EjectDllA
EjectDllW
GetProcessInfo
InjectDllA
InjectDllW
RemoteExecute
StartRemoteSubclass
StopRemoteSubclass
Static task
static1
Behavioral task
behavioral1
Sample
91094f7a1339807a892be0234be6f10a6c38764ff76b9ea4be9de3402c75628cN.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
91094f7a1339807a892be0234be6f10a6c38764ff76b9ea4be9de3402c75628cN.dll
Resource
win10v2004-20240802-en
Target
91094f7a1339807a892be0234be6f10a6c38764ff76b9ea4be9de3402c75628cN
Size
220KB
MD5
fa5392d6aa890137bb42926db24f7e80
SHA1
dc46b399f18171b407f4238345151851d6098dfc
SHA256
91094f7a1339807a892be0234be6f10a6c38764ff76b9ea4be9de3402c75628c
SHA512
b0247226126e52203091fdc8591d76ef4792dc1e2ee2fe23c6a749adf577117b90546a2e17407a93093a9b43019608c5b2112fbdf9066d5afa1cd7c7e8b05d35
SSDEEP
3072:QzzbkAmhzBoOBs6dU3xx+7i92KcbkpLirkH5gNUp75Mex3dcantvW8G9gcYEES:QzvjQje3xMW94gp+gH++75nxZt7EE
Checks for missing Authenticode signature.
resource |
---|
91094f7a1339807a892be0234be6f10a6c38764ff76b9ea4be9de3402c75628cN |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapReAlloc
LoadLibraryA
CloseHandle
ReadProcessMemory
OpenProcess
WriteProcessMemory
GetExitCodeThread
SetLastError
WaitForSingleObject
GetCurrentThread
GetProcAddress
lstrcpyA
WideCharToMultiByte
DisableThreadLibraryCalls
GetVersionExA
IsBadReadPtr
GetCurrentProcessId
VirtualAlloc
VirtualFree
GetCurrentProcess
DuplicateHandle
GetCurrentThreadId
ResumeThread
GetThreadContext
GetStdHandle
GetFileType
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
FreeLibrary
TerminateProcess
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetCPInfo
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
IsWindowUnicode
EjectDllA
EjectDllW
GetProcessInfo
InjectDllA
InjectDllW
RemoteExecute
StartRemoteSubclass
StopRemoteSubclass
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ