CreateProcessNotify
main
Behavioral task
behavioral1
Sample
e936b31aba75c09dc80fec5f009ac67365b814c1bd766abbff04ff7724e057f8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e936b31aba75c09dc80fec5f009ac67365b814c1bd766abbff04ff7724e057f8.dll
Resource
win10v2004-20220812-en
Target
e936b31aba75c09dc80fec5f009ac67365b814c1bd766abbff04ff7724e057f8
Size
116KB
MD5
25d67ed7d8cd72b232d4b01acbd5d780
SHA1
9415872ebde34a9e5553184f47be68e54ed7d9d0
SHA256
e936b31aba75c09dc80fec5f009ac67365b814c1bd766abbff04ff7724e057f8
SHA512
2f2c0bd14e6570b2701035bbb08e2a8772e1489e1be0b29936d4eed23aa47b3d2d9a6885493b01c281b734127b300407e3d0083216984624fbf3a6b3708ec50f
SSDEEP
3072:HhffwJwDSxQO+bj3MRkieeHf5++qqS9t+o:HhoxgEkZWf5++qqS/V
resource | yara_rule |
---|---|
sample | family_gh0strat |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
WaitForSingleObject
GetProcAddress
LoadLibraryA
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CloseHandle
lstrcpyA
SetEvent
CancelIo
Sleep
ResetEvent
GetLastError
CreateDirectoryA
GetFileAttributesA
lstrlenA
CreateProcessA
lstrcatA
GetDiskFreeSpaceExA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
DeleteFileA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
DeviceIoControl
GlobalMemoryStatus
GetVersionExA
OpenEventA
GetTickCount
SetUnhandledExceptionFilter
SetErrorMode
CreateThread
GetModuleFileNameA
GetCurrentProcess
GetSystemDirectoryA
GetStartupInfoA
GetWindowsDirectoryA
FreeLibrary
OpenProcess
InitializeCriticalSection
Process32Next
Process32First
InterlockedExchange
MoveFileExA
GetTempPathA
TerminateThread
GetLocalTime
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
UnmapViewOfFile
ResumeThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
CreatePipe
LocalSize
lstrcmpiA
GetCurrentThreadId
RaiseException
realloc
atoi
strchr
_iob
strncmp
strncpy
sprintf
_errno
strrchr
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_except_handler3
malloc
free
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
strncat
??2@YAPAXI@Z
_strnicmp
_strupr
??3@YAXPAX@Z
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
CreateEnvironmentBlock
CreateProcessNotify
main
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ