NtWow64UserConnectHook
sdwhwin32
Static task
static1
Behavioral task
behavioral1
Sample
pid.15412.wow64win.dll.0x1047d50.0x7ff9aa220000.dll
Resource
win10v2004-20240802-en
Target
pid.15412.wow64win.dll.0x1047d50.0x7ff9aa220000.dmp
Size
556KB
MD5
1a5a09f72a05e7d00f9dbd851d103eba
SHA1
7e6e0eae11fce8afd1d7f121ad18e5d3f92b3ca2
SHA256
5841002eacf56e2a9264ff77b51c1fc8f53f20bb83035df801cba4593293d846
SHA512
d141f5e30fad3a52fb2d965c5fbb503e06dc51149691b0f4f0fdb51156bd5b3c10587bb214e2c0fd50ba7f9904acc7a12de7eda84a68555d9adb0ca34c1ae6c3
SSDEEP
3072:WxsGZGkiVRkZ6ebDsl/Tpew/3QlRlWpEMNy4hlP9d3h9Ec3ArvsrJFFhe4u:G8kZ6ebIldeOWRsfd9L9E7vsrJFre4u
Checks for missing Authenticode signature.
resource |
---|
pid.15412.wow64win.dll.0x1047d50.0x7ff9aa220000.dmp |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
__C_specific_handler
RtlAllocateHeap
NtClose
RtlFreeHeap
RtlRaiseStatus
NtCallbackReturn
memcpy
_local_unwind
Wow64ShallowThunkSIZE_T64TO32
Wow64AllocateTemp
Wow64LogPrint
Wow64AllocThreadHeap
Wow64KiUserCallbackDispatcher
Wow64FreeThreadHeap
Wow64FreeHeap
Wow64ShallowThunkSIZE_T32TO64
Wow64ShallowThunkAllocObjectAttributes32TO64_FNC
NtWow64UserConnectHook
sdwhwin32
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ