PowerProcess[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PowerProcess.dll
Size

345KB
MD5

b3d1c1ef0b8cc5c8e4aec53cc4ae98e2
SHA1

b8a83894ef8a039a44e364f610d523e4f8cf8180
SHA256

5122fadc5b4b7cf24f1821b8c71c463b430001d60ae0d086997418b4780f2bcc
SHA512

d8147e0e7f27807e4d7e74339fc9e6097b569bbef136be44c08761693d6566926d7b8f3008cde742e33af93f3339a4803fa56a60565957dbefe0b05c8b0bec9f
SSDEEP

6144:rcAyHfH/LtBqcx2yF5wF5wF5QF5wF5QF5wF5:rcLH/Xqm2yF2F2F+F2F+F2F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PowerProcess.dll

Files

PowerProcess.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ