GameBarPresenceWriter[.]proxy[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

GameBarPresenceWriter.proxy.dll
Size

10KB
MD5

59c92d78b897651dd985255c29279160
SHA1

42774771bd1eeeec51766ebf4c83962c5d0cdd9f
SHA256

0c70f1937b810da6e4ace957f9576efa0e321df19f3668e565ff14043b841995
SHA512

fe5781775409d39c0bb8984a309206922561af7784a5f56f95738013355c810831a6697b3a682d4d65f36e418ef4c198e7aea7bc24b3dacc87f66fd086ea6f23
SSDEEP

192:K5/F+Nh2Ot+I4w5bxUGmAA3MJtrC/pWA6Wz:K5+2Ot+I4w5bCG86rWWA6Wz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GameBarPresenceWriter.proxy.dll

Files

GameBarPresenceWriter.proxy.dll
.dll regsvr32 windows:10 windows x86 arch:x86

d9a4917dc609901083ad8b4b9835b065

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

GameBarPresenceWriter.proxy.pdb

Imports

msvcrt

_except_handler4_common
_XcptFilter
_initterm
malloc
free
_amsg_exit

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserFree
HSTRING_UserMarshal
HSTRING_UserSize
HSTRING_UserUnmarshal

kernel32

GetTickCount
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls

rpcrt4

NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
NdrStubCall2
IUnknown_Release_Proxy
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrCStdStubBuffer2_Release
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrDllGetClassObject
IUnknown_AddRef_Proxy
NdrStubForwardingFunction
NdrDllCanUnloadNow

combase

CStdStubBuffer2_CountRefs
CStdStubBuffer2_Disconnect
CStdStubBuffer2_QueryInterface
ord33
ord34
ord5
ord32
CStdStubBuffer2_Connect

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9a4917dc609901083ad8b4b9835b065

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-winrt-string-l1-1-0

kernel32

rpcrt4

combase

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 864B

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 480B

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 864B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 480B