Windows[.]System[.]Profile[.]PlatformDiagnosticsAndUsageDataSettings[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll
Size 100KB
Sample260812-mhc3csvbmb
SHA256 d5e2e8d0033564d0e0f1d27134538ef1f63be7a24a42e923ab3a5a77e28fb2fa
MD5 4d63c73402c7251149105283cf58afe8
SHA1 df910603f5dec94e2470a8818037219166fb36fd
SHA512 66eeb080bfac6939d49804cdb38a528470d97a0777f231519f2b1ee144656f0587200c1c356516d2bacf08e8d0baa0c9f7cbc8021dd4d8c731f5d950aec47456
SSDEEP 1536:W+bHIVN2WChXU9xUohX+m1AlcK90g7AqNxiWooUN9ybHLPh9:W+TISaoq+YAlcS7A0xiW/U6bHjT
TLSH
T112A34A2E62BD10E9E576903C89570E0AE3B1F461530257EF036482BD5F63BF4AE39B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll

File Explorer

Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll

.dll 100KB

Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll

IMPHASH af20e757d26dca74176015bbe87a125f
SHA256 d5e2e8d0033564d0e0f1d27134538ef1f63be7a24a42e923ab3a5a77e28fb2fa
MD5 4d63c73402c7251149105283cf58afe8
SHA1 df910603f5dec94e2470a8818037219166fb36fd
SHA512 66eeb080bfac6939d49804cdb38a528470d97a0777f231519f2b1ee144656f0587200c1c356516d2bacf08e8d0baa0c9f7cbc8021dd4d8c731f5d950aec47456
SSDEEP 1536:W+bHIVN2WChXU9xUohX+m1AlcK90g7AqNxiWooUN9ybHLPh9:W+TISaoq+YAlcS7A0xiW/U6bHjT
TLSH
T112A34A2E62BD10E9E576903C89570E0AE3B1F461530257EF036482BD5F63BF4AE39B91
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.pdb

msvcrt

_XcptFilter __CxxFrameHandler3 _CxxThrowException _initterm _callnewh __C_specific_handler ?what@exception@@UEBAPEBDXZ _purecall ?terminate@@YAXXZ ??0exception@@QEAA@AEBQEBDH@Z malloc __CxxFrameHandler4 _amsg_exit free ??1type_info@@UEAA@XZ _lock _unlock ??0exception@@QEAA@AEBV0@@Z ??0exception@@QEAA@XZ ??1exception@@UEAA@XZ memcpy_s __dllonexit _vsnwprintf _onexit memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA GetModuleHandleExW GetModuleHandleW FreeLibrary DisableThreadLibraryCalls GetProcAddress

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive WaitForSingleObject DeleteCriticalSection ReleaseMutex ReleaseSRWLockShared AcquireSRWLockShared WaitForSingleObjectEx OpenSemaphoreW CreateEventExW EnterCriticalSection InitializeCriticalSectionEx LeaveCriticalSection CreateMutexExW CreateSemaphoreExW InitializeSRWLock ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapFree HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter RaiseException GetLastError SetLastError SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId TerminateProcess GetCurrentProcess GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-eventing-provider-l1-1-0

EventRegister EventSetInformation EventUnregister EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError RoTransformError RoOriginateErrorW

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-synch-l1-2-0

WakeByAddressAll InitOnceExecuteOnce WaitOnAddress Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty WindowsGetStringRawBuffer WindowsStringHasEmbeddedNull WindowsCreateString WindowsCreateStringReference

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork CreateThreadpoolWork CreateThreadpoolWait FreeLibraryWhenCallbackReturns SetThreadpoolWait WaitForThreadpoolWaitCallbacks SubmitThreadpoolWork CloseThreadpoolWait

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue RegCloseKey RegCreateKeyExW

ntdll

RtlUnsubscribeWnfStateChangeNotification NtQueryWnfStateData RtlSubscribeWnfStateChangeNotification

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoDecrementMTAUsage CoTaskMemAlloc

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

48KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

ntdll

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic