Static task
static1
Behavioral task
behavioral1
Sample
a8764f409d803a550b8dc432a2beed9439a558afd4f4f38441e485bdaff76e67.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a8764f409d803a550b8dc432a2beed9439a558afd4f4f38441e485bdaff76e67.dll
Resource
win10v2004-20220812-en
General
-
Target
a8764f409d803a550b8dc432a2beed9439a558afd4f4f38441e485bdaff76e67
-
Size
476KB
-
MD5
e6ac453a479424a4c80a195cbea0c652
-
SHA1
8ba079028ef773d3e20e4c3a19cda8fc4b85ddfc
-
SHA256
a8764f409d803a550b8dc432a2beed9439a558afd4f4f38441e485bdaff76e67
-
SHA512
c943a2b4cf471e2735954a4497dfc448a8c0f8994986b4a58c7a3c502030ccd0ec86dcafbca52c29b7708e6768a730b0745958ed6d02f2bbb09655646b6dc74c
-
SSDEEP
6144:kn46wsJrrbFhkF8kJFYbyu2GDhLZbVT0luJVzntQjwfEOO8qwtvzvwW2+rrqDMgZ:k463J/azJIyuIxtnxKTDk
Malware Config
Signatures
Files
-
a8764f409d803a550b8dc432a2beed9439a558afd4f4f38441e485bdaff76e67.dll windows x86
6f993ac42c5de0232b17e9de0547c253
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCopyLuid
RtlHashUnicodeString
RtlInitString
ObReferenceObjectByPointer
RtlInitUnicodeString
KeRemoveDeviceQueue
FsRtlLookupLastLargeMcbEntry
IoCancelIrp
KeInsertDeviceQueue
RtlEqualUnicodeString
RtlEqualString
SeDeleteObjectAuditAlarm
RtlxUnicodeStringToAnsiSize
ExRegisterCallback
IoMakeAssociatedIrp
IoCheckEaBufferValidity
KeInitializeEvent
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.code Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.icode Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fdata Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ