api-ms-win-core-processthreads-l1-1-0[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

api-ms-win-core-processthreads-l1-1-0.dll
Size

20KB
MD5

42e99c89e241f21bf2fb20f3ff477eba
SHA1

e3b0012cd6d74f0ac2bf0c34997a87333c895834
SHA256

6e5bd110a2f4dc345b68e9a8fb081783586c8c25f46027c58443ade2d3e1bf01
SHA512

8eed3b21695cccae0dbf2db844efa11ad4957cd7bcd6c8ab7cfd4f0653bbacfd6bedd82ac27c3995f6418ae38ed0b8d46afa0bdfc627c16619aab775c5f8da16
SSDEEP

192:YMck1JzX9cKSIUWBhWHWYnO/VWQ4SWzgG/uuOiqnajBLP:dck1JzNcKSIUWBhW3Upillb

Score

1^/10

Malware Config

Signatures

Files

api-ms-win-core-processthreads-l1-1-0.dll
.dll windows x64

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:c4:b5:fd:d2:51:c8:2f:1a:9c:a3:40:f4:7b:63:56:a8:ef:d4:10:f3:b9:34:d4:c6:fb:9f:e9:d0:db:da:4a
Signer

Actual PE Digest

63:c4:b5:fd:d2:51:c8:2f:1a:9c:a3:40:f4:7b:63:56:a8:ef:d4:10:f3:b9:34:d4:c6:fb:9f:e9:d0:db:da:4a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/03/2023, 16:05
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Exports

Exports

CreateProcessA
CreateProcessAsUserW
CreateProcessW
CreateRemoteThread
CreateRemoteThreadEx
CreateThread
DeleteProcThreadAttributeList
ExitProcess
ExitThread
FlushProcessWriteBuffers
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetPriorityClass
GetProcessId
GetProcessIdOfThread
GetProcessTimes
GetProcessVersion
GetStartupInfoW
GetThreadId
GetThreadPriority
GetThreadPriorityBoost
InitializeProcThreadAttributeList
OpenProcessToken
OpenThread
OpenThreadToken
ProcessIdToSessionId
QueryProcessAffinityUpdateMode
QueueUserAPC
ResumeThread
SetPriorityClass
SetProcessAffinityUpdateMode
SetProcessShutdownParameters
SetThreadPriority
SetThreadPriorityBoost
SetThreadStackGuarantee
SetThreadToken
SuspendThread
SwitchToThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UpdateProcThreadAttribute

Sections

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:dfCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

63:c4:b5:fd:d2:51:c8:2f:1a:9c:a3:40:f4:7b:63:56:a8:ef:d4:10:f3:b9:34:d4:c6:fb:9f:e9:d0:db:da:4aSigner

Signature Validations

Verification

23/03/2023, 16:05 Valid: false

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.rdata Size: 4KB - Virtual size: 3KB

.data Size: - Virtual size: 128B

.rsrc Size: 4KB - Virtual size: 1008B

33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

63:c4:b5:fd:d2:51:c8:2f:1a:9c:a3:40:f4:7b:63:56:a8:ef:d4:10:f3:b9:34:d4:c6:fb:9f:e9:d0:db:da:4a
Signer

23/03/2023, 16:05
Valid: false

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: - Virtual size: 128B

.rsrc
Size: 4KB - Virtual size: 1008B