FreeInstalledPackageInfo
GetInstalledPackageInfo
Test
rundll
start
Static task
static1
Behavioral task
behavioral1
Sample
7ffbfc130000.conhost2.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ffbfc130000.conhost2.dll
Resource
win10v2004-20240802-en
Target
7ffbfc130000.conhost2.dll.exe
Size
176KB
MD5
588a70b0564692e8f1baf00d592aedff
SHA1
d66b028ff4e323b3beadf8faba80b095ec1e4b5b
SHA256
6933141fbdcdcaa9e92d6586dd549ac1cb21583ba9a27aa23cf133ecfdf36ddf
SHA512
3307f70d3e92082f2a2a3da029d5e9736c52cb1115bfaa82ccbb7be300bf092778908a81a2ee6af7429dc6778be2b63b9cdbe419e9468515149652224beb23d4
SSDEEP
384:gT/WSnV4iPKeAsZxrpVrJy1KPAZRsZiMaxsrjFOmZ:grM0Zx1VVGb9orBOu
Checks for missing Authenticode signature.
resource |
---|
7ffbfc130000.conhost2.dll.exe |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
CloseHandle
CreateMutexA
CreatePipe
CreateProcessA
GetComputerNameA
GetCurrentProcess
GetExitCodeProcess
GetFileSize
GetModuleFileNameA
GetVersionExA
ReadFile
ReleaseMutex
SetHandleInformation
Sleep
TerminateProcess
VerSetConditionMask
VerifyVersionInfoA
WaitForSingleObject
WriteFile
_beginthread
exit
fclose
fopen
fread
free
fseek
ftell
fwrite
getenv
malloc
memcpy
memset
rand
sprintf
srand
strcpy
strlen
wcstombs
_time64
NetApiBufferFree
NetGetJoinInformation
WSACleanup
WSAStartup
__WSAFDIsSet
closesocket
connect
freeaddrinfo
getaddrinfo
htons
inet_addr
inet_ntop
ntohs
recv
select
send
setsockopt
socket
FreeInstalledPackageInfo
GetInstalledPackageInfo
Test
rundll
start
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ