how to get imphash same as sysmon

Question

i want to calculate imphash. How to piece together import data.

i have tried this, kernel.dll.funcname1kernel.dll.funcname2..... It work out different with sysmon`s result.

Answer 1

Hello there,

To get an ImpHash (Import Hash) similar to Sysmon, you can use the following steps:

Download the Sysinternals Suite: Sysmon is part of the Sysinternals Suite, a collection of powerful Windows utilities created by Mark Russinovich and Bryce Cogswell. You can download it from the Microsoft website or from the official Sysinternals Suite page.

Install and configure Sysmon: Install Sysmon on the target system where you want to generate the ImpHash. During installation, you can choose to configure Sysmon using a configuration file or command-line options. The configuration allows you to specify the events you want to monitor and log.

Generate Sysmon logs: Once Sysmon is installed and configured, let it run for a while to generate logs. Sysmon will start monitoring various events on the system, including process creations and loads of DLLs.

Extract ImpHash from Sysmon logs: You can use various methods to extract the ImpHash from Sysmon logs. One common approach is to use a log analysis tool like "Log Parser" or "ELK Stack" (Elasticsearch, Logstash, and Kibana) to parse and search the logs for process creation events. Extract the DLLs loaded during each process creation event and compute the ImpHash of these DLLs.

Calculate the ImpHash: The ImpHash is calculated based on the imported functions of a binary or DLL. There are various tools and scripts available to compute the ImpHash of a file. One popular tool is the "pehash.py" script by Mark Russinovich. You can find this script on the Sysinternals GitHub repository.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 2

piece together importData like that kernel32.func1,kernel32.func2. it is same with sysmon.