlNotifyUninitializeSync
MmAddVerifierThunks
IoRegisterDeviceInterface
ZwCreateKey
IoCreateStreamFileObjectLite
ExDeleteNPagedLookasideList
CcMdlReadComplete
CcCopyWrite
RtlSplay
IoGetRequestorProcessId
ObQueryNameString
KeReleaseSemaphore
MmProbeAndLockPages
SeTokenIsAdmin
KeWaitForSingleObject
RtlUnicodeToMultiByteN
KeSetEvent
CcPurgeCacheSection
MmCanFileBeTruncated
IoVolumeDeviceToDosName
RtlUnicodeStringToAnsiString
ExAcquireFastMutexUnsafe
IoDeleteSymbolicLink
RtlFreeUnicodeString
PoSetSystemState
RtlFindSetBits
KeFlushQueuedDpcs
ZwOpenProcess
ZwQueryValueKey
IoAllocateAdapterChannel
SeTokenIsRestricted
ZwFreeVirtualMemory
KefAcquireSpinLockAtDpcLevel
IoInitializeIrp
RtlFreeAnsiString
MmQuerySystemSize
FsRtlDeregisterUncProvider
IoGetCurrentProcess
IoCheckShareAccess
ZwClose
ProbeForRead
KeInitializeSpinLock
IoGetDeviceProperty
RtlCreateSecurityDescriptor
KeDetachProcess
RtlFreeOemString
CcSetReadAheadGranularity
RtlTimeToTimeFields
RtlInitAnsiString
KeGetCurrentThread
ZwUnloadDriver
KeUnstackDetachProcess
MmMapUserAddressesToPage
MmAllocatePagesForMdl
ExVerifySuite
MmAllocateMappingAddress
RtlIntegerToUnicodeString
RtlUnicodeStringToOemString
RtlAddAccessAllowedAce
IoRequestDeviceEject
IoRegisterFileSystem
FsRtlFastCheckLockForRead
RtlxUnicodeStringToAnsiSize
FsRtlMdlWriteCompleteDev
?CancelListItemOld@@YGPAXHHG<V
?DeleteCommandLineExA@@YGPAMPAG<V
?InvalidateWindowInfoExW@@YG_NJF<V
?CloseObjectExA@@YGPAXPADPAIGM<V
?InstallFunctionExA@@YGPAFNE<V
?InstallEventNew@@YGHHM<V
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ