??����?��??��yD��
??����D��??��yD��
?a?��
?��?��
RunDllHostCallBack
Behavioral task
behavioral1
Sample
50f461abd677061033f4c91e9cc6f23c3c7aaf286c3daa0f940f169a62e5eccb.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
50f461abd677061033f4c91e9cc6f23c3c7aaf286c3daa0f940f169a62e5eccb.dll
Resource
win10v2004-20221111-en
Target
50f461abd677061033f4c91e9cc6f23c3c7aaf286c3daa0f940f169a62e5eccb
Size
904KB
MD5
1834ae31911236fab8af0150c99e8160
SHA1
0d129a9ca6eb0206de261be1061ea54a4f941ada
SHA256
50f461abd677061033f4c91e9cc6f23c3c7aaf286c3daa0f940f169a62e5eccb
SHA512
295ed733833fe247389ccfae62f0210bbd856a354b4a9720268830dddd57f50287e0ac13cfea7d7b356f6e3e9d53141298f8c5a833ec850aa763ddef51c94ec0
SSDEEP
24576:rAl7ThOfQcMRO8EzJj3eHd/N7vwFHXS52GA:ElpOaRV+dUd/N7vwF62F
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CharNextA
BitBlt
waveOutPrepareHeader
OpenPrinterA
RegOpenKeyExA
ShellExecuteA
StgCreateDocfileOnILockBytes
SafeArrayGetElemsize
ord17
ord8
accept
GetSaveFileNameA
??����?��??��yD��
??����D��??��yD��
?a?��
?��?��
RunDllHostCallBack
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ