Windows[.]StateRepositoryCore[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Windows.StateRepositoryCore.dll
Size 134KB
Sample260812-mplm3seq3v
SHA256 6853dd834e3e00a0f64fca471d0aec74d9357cf90d44b58deae3faa4cb48c9ab
MD5 d930efe3248e87909a835bfbaf3a4435
SHA1 78fc94e27140878749c0fd5e40e0dd89a5ca885e
SHA512 93ba82fff002e55a44a9f93ff018e2bfbb02d18a31c796d2fbcbaf39e6d453718c960ceb439925d1a220a7881fbfc05270ea0ed1ffeaa65045a9d0f846b84bf2
SSDEEP 1536:FlyO4mT37+ycNkrnhEeKbYV0MfqD+XNL+5eVPFa9KGLr0Zr5zLkRPPrKf55gPuzV:FlmycmpVLTF8QGUR53kRPPy5gGx
TLSH
T156D36D9E33A410B6E17A913CC9D2860ED3B2785217615BCF066142EE5F73BD86C3D3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Windows.StateRepositoryCore.dll

.dll 134KB

Windows.StateRepositoryCore.dll

IMPHASH 8dd769bd4227a4fc12ad7458dff4866a
SHA256 6853dd834e3e00a0f64fca471d0aec74d9357cf90d44b58deae3faa4cb48c9ab
MD5 d930efe3248e87909a835bfbaf3a4435
SHA1 78fc94e27140878749c0fd5e40e0dd89a5ca885e
SHA512 93ba82fff002e55a44a9f93ff018e2bfbb02d18a31c796d2fbcbaf39e6d453718c960ceb439925d1a220a7881fbfc05270ea0ed1ffeaa65045a9d0f846b84bf2
SSDEEP 1536:FlyO4mT37+ycNkrnhEeKbYV0MfqD+XNL+5eVPFa9KGLr0Zr5zLkRPPrKf55gPuzV:FlmycmpVLTF8QGUR53kRPPy5gGx
TLSH
T156D36D9E33A410B6E17A913CC9D2860ED3B2785217615BCF066142EE5F73BD86C3D3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

e4:ac:00:58:44:22:30:37:b6:bd:a4:03:ab:fc:97:98:51:e2:6a:ee:1e:b8:f3:3a:f7:5c:9f:d1:82:df:b1:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Oct 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

7872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Windows.StateRepositoryCore.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__crt_atexit _o__errno _o__execute_onexit_table _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_dll memmove _o__configure_narrow_argv _o_free _o_malloc _o_wcstoll __C_specific_handler _o__cexit _o___stdio_common_vswprintf _o__callnewh _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy wcschr __CxxFrameHandler3 _CxxThrowException __std_terminate __CxxFrameHandler4 memcmp memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls GetModuleFileNameA GetModuleHandleExW GetProcAddress GetModuleHandleW GetModuleHandleExA

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize InitOnceComplete

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW ReleaseSemaphore EnterCriticalSection InitializeCriticalSectionEx DeleteCriticalSection AcquireSRWLockShared CreateMutexExW WaitForSingleObject ReleaseSRWLockShared OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseMutex ReleaseSRWLockExclusive LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventUnregister EventRegister EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId GetCurrentProcess TerminateProcess GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringOrdinal WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemDirectoryW GetSystemTimeAsFileTime GetWindowsDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW RegCreateKeyExW RegEnumKeyExW RegDeleteKeyExW RegQueryInfoKeyW RegDeleteTreeW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

api-ms-win-security-lsalookup-l1-1-0

LsaLookupClose LsaLookupGetDomainInfo LsaLookupFreeMemory LsaLookupOpenLocalPolicy

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

ntdll

RtlFreeHeap RtlAllocateHeap

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

328B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Windows.StateRepositoryCore.dll

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-core-realtime-l1-1-0

ntdll

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic