DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
97669bd0f2c115d4e7b4a7905aac075ae90b92c1b5e078c4c03b5a49473456dc.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
97669bd0f2c115d4e7b4a7905aac075ae90b92c1b5e078c4c03b5a49473456dc.dll
Resource
win10v2004-20221111-en
Target
97669bd0f2c115d4e7b4a7905aac075ae90b92c1b5e078c4c03b5a49473456dc
Size
256KB
MD5
874a07e1d648d222fd20a43053e222a0
SHA1
809bfdbda2b0284c7bcd443f236eee99010be7c1
SHA256
97669bd0f2c115d4e7b4a7905aac075ae90b92c1b5e078c4c03b5a49473456dc
SHA512
ec607d25b94858e37b770a90845328bd498a1ed27473d0795dc42bde4ac2e86f6d071951817abd19644fe0c135ce57427298394da04e9d7ab71c53b8d261ec54
SSDEEP
6144:z11t8bMRtXQMk39rJYMggSDiqhmSBvrGVEJf1kxSAQUq7ypk:zyM/XQMkN1YvDdoSVNJfqc/7R
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
VirtualAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CallWindowProcW
MessageBoxW
RegDeleteKeyW
StrStrIW
CoTaskMemAlloc
SysStringLen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ