PowerProcess[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PowerProcess.dll
Size

165KB
MD5

0e883e3d7b0d589203dc41934d4af287
SHA1

6c8d580abf60ac6d6f9301bdb0ec44d34a57a4ba
SHA256

531746c1628b6016c7be26db0d2dda215228ca209df590976073acee6c464c05
SHA512

a6ce35d3fe7b69c9f2694475dda3c534299b459128a0a3c6eaa0a1d6fc805fa558d73c1749dd746b1958e8475ad08450c80bfbc8f74cfd95d215d8573b39647c
SSDEEP

3072:vHd0qvUTSVn7ksOQjwS8OKoUG/umzXf8OAprFnhD/d57d8pUEtuzJjgwA+2dPhwx:/CqvbVn7kVoXW8p8zJjgQ2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PowerProcess.dll

Files

PowerProcess.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ