DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
d6349c99132521c22cbdf0c70c92cc7ff6a701f22ce82d17116c6ae6956a1247.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d6349c99132521c22cbdf0c70c92cc7ff6a701f22ce82d17116c6ae6956a1247.dll
Resource
win10v2004-20230915-en
Target
d6349c99132521c22cbdf0c70c92cc7ff6a701f22ce82d17116c6ae6956a1247
Size
6.8MB
MD5
6728e0aeca290c5a1bc4975b211bff08
SHA1
ca578df3d820fbc2d0f05bc6656ffdbf6bd05e1c
SHA256
d6349c99132521c22cbdf0c70c92cc7ff6a701f22ce82d17116c6ae6956a1247
SHA512
31f8dec50fa95fd07727ee05f21c84d5eb24680bc2fbd564d09d8c003f6d81dbe3643c73801d457b24259de3aa4e67467825d469c0e649b6ed414fe4c1892b21
SSDEEP
196608:149ifmqeJF3Uu+PG0nS8I6qIQkcAYAOf1RUw:149OChnAnS8K9Q
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
d6349c99132521c22cbdf0c70c92cc7ff6a701f22ce82d17116c6ae6956a1247 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EVENT_SINK_GetIDsOfNames
WTSSendMessageW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ