DllInstall
DllRegisterServer
Behavioral task
behavioral1
Sample
9354353a1fee91a6426b1f11558086c37847eca3a9f78d789ed954c541293cf1.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9354353a1fee91a6426b1f11558086c37847eca3a9f78d789ed954c541293cf1.dll
Resource
win10v2004-20230703-en
Target
9354353a1fee91a6426b1f11558086c37847eca3a9f78d789ed954c541293cf1
Size
2.0MB
MD5
20e26d3991cda84499ca5769a7b44e0c
SHA1
17fffe3dd3a389c7059bdbd75589bc9538fabe7b
SHA256
9354353a1fee91a6426b1f11558086c37847eca3a9f78d789ed954c541293cf1
SHA512
259d3f5d05040a6b5b3e91aa6fd35e70428882a53754aa407315361dcdf192f10fb4db0ebdb0f8b6e20f2413910aa493e65016fb91a7d1266eeaf33df8674f9d
SSDEEP
49152:pVQRsL7nJ9lv0Q5UEDwzcKU2yfyce1gb5Ngkry:D0qnNsxJyfycKgHgt
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
9354353a1fee91a6426b1f11558086c37847eca3a9f78d789ed954c541293cf1 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetTokenInformation
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
WTSSendMessageW
CharUpperBuffW
DllInstall
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE