?IsSemaphoreOriginal@@YGIJNPAM<V
?InsertWidthW@@YGGIFHE<V
?CrtComponent@@YGEPAEPAFN<V
?FreeStringExA@@YGPAXMM<V
?SendPointerExA@@YGPAHPAM_N_NF<V
?InstallProviderNew@@YGDGE<V
Static task
static1
Behavioral task
behavioral1
Sample
b246a24a8659851816ec17e4fb23be136923f1b50d6196757220e8fe1c5e6fb6.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b246a24a8659851816ec17e4fb23be136923f1b50d6196757220e8fe1c5e6fb6.dll
Resource
win10v2004-20221111-en
Target
b246a24a8659851816ec17e4fb23be136923f1b50d6196757220e8fe1c5e6fb6
Size
76KB
MD5
9a56c0d9a5c1f214e35ef8d13dbaef38
SHA1
f68f3b11bdcfad3b80f2ba7f137b02ad65b58720
SHA256
b246a24a8659851816ec17e4fb23be136923f1b50d6196757220e8fe1c5e6fb6
SHA512
ef4d25dc7df3a56562e483ae22f30b07163f8f67cb45c312186c0f41566fa1a5e17b1b3efa609fd7e9d32af2593e34a1f8c64a7c9326ad598026577f93b6b0ab
SSDEEP
1536:aQC0WsVbggSCwQiTVlvsm6LPAcYZCT7sPU6Hnvalt1R:pCaVb2b8LPAcbsP7ilt1
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
RtlWriteRegistryValue
IoFreeMdl
RtlMultiByteToUnicodeN
CcGetFileObjectFromBcb
MmIsThisAnNtAsSystem
IoAcquireCancelSpinLock
RtlUnicodeStringToInteger
RtlDeleteRegistryValue
MmHighestUserAddress
IoGetTopLevelIrp
ObReferenceObjectByHandle
ZwEnumerateKey
ObReferenceObjectByPointer
ExRaiseDatatypeMisalignment
RtlCopySid
FsRtlCheckLockForReadAccess
KeGetCurrentThread
ZwPowerInformation
IoVerifyVolume
KeReadStateTimer
KeInitializeSemaphore
IoConnectInterrupt
CcFlushCache
ZwMapViewOfSection
IoRemoveShareAccess
RtlGenerate8dot3Name
RtlFindSetBits
IoWriteErrorLogEntry
ZwAllocateVirtualMemory
KdDisableDebugger
RtlFindNextForwardRunClear
RtlRandom
MmMapUserAddressesToPage
ZwNotifyChangeKey
MmMapLockedPages
ExDeletePagedLookasideList
KeReleaseSemaphore
ZwClose
ZwCreateKey
PsSetLoadImageNotifyRoutine
KeRevertToUserAffinityThread
ExGetExclusiveWaiterCount
IoWritePartitionTableEx
IoFreeErrorLogEntry
SeCreateClientSecurity
MmPageEntireDriver
IoCreateSynchronizationEvent
RtlFindClearRuns
PoCallDriver
KeReadStateEvent
SePrivilegeCheck
ObfDereferenceObject
RtlTimeToTimeFields
KeQueryActiveProcessors
KeQuerySystemTime
CcFastCopyRead
IoIsSystemThread
KeSetKernelStackSwapEnable
FsRtlCheckLockForWriteAccess
RtlCompareMemory
RtlUpperString
RtlStringFromGUID
MmFreeMappingAddress
SeReleaseSubjectContext
KeInitializeMutex
IoInitializeIrp
SeAppendPrivileges
ExInitializeResourceLite
RtlSubAuthoritySid
IoAllocateController
IoDisconnectInterrupt
RtlFreeOemString
KeInitializeApc
ZwSetSecurityObject
RtlGetNextRange
KeInitializeDpc
RtlDowncaseUnicodeString
IoReadDiskSignature
MmQuerySystemSize
ProbeForRead
KeInsertQueueDpc
KeInsertHeadQueue
FsRtlMdlWriteCompleteDev
IoCreateDisk
IoStopTimer
ExGetSharedWaiterCount
MmGetSystemRoutineAddress
RtlUpcaseUnicodeChar
MmAddVerifierThunks
RtlUnicodeToOemN
RtlGetCallersAddress
RtlRemoveUnicodePrefix
IoInitializeRemoveLockEx
RtlUnicodeToMultiByteN
IoStartTimer
IoGetDeviceToVerify
KeReadStateSemaphore
KeRemoveDeviceQueue
ZwCreateSection
ExUuidCreate
IoReportResourceForDetection
RtlSetBits
MmUnmapIoSpace
PoRequestPowerIrp
ZwOpenFile
FsRtlIsFatDbcsLegal
IoQueueWorkItem
CcIsThereDirtyData
IoSetPartitionInformationEx
KeDetachProcess
ExDeleteNPagedLookasideList
CcMdlWriteComplete
RtlAreBitsClear
CcSetReadAheadGranularity
IoRaiseHardError
IoReleaseCancelSpinLock
IoReportDetectedDevice
FsRtlFreeFileLock
RtlAnsiStringToUnicodeString
MmMapLockedPagesSpecifyCache
CcMapData
KeReleaseMutex
KeFlushQueuedDpcs
SeSinglePrivilegeCheck
RtlFindUnicodePrefix
RtlGetVersion
PsGetProcessExitTime
IoGetDiskDeviceObject
IoAllocateMdl
ExIsProcessorFeaturePresent
RtlUpperChar
MmAllocateMappingAddress
RtlClearAllBits
IoReleaseRemoveLockAndWaitEx
ExAllocatePool
CcUnpinDataForThread
ZwCreateFile
IoGetDeviceObjectPointer
RtlAddAccessAllowedAceEx
ZwQueryKey
KePulseEvent
RtlFreeAnsiString
KeClearEvent
ZwOpenSymbolicLinkObject
IoOpenDeviceRegistryKey
IoUpdateShareAccess
IoInitializeTimer
RtlFillMemoryUlong
ExLocalTimeToSystemTime
IoDeleteController
KeInitializeDeviceQueue
FsRtlFastCheckLockForRead
IoDetachDevice
MmSetAddressRangeModified
RtlEqualString
KeInitializeSpinLock
RtlSetDaclSecurityDescriptor
ObfReferenceObject
SeDeleteObjectAuditAlarm
RtlxAnsiStringToUnicodeSize
MmGetPhysicalAddress
ExAllocatePoolWithQuotaTag
CcZeroData
IoInvalidateDeviceRelations
RtlInitUnicodeString
CcDeferWrite
IoSetDeviceToVerify
KeRegisterBugCheckCallback
FsRtlFastUnlockSingle
KeLeaveCriticalRegion
KeInsertByKeyDeviceQueue
PsDereferencePrimaryToken
CcMdlWriteAbort
DbgPrompt
RtlFindClearBitsAndSet
KeBugCheckEx
RtlInitializeGenericTable
PsChargeProcessPoolQuota
IoVerifyPartitionTable
RtlSecondsSince1980ToTime
KeCancelTimer
IoThreadToProcess
SeOpenObjectAuditAlarm
RtlLengthRequiredSid
CcSetDirtyPinnedData
KeQueryTimeIncrement
IoAcquireRemoveLockEx
IoAllocateErrorLogEntry
IoAcquireVpbSpinLock
KeUnstackDetachProcess
IoBuildPartialMdl
RtlNtStatusToDosError
KeReadStateMutex
ZwQueryVolumeInformationFile
IoAllocateAdapterChannel
IoSetStartIoAttributes
ExAllocatePoolWithTag
KeEnterCriticalRegion
KdEnableDebugger
ObQueryNameString
IoGetDmaAdapter
RtlAnsiCharToUnicodeChar
RtlCreateUnicodeString
RtlFindLastBackwardRunClear
KeSetTimerEx
RtlCopyLuid
CcFastCopyWrite
IoRegisterDeviceInterface
IoInvalidateDeviceState
MmBuildMdlForNonPagedPool
ExReleaseResourceLite
KeSetImportanceDpc
CcSetBcbOwnerPointer
IoWMIWriteEvent
RtlCreateSecurityDescriptor
KeInsertQueue
SeCaptureSubjectContext
ZwCreateEvent
MmSizeOfMdl
MmAllocateNonCachedMemory
IoCreateNotificationEvent
KeRemoveQueueDpc
IoGetAttachedDevice
RtlFindClearBits
IoGetDriverObjectExtension
FsRtlLookupLastLargeMcbEntry
MmFreeContiguousMemory
PoUnregisterSystemState
IoGetCurrentProcess
SeUnlockSubjectContext
IoSetThreadHardErrorMode
RtlExtendedIntegerMultiply
RtlHashUnicodeString
RtlDeleteElementGenericTable
SeAccessCheck
IoWMIRegistrationControl
FsRtlCheckOplock
ZwOpenKey
DbgBreakPointWithStatus
KeInitializeQueue
RtlTimeToSecondsSince1970
RtlCreateAcl
FsRtlIsTotalDeviceFailure
PsGetCurrentThread
CcMdlRead
MmUnmapLockedPages
ObMakeTemporaryObject
KefAcquireSpinLockAtDpcLevel
ExFreePoolWithTag
KeInitializeTimerEx
ZwSetValueKey
ExRaiseAccessViolation
RtlInitializeUnicodePrefix
IoGetRequestorProcess
KeAttachProcess
IoCreateStreamFileObject
MmUnmapReservedMapping
CcCanIWrite
MmProbeAndLockProcessPages
ExRegisterCallback
RtlFindLeastSignificantBit
?IsSemaphoreOriginal@@YGIJNPAM<V
?InsertWidthW@@YGGIFHE<V
?CrtComponent@@YGEPAEPAFN<V
?FreeStringExA@@YGPAXMM<V
?SendPointerExA@@YGPAHPAM_N_NF<V
?InstallProviderNew@@YGDGE<V
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ