BeginRun
SetUtility
Behavioral task
behavioral1
Sample
d41cdfcc40eea67a6014550f0b91a6c7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d41cdfcc40eea67a6014550f0b91a6c7.dll
Resource
win10v2004-20240226-en
Target
d41cdfcc40eea67a6014550f0b91a6c7
Size
19.2MB
MD5
d41cdfcc40eea67a6014550f0b91a6c7
SHA1
4a901c27f707fe395b1baa672268ef69c93830d9
SHA256
dca019bd42e3b8fee0a79916a823f3043fc14ed43267904ee53a4090c9a49b50
SHA512
c933a181f95ee875d90a125504826d59a607c90bf4f14d9301c4547e2fddb47d77ab3672b418bda2a937bf053ffceb4da381be43c5985785e7b7f6fb5e9642a7
SSDEEP
3072:WS+Gre6prIzYkTRiPFZBlxSs5nIexOTP108478Aa4TB:3+CprkTEdZBltnIexOTP28m1
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
d41cdfcc40eea67a6014550f0b91a6c7 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
memcpy
memset
strtok
malloc
free
_access
DeleteFileA
FindResourceA
SetFileAttributesA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
ResumeThread
WriteProcessMemory
VirtualAllocEx
VirtualProtectEx
GetProcAddress
GetSystemDirectoryA
ReadProcessMemory
SetThreadContext
GetThreadContext
GetTempPathA
CloseHandle
GetFileTime
CreateDirectoryA
CreateProcessA
WriteFile
SetFileTime
WaitForSingleObject
CreateFileA
LocalFree
LocalAlloc
GetModuleHandleA
WritePrivateProfileStringA
SizeofResource
GetWindowsDirectoryA
LoadResource
GetDesktopWindow
InitializeSecurityDescriptor
RegDeleteKeyA
RegOpenKeyExA
RegSetKeySecurity
FreeSid
AllocateAndInitializeSid
RegCreateKeyExA
SetSecurityDescriptorDacl
RegQueryValueExA
RegSetValueExA
SetEntriesInAclA
RegCloseKey
RegEnumKeyA
RegOpenKeyA
SHGetSpecialFolderPathA
SHChangeNotify
BeginRun
SetUtility
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ