Edit tour

Windows Analysis Report
grade.exe

Overview

General Information

Sample name:	grade.exe
Analysis ID:	1430592
MD5:	6e57c402199ce6e7bbf5ede13d4a838e
SHA1:	69fb871bdb2d0fa0af25107215b5187e1f420ada
SHA256:	e3eb252b1b009440c097ba7a40d8b2ccc4e233847dec9e1d6c08c5a4439dcc12
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

grade.exe (PID: 2632 cmdline: "C:\Users\user\Desktop\grade.exe" MD5: 6E57C402199CE6E7BBF5EDE13D4A838E)

conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: grade.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\grade.exe

Code function: 0_2_00007FF6841040D4 FindFirstFileExW,

0_2_00007FF6841040D4

Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF68410DD48	0_2_00007FF68410DD48
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F8588	0_2_00007FF6840F8588
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6841021BC	0_2_00007FF6841021BC
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F69F0	0_2_00007FF6840F69F0
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840FAA04	0_2_00007FF6840FAA04
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF68410266C	0_2_00007FF68410266C
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F96A4	0_2_00007FF6840F96A4
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840FCF10	0_2_00007FF6840FCF10
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF684108B64	0_2_00007FF684108B64
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F733C	0_2_00007FF6840F733C
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF684107F58	0_2_00007FF684107F58
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F6BD8	0_2_00007FF6840F6BD8
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F6808	0_2_00007FF6840F6808
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F784C	0_2_00007FF6840F784C
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF68410C08C	0_2_00007FF68410C08C
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6841040D4	0_2_00007FF6841040D4
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF684102CEC	0_2_00007FF684102CEC
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840FA50C	0_2_00007FF6840FA50C
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840FF4FC	0_2_00007FF6840FF4FC
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840FC920	0_2_00007FF6840FC920

Source: C:\Users\user\Desktop\grade.exe

Code function: String function: 00007FF6840F1D30 appears 36 times

Source: classification engine

Classification label: clean4.winEXE@2/1@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3004:120:WilError_03

Source: grade.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\grade.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\grade.exe "C:\Users\user\Desktop\grade.exe"
Source: C:\Users\user\Desktop\grade.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\grade.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\grade.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: grade.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: grade.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: grade.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: grade.exe

Static PE information: section name: _RDATA

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\grade.exe

Code function: 0_2_00007FF6841040D4 FindFirstFileExW,

0_2_00007FF6841040D4

Source: C:\Users\user\Desktop\grade.exe

Code function: 0_2_00007FF6840FFD94 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6840FFD94

Source: C:\Users\user\Desktop\grade.exe

Code function: 0_2_00007FF684106848 GetProcessHeap,

0_2_00007FF684106848

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840FFD94 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6840FFD94
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F2708 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6840F2708
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F28B0 SetUnhandledExceptionFilter,	0_2_00007FF6840F28B0
Source: C:\Users\user\Desktop\grade.exe	Code function: 0_2_00007FF6840F2104 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6840F2104

Source: C:\Users\user\Desktop\grade.exe

Code function: 0_2_00007FF68410DB90 cpuid

0_2_00007FF68410DB90

Source: C:\Users\user\Desktop\grade.exe

Code function: 0_2_00007FF6840F25F0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6840F25F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Domains and IPs

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430592
Start date and time:	2024-04-23 23:02:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	grade.exe
Detection:	CLEAN
Classification:	clean4.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 14 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: grade.exe

Joe Sandbox View / Context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\grade.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	334
Entropy (8bit):	3.5864209896797057
Encrypted:	false
SSDEEP:	3:fPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPt:Yv5ON2RCXdLANvB8xDCuKNEULiGC
MD5:	602CC9A40803F3AF2C62D8E9CF509618
SHA1:	F959B23F21DE0794D628AE327D9B2CC37438DECB
SHA-256:	6A449525DF5AA861B4C511134AC8F1B3EF0AA6CBB014D0639F992D0A10F9BF40
SHA-512:	AECA2007147EB148BCF18E97A27A9CDEF1730403210187A87560EF1A4791AA39D94C2C8D83FBF19D26B8C40D333CBE0D6C06A751725A0A3BB650E3F8BF3F105C
Malicious:	false
Reputation:	low
Preview:	************************************************************************..C:\Users\user\Desktop\grade.exe <File> [show]..File = file that has the pasted scores from Excel file...show = optional argument for showing the scores..Author: Rassul Saeedipour..************************************************************************

Instruction
dec eax
sub esp, 28h
call 00007F144CF8FD1Ch
dec eax
add esp, 28h
jmp 00007F144CF8F697h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001CF0Bh]
dec eax
mov ecx, ebx
call dword ptr [0001CEFAh]
call dword ptr [0001CF04h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0001CEF8h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001CEECh]
test eax, eax
je 00007F144CF8F829h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00029132h]
call 00007F144CF8F9EEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00029219h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [000291A9h], eax
dec eax
mov eax, dword ptr [00029202h]
dec eax
mov dword ptr [00029073h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00029177h], eax
mov dword ptr [0002904Dh], C0000409h
mov dword ptr [00029047h], 00000001h
mov dword ptr [00029051h], 00000001h

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x292b4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x33000	0x16f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x36000	0x688	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x277f0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x276b0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x270	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1da30	0x1dc00	0f13644fe3f402192676c0eb96b36c4c	False	0.5702304359243697	zlib compressed data	6.5157803645526515	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0xaade	0xac00	e2aeda0e5ff79caea959151fc713c4c6	False	0.45896166424418605	data	5.004565963167963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2a000	0x85f0	0x1200	83e7198e6ed66391be71368899e6beef	False	0.2406684027777778	data	3.5429865666336964	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x33000	0x16f8	0x1800	7898243f4d591b9490bded1a69fa861e	False	0.4713541666666667	data	5.087100398167949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x35000	0x15c	0x200	4abdc6ccba67d0d605f53aafbbb9f873	False	0.392578125	data	2.8103216483041695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x36000	0x688	0x800	97fed5e2aaf751767837faf5acc79024	False	0.50244140625	data	4.968382633383432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

DLL	Import
KERNEL32.dll	RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, SetEndOfFile, RtlUnwindEx, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, RtlPcToFileHeader, ExitProcess, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetFileType, CloseHandle, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, CreateFileW, GetFileSizeEx, SetFilePointerEx, HeapSize, HeapReAlloc, ReadFile, ReadConsoleW, WriteConsoleW

RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, SetEndOfFile, RtlUnwindEx, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, RtlPcToFileHeader, ExitProcess, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetFileType, CloseHandle, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, CreateFileW, GetFileSizeEx, SetFilePointerEx, HeapSize, HeapReAlloc, ReadFile, ReadConsoleW, WriteConsoleW

Target ID:	0
Start time:	23:02:56
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\grade.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\grade.exe"
Imagebase:	0x7ff6840f0000
File size:	180'224 bytes
MD5 hash:	6E57C402199CE6E7BBF5EDE13D4A838E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:02:56
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1610
Total number of Limit Nodes:	14

Executed Functions

Function 00007FF684100274 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF684100612,?,?,-00000018,00007FF6841012A2,?,?,?,00007FF68410119A,?,?,?,00007FF6840F640D), ref: 00007FF6841003F3
GetProcAddress.KERNEL32(?,?,?,00007FF684100612,?,?,-00000018,00007FF6841012A2,?,?,?,00007FF68410119A,?,?,?,00007FF6840F640D), ref: 00007FF6841003FF

Strings

api-ms-, xrefs: 00007FF68410033D
ext-ms-, xrefs: 00007FF684100350

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 1b45266ec9771067a26fa83aa274804e7b5c9a1966a113be077a1b509eb141a4
Instruction ID: 9932475338bc456166b4fc30b17d88b341707393bcf4915575d67f4e697d062a
Opcode Fuzzy Hash: 1b45266ec9771067a26fa83aa274804e7b5c9a1966a113be077a1b509eb141a4
Instruction Fuzzy Hash: 5F41C521B19A02C6EA129B16A9942B66B92BF44BD0F44513EDE4DCB788FF7CE455C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684107880 Relevance: 6.2, APIs: 4, Instructions: 218
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF684107820), ref: 00007FF6841079A3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF684107820), ref: 00007FF684107A2D

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fded8a97fe0603a0778edaa5c764133d28f504cb692cfb8a3452c74e1a05afda
Instruction ID: 95ba53d30f34fed13e802aee4b03828b51e8adb71e62cd13860fbafd9490d384
Opcode Fuzzy Hash: fded8a97fe0603a0778edaa5c764133d28f504cb692cfb8a3452c74e1a05afda
Instruction Fuzzy Hash: 0591D062F18652C9FB608B6594C06BD2FA0BF24B98F48413EDE9E97A94DF38D461C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68410064C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE ref: 00007FF6841006E9
LCMapStringW.KERNEL32 ref: 00007FF68410071D

Strings

LCMapStringEx, xrefs: 00007FF684100668, 00007FF684100679

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: a0f868da1af82e01342fbd000abb89ab9a795cfa19fee68ce67e2fc1342dc39a
Instruction ID: 04d014cc3de2b772441a47c1c827432b186e688f2a88d47e10e8bb2089d797aa
Opcode Fuzzy Hash: a0f868da1af82e01342fbd000abb89ab9a795cfa19fee68ce67e2fc1342dc39a
Instruction Fuzzy Hash: DF21ED35608B81C6D760CB16B4802AABBA5FB89BD0F54413AEACD93B19DF3CD555CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F1F74 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6840F1F88

Part of subcall function 00007FF6840F23DC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6840F23FE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6840F1F9D
__scrt_release_startup_lock.LIBCMT ref: 00007FF6840F200B

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3058843127-0
Opcode ID: c9c3cd7c29927abd31f3b49e105a0995f79a26efa26f274cf051917e7df3851f
Instruction ID: 9edec613c048f47268bf2d2fe4bc7860eaf26fa7affbf90fc430767056f1b3b6
Opcode Fuzzy Hash: c9c3cd7c29927abd31f3b49e105a0995f79a26efa26f274cf051917e7df3851f
Instruction Fuzzy Hash: DD311E22A0A506C1FA14AB24A5D23BB2691BF45784F44403DEA4EC73E7DEAEE845C649

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FDC64 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6840FDC60), ref: 00007FF6840FDC75
TerminateProcess.KERNEL32(?,?,?,00007FF6840FDC60), ref: 00007FF6840FDC80
ExitProcess.KERNEL32 ref: 00007FF6840FDC8F

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 7fe735ed36e22e01c0081141643d85a710bef08a62bd7fb68d17b4913d89c3da
Instruction ID: 1079869c840a7cf7457a28e555a4b0037a5cde417e842900047c082655910d61
Opcode Fuzzy Hash: 7fe735ed36e22e01c0081141643d85a710bef08a62bd7fb68d17b4913d89c3da
Instruction Fuzzy Hash: 18D09E14F3A607C2EA542B7068D617A16527F48751F00583CC98F863D7DDFCA45DC244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684104ADC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32 ref: 00007FF684104B1E

Strings

, xrefs: 00007FF684104B61

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: be44ce34aa222255b5420ec981f22736bef20295e4214e3c23c2c2b709479160
Instruction ID: d36fe362e077f96fcb49b99fadf2948c6a608fc03a235f92e9a1c3c32cbd08bc
Opcode Fuzzy Hash: be44ce34aa222255b5420ec981f22736bef20295e4214e3c23c2c2b709479160
Instruction Fuzzy Hash: 11518A32A18685CAE7218F24E1C43BE7BA0FB48744F54423AE6CD87A85CF7CE565CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684105068 Relevance: 3.2, APIs: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6841049C4: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF684104D00), ref: 00007FF6841049EE

IsValidCodePage.KERNEL32(?,?,?,00000001,?,00000000,?,00007FF684104E31), ref: 00007FF6841050D5
GetCPInfo.KERNEL32(?,?,?,00000001,?,00000000,?,00007FF684104E31), ref: 00007FF684105121

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 222cad02fe40f821455c5b7c30d6ac466e308c81209dcc864a0cb870c9b5141a
Instruction ID: a6e6590baf1aca347c118405141c03652c7c7e81906dab30a07fb5e6249f3dd4
Opcode Fuzzy Hash: 222cad02fe40f821455c5b7c30d6ac466e308c81209dcc864a0cb870c9b5141a
Instruction Fuzzy Hash: 5981AB62A0C682C6EB65DF25A4C4179BFA1FF54784F48413ACACE87691DF7DE961C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684107330 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF6841073E3
GetLastError.KERNEL32 ref: 00007FF6841073FF

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: e6fceaaa9a21d7b1dd1ed8f0828f5f9ea05f014dd0ef3d942d3edebe8990df0f
Instruction ID: ac05f2df19c6d07d21ed9cc2d0e05529afa81c58dd49808862e37894c5caaef2
Opcode Fuzzy Hash: e6fceaaa9a21d7b1dd1ed8f0828f5f9ea05f014dd0ef3d942d3edebe8990df0f
Instruction Fuzzy Hash: 2B31A032618B81C6EB119F25E5806A97BA1FB68780F44403AEE9DC7B55DF3CE566C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684100D28 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF684100DA1
GetFileType.KERNELBASE ref: 00007FF684100DB7

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 076147a36b533debe34a27ae2876a668ec541cd228bda0177b061b0d40d28c08
Instruction ID: ddf316d9745b25173bbaec5979d322616c1341decf6fed5e15d7f50fc473ee65
Opcode Fuzzy Hash: 076147a36b533debe34a27ae2876a668ec541cd228bda0177b061b0d40d28c08
Instruction Fuzzy Hash: C3316F21A18A45C1E7608B14A5D01796E50FF45BB0B68133DEBAE973E0DF38E4B1D340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F1E90 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_fmode.LIBCMT ref: 00007FF6840F1EA7
_RTC_Initialize.LIBCMT ref: 00007FF6840F1EC8

Part of subcall function 00007FF6840FEBDC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FEC0E

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 1c31e816b9a52671ce369ecbaddc29c951034789c1a9fdf0d0ceaef68d2603f4
Instruction ID: 990e4c185a4e0d2f438bd09e0d74d3675d28e8e9b8b778258952bf4b8739bd47
Opcode Fuzzy Hash: 1c31e816b9a52671ce369ecbaddc29c951034789c1a9fdf0d0ceaef68d2603f4
Instruction Fuzzy Hash: E6119950E1B103C6FA5877B064D22BB21907F94301F80043DE94DCA2C3DEEEB886C66A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FDB95 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6840FDBC3

Part of subcall function 00007FF6840FDCC8: GetModuleHandleExW.KERNEL32 ref: 00007FF6840FDCED
Part of subcall function 00007FF6840FDCC8: GetProcAddress.KERNEL32 ref: 00007FF6840FDD03
Part of subcall function 00007FF6840FDCC8: FreeLibrary.KERNEL32 ref: 00007FF6840FDD2A

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: e33298493a98b7c0429772620a1a846320d835de74cc284387c33f1468ac47d2
Instruction ID: 8996844442393caa46e1f586a5120b021e5820e94115dd66b48f00310fcf9262
Opcode Fuzzy Hash: e33298493a98b7c0429772620a1a846320d835de74cc284387c33f1468ac47d2
Instruction Fuzzy Hash: 2C219131A15B0AC9EB24CF64D4842AD33A0FF04318F140639D71F86AC5EFB8D445CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684105B0C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF684105B37

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2063547b987781361bee4cf75965ca167c44c7983fca8f1dbf4df2d13f5a11f1
Instruction ID: 17f0ddd3c15fcf9882ad4071f1bc0f79426c8587e49adf248e468e592dd00496
Opcode Fuzzy Hash: 2063547b987781361bee4cf75965ca167c44c7983fca8f1dbf4df2d13f5a11f1
Instruction Fuzzy Hash: 41113A36A19642C2F710DB15A4C0679ABA6FF88744F59013DE6DD97692EF3CF860CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6841001C0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6841016B2,?,?,?,00007FF6840FE66D), ref: 00007FF684100215

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f97ada7fbd599237d7393624cd2b913583b52e28a79355954de62731691aa7c8
Instruction ID: ac7b904e03126b8d7a044ffbcd0d699e169f49ce1fa98df0ad241e2ae52ef948
Opcode Fuzzy Hash: f97ada7fbd599237d7393624cd2b913583b52e28a79355954de62731691aa7c8
Instruction Fuzzy Hash: 89F04900B09202D1FE649BA1B9812B51E813F99F50F48103CCC8EC62C2EE2CE4A4C210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F1D30 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_vfwprintf_l.LIBCONCRTD ref: 00007FF6840F1D6C

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _vfwprintf_l
String ID:
API String ID: 1692953108-0
Opcode ID: d0233d1e94c66d8e2dc1ca1f0d243942dc3f88bf7c96fcdfee8c9905d5fb31a4
Instruction ID: 5ccda45d7a6c0ecfd6ca65de581f0baf5b6fce68196ad85e82795389511d318d
Opcode Fuzzy Hash: d0233d1e94c66d8e2dc1ca1f0d243942dc3f88bf7c96fcdfee8c9905d5fb31a4
Instruction Fuzzy Hash: 3FE07F72608B8086D720DB14B48175BBBA4FB89398F900629FACC46B69DB7DC2608B44

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6840FAA04 Relevance: 47.4, APIs: 24, Strings: 2, Instructions: 1877COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FAD38
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FAF97
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FB25D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FB4A4
memcpy_s.LIBCPMT ref: 00007FF6840FB70A
memcpy_s.LIBCPMT ref: 00007FF6840FB992
memcpy_s.LIBCPMT ref: 00007FF6840FBBAB
memcpy_s.LIBCPMT ref: 00007FF6840FBC26
memcpy_s.LIBCPMT ref: 00007FF6840FBC5B
memcpy_s.LIBCPMT ref: 00007FF6840FBC96
memcpy_s.LIBCPMT ref: 00007FF6840FBDC2
memcpy_s.LIBCPMT ref: 00007FF6840FBEE7
memcpy_s.LIBCPMT ref: 00007FF6840FBF92
memcpy_s.LIBCPMT ref: 00007FF6840FBFDD
memcpy_s.LIBCPMT ref: 00007FF6840FC0AA
memcpy_s.LIBCPMT ref: 00007FF6840FC233
memcpy_s.LIBCPMT ref: 00007FF6840FC2AA
memcpy_s.LIBCPMT ref: 00007FF6840FC2EF
memcpy_s.LIBCPMT ref: 00007FF6840FC3A1
memcpy_s.LIBCPMT ref: 00007FF6840FC4CE
memcpy_s.LIBCPMT ref: 00007FF6840FB7A6

Part of subcall function 00007FF6840FDA10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FDA42

memcpy_s.LIBCPMT ref: 00007FF6840FC688

Strings

, xrefs: 00007FF6840FC57B
, xrefs: 00007FF6840FC44E

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: c4ea54f63cbd4d0a9d0e14dd216b8cb128caa816c86cfe7d1c5e37177d0bf1b8
Instruction ID: 4b90b3900a53e1591336959c6920cd8e1d2c1183ad4f094d1869f018bf74c451
Opcode Fuzzy Hash: c4ea54f63cbd4d0a9d0e14dd216b8cb128caa816c86cfe7d1c5e37177d0bf1b8
Instruction Fuzzy Hash: E603B672A192C2CBE7758F259580BFA37A1FF94788F405139DA0AD7B85DF78A900CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684108B64 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF684108BB3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6841091E6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF68410935C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF684109618
_invalid_parameter_noinfo.LIBCMT ref: 00007FF684109838
_invalid_parameter_noinfo.LIBCMT ref: 00007FF684109A73
memcpy_s.LIBCPMT ref: 00007FF684109B4E
memcpy_s.LIBCPMT ref: 00007FF684109BF9
memcpy_s.LIBCPMT ref: 00007FF684109CC9

Part of subcall function 00007FF6840FDA10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FDA42

Strings

1#IND, xrefs: 00007FF684108CA3
1#SNAN, xrefs: 00007FF684108CC6
1#INF, xrefs: 00007FF684108CDF
1#QNAN, xrefs: 00007FF684108CCF

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 436955ccb22b48bca490a8ded85e916626e7fb7816552579be5e77d8f9f167a8
Instruction ID: 34d1caa799a69d0984f9f5ece1b617d72b7a855d4d10fb77dcfc76f4240bac3b
Opcode Fuzzy Hash: 436955ccb22b48bca490a8ded85e916626e7fb7816552579be5e77d8f9f167a8
Instruction Fuzzy Hash: 4CB2C372A28282CBE7658F24D5907FD3BA1FF54788F545139DA4A97A88DF38E910CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68410C08C Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF68410C4BE

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6123995c456b7f1e5ba3b79e84b9cafaf6407a6b655f64262677e11a7ce3823e
Instruction ID: 2d4078d1c57a6be426147068338cb28a6b7d74393b9797ff5877eaaeb5d0c46c
Opcode Fuzzy Hash: 6123995c456b7f1e5ba3b79e84b9cafaf6407a6b655f64262677e11a7ce3823e
Instruction Fuzzy Hash: 00C1CD22A1C686D6E7699B51D4803BD2FA0FF84B80F444139EACE87795EF7CE464CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F2708 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6840F2724
RtlCaptureContext.KERNEL32 ref: 00007FF6840F2751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6840F276B
RtlVirtualUnwind.KERNEL32 ref: 00007FF6840F27AC
IsDebuggerPresent.KERNEL32 ref: 00007FF6840F2800
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6840F2821
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6840F282C

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2d7525312a6657bcb5882ece53918f1a3704b53c53e7da8fb53b7088444a062e
Instruction ID: 25aaf7ef779afa7c75dfb6ca7fd6db74216dbfd8d10b31899e9243b6b50d2eb0
Opcode Fuzzy Hash: 2d7525312a6657bcb5882ece53918f1a3704b53c53e7da8fb53b7088444a062e
Instruction Fuzzy Hash: B0314C72619B81C6EB609F60E8807FA7365FB84744F44443EDB8E87A98DF78D548C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FFD94 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6840FFE0D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6840FFE25
RtlVirtualUnwind.KERNEL32 ref: 00007FF6840FFE60
IsDebuggerPresent.KERNEL32 ref: 00007FF6840FFE99
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6840FFEA3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6840FFEAE

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3829ae74bf71e0cb5bb2bd97b787ef049aff150a491613f828c3d96994fd02d7
Instruction ID: 5f13f4ae4c5b82a0138b8508d6b85e67420db393f618a1b7086471bb1a609b37
Opcode Fuzzy Hash: 3829ae74bf71e0cb5bb2bd97b787ef049aff150a491613f828c3d96994fd02d7
Instruction Fuzzy Hash: AB316C36618F81C6EB60CF25E8806AE77A1FF88754F50013AEA9D83B99DF78D155CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FC920 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6840FC98A
memcpy_s.LIBCPMT ref: 00007FF6840FC9B5

Strings

, xrefs: 00007FF6840FCAE8

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 109874d94e0b872f05b0a9e5404d8707ef423afa9b6a00e41ed3d4d154f4db59
Instruction ID: 7b9f5cdd6ef3b88d6158333baea4156b2a6739cb433e0dd0ddca17f91c9189eb
Opcode Fuzzy Hash: 109874d94e0b872f05b0a9e5404d8707ef423afa9b6a00e41ed3d4d154f4db59
Instruction Fuzzy Hash: A6C1C376A1E686C7D724CF19E089A6EB791FB84784F448139DB4A83B84DF7CE805CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68410DD48 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF68410DF97
RaiseException.KERNEL32 ref: 00007FF68410DFA8

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 271c0d8bf9f0ad158ff07bec116ba512e9fe6929010cab1ea0d58cf796623e8d
Instruction ID: f9ccb9fb0d954516c38714cfd1387988a95d7fd014293d122afddc53324abd0f
Opcode Fuzzy Hash: 271c0d8bf9f0ad158ff07bec116ba512e9fe6929010cab1ea0d58cf796623e8d
Instruction Fuzzy Hash: 06B13E73600B85CBEB15CF2AC88636C7BA1FB44B48F158925DA9D87BA8CF39D461C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68410266C Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

gfff, xrefs: 00007FF6841027F6
e+000, xrefs: 00007FF684102779

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 11b650a1c3784239d1fd6df14463c68ee2151c5aaa2633adc566f6a88fb18b6f
Instruction ID: 1bbad08835d644a0dbe8429e94c168df951ac186ec9a7c8432f94db37db4f396
Opcode Fuzzy Hash: 11b650a1c3784239d1fd6df14463c68ee2151c5aaa2633adc566f6a88fb18b6f
Instruction Fuzzy Hash: CE516766B182C586E7648F359880779AB91FB54B94F48C23ACBAC87BC5DF7DD844C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F8588 Relevance: 2.2, APIs: 1, Instructions: 674COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6840F85C8

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d86fe434e41b6001a3fc2d0168113d91e5b4a952e5df6f911117f81f3967bd82
Instruction ID: eef0877f0ed11a4582206b1d24be3b481f4d283275fb13cb902a205627e98c12
Opcode Fuzzy Hash: d86fe434e41b6001a3fc2d0168113d91e5b4a952e5df6f911117f81f3967bd82
Instruction Fuzzy Hash: 3E52B42390AA86C5EB149F25C4C0BFE27A1FF01B58F18493ACA5D876D9CFB8E455D344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F96A4 Relevance: 1.8, APIs: 1, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6840F96E8

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 67e3503ca5095182f53e3daadbbeff50917cd4321a83b4807d19b934a95a1e1c
Instruction ID: 4be3a99651192178edfc186cc464acc1726c451bab80a7f50f4a16f0edaf4951
Opcode Fuzzy Hash: 67e3503ca5095182f53e3daadbbeff50917cd4321a83b4807d19b934a95a1e1c
Instruction Fuzzy Hash: 42D19322A0AB46C1EB648F69C4C167E2390FF40B68F55463ACA6D837D4DFBCE851C348

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684107F58 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF684107FBB

Part of subcall function 00007FF6840FF1A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6840FF1BC

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 7a43723d5f6ca39190d8b0e4f55405bdbfbdb2756f5dd8115f47f7f33ea78160
Instruction ID: 8652348d41b654c3e45bf994dbe3c16743aae4305a6a7532e948ba181db33916
Opcode Fuzzy Hash: 7a43723d5f6ca39190d8b0e4f55405bdbfbdb2756f5dd8115f47f7f33ea78160
Instruction Fuzzy Hash: 8C61AF22F0C692CAFB649A2888807796AC1BF50760F14423DDAEDC76C5EF7DE861C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6841040D4 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b25047ba5f04c7ac284e11e0ac21224c0795f2a74150ae96a2b12978caba41
Instruction ID: b270939b3713c08a642240a22544309c04aa8550e4ff241f88074df68d73e4e7
Opcode Fuzzy Hash: f3b25047ba5f04c7ac284e11e0ac21224c0795f2a74150ae96a2b12978caba41
Instruction Fuzzy Hash: 63519322B08791C5EB209B72A8C06BA7FA5FF44798F144139EE9CA7A99DF38D411C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6841021BC Relevance: 1.5, Strings: 1, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF68410251B

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 18aff8fdb43de5301eef239b1603367e97498316aa83c693dfebc2d028e1c4d3
Instruction ID: 711eb83a1560e09e596b74e8dfafe1f827661c46f9e28331f2b608241644796f
Opcode Fuzzy Hash: 18aff8fdb43de5301eef239b1603367e97498316aa83c693dfebc2d028e1c4d3
Instruction Fuzzy Hash: 42A15662B087C686EB65CB25E4907BABB91BF54784F04813ADE8DC7785DE3CE815C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F733C Relevance: 1.5, Strings: 1, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00007FF6840F7555

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2d1138b85b1147b0ebf82975de327dd650abc04239b98de7aa4e62eb5bbd56cf
Instruction ID: a3fd4472207d7e0b2b46daf0e0d962dcbfa6da018e27022064b5ca47c6589505
Opcode Fuzzy Hash: 2d1138b85b1147b0ebf82975de327dd650abc04239b98de7aa4e62eb5bbd56cf
Instruction Fuzzy Hash: D2B16C7290AA56C5E7699F39C09027E3BA0FF05B48F185139DA4E873D6CFB9E440C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684106848 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF68410684C

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 651349cded3eaa1f17c842fd3c57fcd57cf5434b821f59af53352c5bfef3b5c4
Instruction ID: e31a4be13fe7f69eecc53be324bf965f3775d0d5ad97e23d026b5d8cd4c47580
Opcode Fuzzy Hash: 651349cded3eaa1f17c842fd3c57fcd57cf5434b821f59af53352c5bfef3b5c4
Instruction Fuzzy Hash: E9B09225E27B02C2EA082B116CC222427A67F58B10F98003CD08C80320EE2C20F5D705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F784C Relevance: .3, Instructions: 345COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec307ed3338de62cbed40ba19046713bccc19a95b8c304709c898d113fd60b5
Instruction ID: 312f87057f009258ae1cc99f4fdbbb7a69c557229cd550ab9b5e794787e1a267
Opcode Fuzzy Hash: 4ec307ed3338de62cbed40ba19046713bccc19a95b8c304709c898d113fd60b5
Instruction Fuzzy Hash: 8DE1C32291DA42C5EB688B2984C037B27A1FF45B58F14423DCE4D877D6DFB9E942C34A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FA50C Relevance: .3, Instructions: 283COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c248f55d2cad8b17c625ec7d073b18cae2a6338ba573e08bfcc3e7637e2ac2bb
Instruction ID: 3faef9babab33d4c38e6297fa20b51c23265edac5970552eafc25aa03638ed73
Opcode Fuzzy Hash: c248f55d2cad8b17c625ec7d073b18cae2a6338ba573e08bfcc3e7637e2ac2bb
Instruction Fuzzy Hash: 57912526F1E742CAFA254B299490BBB1690BF54798F14113DDE6EC77C0DDACE806DE08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684102CEC Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c824fa0418409c4725c657295481fbfb6f8639a2c7d056fc24cb1a81b41b061d
Instruction ID: c7accae141223e2c47ebcd182377104c5d2202f80d0bcb20df73c8a244f278a2
Opcode Fuzzy Hash: c824fa0418409c4725c657295481fbfb6f8639a2c7d056fc24cb1a81b41b061d
Instruction Fuzzy Hash: 7381A172A1878186E7B4CB1994C037A6A91FF957D4F144239EADE87BD9DE3CE850CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F69F0 Relevance: .1, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69405bfc8cd9c375f2a4e114867b51ad06e270a6236c55bdc22601cf5ab1185
Instruction ID: b72d4355662be189b7c9c0ac4e2375618c7dbfabf814c03a8bc6a2b80eff3c3c
Opcode Fuzzy Hash: a69405bfc8cd9c375f2a4e114867b51ad06e270a6236c55bdc22601cf5ab1185
Instruction Fuzzy Hash: 33517F72E19611C2E7288F24C19423E27A0FF55B58F14A539CE0A977D8CFA9EC92C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F6BD8 Relevance: .1, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92c94bea4fd842bcff211724540bb77934ffb56ad01a6d4a1b7be360d8aa954
Instruction ID: 1ef546fad439da26818bd8f51e7ca3c6bec1a8e0c569bf99854601c05531d7ab
Opcode Fuzzy Hash: f92c94bea4fd842bcff211724540bb77934ffb56ad01a6d4a1b7be360d8aa954
Instruction Fuzzy Hash: 9751BD72E1A611C2E7288F29C19423E27A0FF51B58F152539CE8D977D9DFA8EC42C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F6808 Relevance: .1, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd14c38c18eb089541994a7d65b6649a4b38e485915baa4b0484587c38aa7d3
Instruction ID: 9825e0b931e730845669badc6168fee7b87fdad51a7bfdc6aa3d66c5fe725454
Opcode Fuzzy Hash: 5fd14c38c18eb089541994a7d65b6649a4b38e485915baa4b0484587c38aa7d3
Instruction Fuzzy Hash: F7516D72E0A651C2E7288F24C19433E27A0FF55B58F54563DCE49977D8CEA9E843C788

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FF4FC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f729f789081dc07bd32549d33617cd65f88c3248c5a935dac76d2a90e7153fc0
Instruction ID: a3abe95e4479cd97a202f282bed5ab9eddc03f0f8456a90b1ed791ffb7500094
Opcode Fuzzy Hash: f729f789081dc07bd32549d33617cd65f88c3248c5a935dac76d2a90e7153fc0
Instruction Fuzzy Hash: 3441C022714A5482EB44CF2AD99517A6BA1FB48FD4B49A03BEE4D87B68DE7CD141C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FCF10 Relevance: .1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fd610c0f802dcc60ae470b222653b9c8bf6f5f7747dfd2f832f3d00d0f077f
Instruction ID: 24ed681f80113d67e91a6f1d62f03e1e6593299695631a2c1f624334a740a90e
Opcode Fuzzy Hash: 08fd610c0f802dcc60ae470b222653b9c8bf6f5f7747dfd2f832f3d00d0f077f
Instruction Fuzzy Hash: 85318332E0E107C5F6A9572995D677B9552BFC2340F248138C90F82DCACCEEB94AF50A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68410DB90 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a258ecf9a2b6934d6e764c08442464d22293535620421c18e8a5b944892d5be1
Instruction ID: dd83456f24745e46605d7bdb3df02b133099c037bb8e789654534b096e2831fe
Opcode Fuzzy Hash: a258ecf9a2b6934d6e764c08442464d22293535620421c18e8a5b944892d5be1
Instruction Fuzzy Hash: 14F044B1A28265CAEBA48F2CA4826397BD0FB18780B50903DD5D9C3A04DA3C9160CF08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F28B0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9c0cbe540811d7c1fb439fc6e484141576a5598b5394a209a91fa519ee9198
Instruction ID: 829e26353b2e8486604106063d009b60c223a3bee5414417713a22c85ca77e4e
Opcode Fuzzy Hash: ab9c0cbe540811d7c1fb439fc6e484141576a5598b5394a209a91fa519ee9198
Instruction Fuzzy Hash: 9FA0012595A902D0E6849B00A8911312B61BF54340B800039D58D810A4DFADA411D225

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6841085F0 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6841081D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF684108211
Part of subcall function 00007FF6841081D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF684108291
Part of subcall function 00007FF6841081D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6841082E5
Part of subcall function 00007FF6841081D0: _get_daylight.LIBCMT ref: 00007FF68410833D

CreateFileW.KERNEL32 ref: 00007FF6841086F6
CreateFileW.KERNEL32 ref: 00007FF684108746
GetLastError.KERNEL32 ref: 00007FF684108776
GetFileType.KERNEL32 ref: 00007FF68410878B
GetLastError.KERNEL32 ref: 00007FF684108795
CloseHandle.KERNEL32 ref: 00007FF6841087C8
CloseHandle.KERNEL32 ref: 00007FF68410892C
CreateFileW.KERNEL32 ref: 00007FF684108961
GetLastError.KERNEL32 ref: 00007FF684108970

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 9ae5f5a8c053c1d1dd2a1c4c89bf1029f78995226051dbf79116b70eafdc1474
Instruction ID: f8d42c0372ac5d8589051dd68f36b3a6b4ed99c15432b0e631b6b8f9006fc9f8
Opcode Fuzzy Hash: 9ae5f5a8c053c1d1dd2a1c4c89bf1029f78995226051dbf79116b70eafdc1474
Instruction Fuzzy Hash: 5BC1B136B28A45C5EB10DF65D4912BC3BA1FB89BA8B011239DEAE977D4DF38D461C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F4A6C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6840F4AC9

Part of subcall function 00007FF6840F59C8: __GetUnwindTryBlock.LIBCMT ref: 00007FF6840F5A0B
Part of subcall function 00007FF6840F59C8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6840F5A30

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6840F4BA1
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6840F4DF6
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6840F4F02

Strings

csm, xrefs: 00007FF6840F4B4A
csm, xrefs: 00007FF6840F4AE3
csm, xrefs: 00007FF6840F4BC4

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 8e916d687b5e9b43eaa8676eb2ad1c7a6c27f5e0ded3e359381a3c2ab64b8ed1
Instruction ID: 33fc53dce5eb38c52fe3184145b6e63262189a146bd2ac098b25effcbc69b9d2
Opcode Fuzzy Hash: 8e916d687b5e9b43eaa8676eb2ad1c7a6c27f5e0ded3e359381a3c2ab64b8ed1
Instruction Fuzzy Hash: 45E1A372A19741C6EB609F65D4802AE77A0FF55798F040139EE8DABB9ACF78E080C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F3D24 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6840F3FD6,?,?,?,00007FF6840F3CC8,?,?,00000001,00007FF6840F3535), ref: 00007FF6840F3DA9
GetLastError.KERNEL32(?,?,?,00007FF6840F3FD6,?,?,?,00007FF6840F3CC8,?,?,00000001,00007FF6840F3535), ref: 00007FF6840F3DB7
LoadLibraryExW.KERNEL32(?,?,?,00007FF6840F3FD6,?,?,?,00007FF6840F3CC8,?,?,00000001,00007FF6840F3535), ref: 00007FF6840F3DE1
FreeLibrary.KERNEL32(?,?,?,00007FF6840F3FD6,?,?,?,00007FF6840F3CC8,?,?,00000001,00007FF6840F3535), ref: 00007FF6840F3E27
GetProcAddress.KERNEL32(?,?,?,00007FF6840F3FD6,?,?,?,00007FF6840F3CC8,?,?,00000001,00007FF6840F3535), ref: 00007FF6840F3E33

Strings

api-ms-, xrefs: 00007FF6840F3DC9

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d120cbac430a7cde9ed7bf2b035a8bd7cb7630aaa922411965ab72717436f98d
Instruction ID: 20d1e05f80a397165563344312c61c9ebd6eaefbe33807113ce7f218e3012510
Opcode Fuzzy Hash: d120cbac430a7cde9ed7bf2b035a8bd7cb7630aaa922411965ab72717436f98d
Instruction Fuzzy Hash: 8431BE21A1BA42C1EE15DB02A88067A3798BF48BA4F59453ADE5D8A7C4EFBCE044C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684101650 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6840FE66D), ref: 00007FF68410165F
FlsGetValue.KERNEL32(?,?,?,00007FF6840FE66D), ref: 00007FF684101674
FlsSetValue.KERNEL32(?,?,?,00007FF6840FE66D), ref: 00007FF684101695
FlsSetValue.KERNEL32(?,?,?,00007FF6840FE66D), ref: 00007FF6841016C2
FlsSetValue.KERNEL32(?,?,?,00007FF6840FE66D), ref: 00007FF6841016D3
FlsSetValue.KERNEL32(?,?,?,00007FF6840FE66D), ref: 00007FF6841016E4
SetLastError.KERNEL32(?,?,?,00007FF6840FE66D), ref: 00007FF6841016FF

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 15949b0561ea137d50506fdd8ec79dd97d734055b8a45d049a0396541e859930
Instruction ID: 4731f361cbb88cc20bd0fbe82229cf12c49396e8c68625f025283e5ad54dbe24
Opcode Fuzzy Hash: 15949b0561ea137d50506fdd8ec79dd97d734055b8a45d049a0396541e859930
Instruction Fuzzy Hash: 70218E20E0D242C2FA656761A9D11399E827F44BF0F08073DE9BEC66C6EE6DF861C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68410D528 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF68410D559
GetLastError.KERNEL32 ref: 00007FF68410D565
CloseHandle.KERNEL32 ref: 00007FF68410D57D
CreateFileW.KERNEL32 ref: 00007FF68410D5A8
WriteConsoleW.KERNEL32 ref: 00007FF68410D5C7

Strings

CONOUT$, xrefs: 00007FF68410D589

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: e1f350374d3b5acb8ca91a9a2d00138dee3832237cd9a78898d335e84adadcc7
Instruction ID: 25a61b38e909db8e12ab6c7e37132f27f3619e175910f513288163ef3e0fb3d9
Opcode Fuzzy Hash: e1f350374d3b5acb8ca91a9a2d00138dee3832237cd9a78898d335e84adadcc7
Instruction Fuzzy Hash: 58115E21B28A45C6E7509B52F885339ABA5FF98BE4F044238EA9DC7794DF7CD414C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6841017C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6841001A9,?,?,?,?,00007FF684100227,?,?,00000000,00007FF6841016B2,?,?,?), ref: 00007FF6841017D7
FlsSetValue.KERNEL32(?,?,?,00007FF6841001A9,?,?,?,?,00007FF684100227,?,?,00000000,00007FF6841016B2,?,?,?), ref: 00007FF68410180D
FlsSetValue.KERNEL32(?,?,?,00007FF6841001A9,?,?,?,?,00007FF684100227,?,?,00000000,00007FF6841016B2,?,?,?), ref: 00007FF68410183A
FlsSetValue.KERNEL32(?,?,?,00007FF6841001A9,?,?,?,?,00007FF684100227,?,?,00000000,00007FF6841016B2,?,?,?), ref: 00007FF68410184B
FlsSetValue.KERNEL32(?,?,?,00007FF6841001A9,?,?,?,?,00007FF684100227,?,?,00000000,00007FF6841016B2,?,?,?), ref: 00007FF68410185C
SetLastError.KERNEL32(?,?,?,00007FF6841001A9,?,?,?,?,00007FF684100227,?,?,00000000,00007FF6841016B2,?,?,?), ref: 00007FF684101877

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: d600949866d499faba61cc66606a69b418155eeddc8e0a7874b57269f556758f
Instruction ID: aa5cbf788600325f6bdb10da63974e3fa4e67ceb3313f236f794e0adab87b432
Opcode Fuzzy Hash: d600949866d499faba61cc66606a69b418155eeddc8e0a7874b57269f556758f
Instruction Fuzzy Hash: DA118E20E4C242C2FA65673165C1139AE82BF44BF0F14473EE8AEC76D6EE2CE562C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F3334 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6840F335F
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6840F33F4
RtlUnwindEx.KERNEL32 ref: 00007FF6840F3443

Strings

f, xrefs: 00007FF6840F3372
csm, xrefs: 00007FF6840F33DA

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 5674842d865fa054f7754243fd4700562c79f163664243a12ae4c759dea48c34
Instruction ID: d3c15e3eec9f54a2015e48cbd906ed29e6425551af362a024d4dd61839cf9787
Opcode Fuzzy Hash: 5674842d865fa054f7754243fd4700562c79f163664243a12ae4c759dea48c34
Instruction Fuzzy Hash: 58519032A1A602C6DB15CB15E484A2A3795FF44BA8F50853ADE5E877C8DFB8F841C708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840FDCC8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6840FDCED
GetProcAddress.KERNEL32 ref: 00007FF6840FDD03
FreeLibrary.KERNEL32 ref: 00007FF6840FDD2A

Strings

CorExitProcess, xrefs: 00007FF6840FDCFC
mscoree.dll, xrefs: 00007FF6840FDCE4

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b4d5c3b408ad346616be52e1836f78b68c73631f55f6072fc6aabb82c80843de
Instruction ID: 453e985d824c34297c28c1254a48206bb338f59a441712830b9f9355896d428f
Opcode Fuzzy Hash: b4d5c3b408ad346616be52e1836f78b68c73631f55f6072fc6aabb82c80843de
Instruction Fuzzy Hash: 48F09661B1960AC1EB108F24E4C577AA760BF487A1F54523DCAAE851F8DF7CD049C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68410D988 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF68410D9B0
_set_statfp.LIBCMT ref: 00007FF68410D9CB
_set_statfp.LIBCMT ref: 00007FF68410D9E7
_set_statfp.LIBCMT ref: 00007FF68410DA23

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f7d7966ef37214f077654dcdb013ff297ba3e4a7513d63f7aababb699d8a5442
Instruction ID: 5663aefcac09fae45e0e939e38797000adaa8d7d863d5ea0ffcafbce3f37c3fa
Opcode Fuzzy Hash: f7d7966ef37214f077654dcdb013ff297ba3e4a7513d63f7aababb699d8a5442
Instruction Fuzzy Hash: 27119E66E9CB03C1F7641129E8D237919807F953B0F49463CEBFE962DACE2CA861C201

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684101890 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6840FFD23,?,?,00000000,00007FF6840FFFBE,?,?,?,?,00000000,00007FF6840FFF4A), ref: 00007FF6841018AF
FlsSetValue.KERNEL32(?,?,?,00007FF6840FFD23,?,?,00000000,00007FF6840FFFBE,?,?,?,?,00000000,00007FF6840FFF4A), ref: 00007FF6841018CE
FlsSetValue.KERNEL32(?,?,?,00007FF6840FFD23,?,?,00000000,00007FF6840FFFBE,?,?,?,?,00000000,00007FF6840FFF4A), ref: 00007FF6841018F6
FlsSetValue.KERNEL32(?,?,?,00007FF6840FFD23,?,?,00000000,00007FF6840FFFBE,?,?,?,?,00000000,00007FF6840FFF4A), ref: 00007FF684101907
FlsSetValue.KERNEL32(?,?,?,00007FF6840FFD23,?,?,00000000,00007FF6840FFFBE,?,?,?,?,00000000,00007FF6840FFF4A), ref: 00007FF684101918

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b9d0f39cf87e550e7373e0bcab485d5e02ce5d5aaf4965d8be53be057f4360ae
Instruction ID: 0d7a08c3410a2c57fdc9f8b1fdaa67ce3187c508bbdcc7ecca26d02d408bd285
Opcode Fuzzy Hash: b9d0f39cf87e550e7373e0bcab485d5e02ce5d5aaf4965d8be53be057f4360ae
Instruction Fuzzy Hash: 37116D20E0D642C1FA696325A5C1179AE817F447B0F04533DE8AE866DAEE3CE462C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684101724 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6840FE66D), ref: 00007FF684101735
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6840FE66D), ref: 00007FF684101754
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6840FE66D), ref: 00007FF68410177C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6840FE66D), ref: 00007FF68410178D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6840FE66D), ref: 00007FF68410179E

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a549a77e1e528f092dfa9b4d36fdf3ba9a090c7c2449dc1340dcf4919b041a0d
Instruction ID: d95fbaf5b2936ee87659cb8e07528a19ec07528e2b0b42b94a8db30dc59b6107
Opcode Fuzzy Hash: a549a77e1e528f092dfa9b4d36fdf3ba9a090c7c2449dc1340dcf4919b041a0d
Instruction Fuzzy Hash: D6112A14E49247C2FA69633158D15795E827F45BB0E041B3DE9BECA2C2EE3DF462D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6841019FC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF684101CA5

Part of subcall function 00007FF684107D94: _invalid_parameter_noinfo.LIBCMT ref: 00007FF684107DB1

Strings

UTF-8, xrefs: 00007FF684101C28
ccs, xrefs: 00007FF684101BF1
UTF-16LEUNICODE, xrefs: 00007FF684101C49

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 3de14f5d5c9a4aabf8cf3c2becf0dd26e9540cc5455f39d4de4dde48d87fb953
Instruction ID: 069f79c1488583982ab4f38813e2411aebd666207407068eee097e52b02d3e90
Opcode Fuzzy Hash: 3de14f5d5c9a4aabf8cf3c2becf0dd26e9540cc5455f39d4de4dde48d87fb953
Instruction Fuzzy Hash: 6D81B132E0C242C5F7A54A2886D4278AFA1BF11748F59903DCA8EC7695EF2FE861D305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F4F44 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6840F4F90
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6840F4FDF

Strings

RCC, xrefs: 00007FF6840F4FAD
MOC, xrefs: 00007FF6840F4FA4

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c77e720224de488b4c413800bc05c3d3e6fba984749f43d5e87a3be5d7cbd9fb
Instruction ID: 89c5ee3a9a2a6160ddfe349d11c6d145cabd1f4091a1c1a23b2c162d69d01f7e
Opcode Fuzzy Hash: c77e720224de488b4c413800bc05c3d3e6fba984749f43d5e87a3be5d7cbd9fb
Instruction Fuzzy Hash: 4B614A36A09A45CAE720CF65D4803AE77A0FB84B88F144239EF8D57B99DFB8E055C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F52A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6840F52C8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6840F53B0

Strings

csm, xrefs: 00007FF6840F52EA
csm, xrefs: 00007FF6840F5402

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: d6ab328318f37516ec412dab3fcf5e3b622bb538729ab8e4a9228887a9b4d15e
Instruction ID: 73a1f0a084e9042ea1e893a0ce01face96b2a28b4e1ba6987b7e9ead7e5f48b6
Opcode Fuzzy Hash: d6ab328318f37516ec412dab3fcf5e3b622bb538729ab8e4a9228887a9b4d15e
Instruction Fuzzy Hash: 05519F3290A252C6EB648F15948426AB7A0FF94B89F544139DACC87BD6CFBCF451CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684106EA4 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF684106F2B
WriteFile.KERNEL32 ref: 00007FF6841071F2
WriteFile.KERNEL32 ref: 00007FF68410723B
GetLastError.KERNEL32 ref: 00007FF6841072FC

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3935df83813671c5302a5d3511c6a77fec9548675e737d46d0d1eb1d1baf9780
Instruction ID: 2b24f52aadf6db983477e21e322f8bbf32392153eea5237aac9180fcd1c8b683
Opcode Fuzzy Hash: 3935df83813671c5302a5d3511c6a77fec9548675e737d46d0d1eb1d1baf9780
Instruction Fuzzy Hash: 0CD10222B08A85C9E711CF79D5802BC3BB1FB55798B10423ADE9D97B99DF38D526C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6841081D0 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF684108211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF684108291
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6841082E5
_get_daylight.LIBCMT ref: 00007FF68410833D

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 84fa70e16dec7406d439eee739c354eb90958fd93df13ea6f15e958565aa6c79
Instruction ID: 9687cd04a770cfdeb6e49bdb64029720cc990aecd9c016366f43ac00d1c077d4
Opcode Fuzzy Hash: 84fa70e16dec7406d439eee739c354eb90958fd93df13ea6f15e958565aa6c79
Instruction Fuzzy Hash: 2B51C136D0CA02C2F7694A28998137E6ED0BF85B14F19503DDACDCA2DADE3CE860D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF684107550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF684107667
GetLastError.KERNEL32 ref: 00007FF684107689

Strings

U, xrefs: 00007FF684107613

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ec5d196d87fa6afedfc1b7cbf2143a831a76c7b6d5d102da5dfce111a9055b17
Instruction ID: 227fb4eaccd2511157720ffa0e214e3dbef4ad76942c37c640974de2fae02003
Opcode Fuzzy Hash: ec5d196d87fa6afedfc1b7cbf2143a831a76c7b6d5d102da5dfce111a9055b17
Instruction Fuzzy Hash: B241B162B18A41C2EB509F25E4847B96BA1FB98794F404135EE8EC7B84EF7CD451C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6840F5DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6840F5E14
RaiseException.KERNEL32 ref: 00007FF6840F5E5A

Strings

csm, xrefs: 00007FF6840F5E47

Memory Dump Source

Source File: 00000000.00000002.2078013824.00007FF6840F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6840F0000, based on PE: true

Associated: 00000000.00000002.2077998888.00007FF6840F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078034648.00007FF68410F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078050634.00007FF68411A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078064756.00007FF684123000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6840f0000_grade.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 60492db50927d80b48fe4c7c35c2f26e12b515590f004ef549d900166b0380f4
Instruction ID: be336a911e9ae028df3ac082b2917423d30c36be125a5978007de6ade2a307f8
Opcode Fuzzy Hash: 60492db50927d80b48fe4c7c35c2f26e12b515590f004ef549d900166b0380f4
Instruction Fuzzy Hash: CE114F32A19B4182EB548F15E48026ABBA4FF88B94F584238EECC47799DFBCD551C700

Uniqueness

Uniqueness Score: -1.00%

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.306864194732709
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	grade.exe
File size:	180'224 bytes
MD5:	6e57c402199ce6e7bbf5ede13d4a838e
SHA1:	69fb871bdb2d0fa0af25107215b5187e1f420ada
SHA256:	e3eb252b1b009440c097ba7a40d8b2ccc4e233847dec9e1d6c08c5a4439dcc12
SHA512:	9c921a76c7ce2b15f5c7df716b88e823b3f211e918348a20063e44b7f577db1b8b695fc33f96d74da9508b37bd08dc0a9a643b36585c6f35fec7572b69a69cb0
SSDEEP:	3072:fP7Eucpu+5JdvyOoyrjuPo2UsdZTAg9umO/Cyhdw7+dibC5:oHpu+5Pvyr0juPo2Bj8DmO/1Y
TLSH:	8504AE5A77A114F4E1B78238CC510686E772B8120B219BAF03A41776DF3B3A15E3FB65
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.@.<..H<..H<..H..-I;..H..+I...H..I0..H../I?..H<./He..Hs..H=..Hs.+I...Hs.I,..Hs.-I5..H..*I=..H..,I=..HRich<..H...............

Entrypoint:	0x1400020f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x662566DE [Sun Apr 21 19:19:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8b2f0481982bd74a15596f64ec245694

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre


Icon Hash:	00928e8e8686b000

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report grade.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: grade.exePID: 2632, Parent PID: 4004

General

Chronological Activities

Analysis Process: conhost.exePID: 3004, Parent PID: 2632

General

Chronological Activities

Disassembly

Analysis Process: grade.exePID: 2632, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF684100274 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Control-flow Graph

Function 00007FF684107880 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Windows Analysis Report
grade.exe

Function 00007FF684100274 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Function 00007FF684107880 Relevance: 6.2, APIs: 4, Instructions: 218
COMMONLIBRARYCODE

Function 00007FF68410064C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Function 00007FF6840F1F74 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF6840FDC64 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF684104ADC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
COMMON

Function 00007FF684105068 Relevance: 3.2, APIs: 2, Instructions: 193
COMMON

Function 00007FF684107330 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMONLIBRARYCODE

Function 00007FF684100D28 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Function 00007FF6840F1E90 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Function 00007FF6840FDB95 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00007FF684105B0C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FF6841001C0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Function 00007FF6840F1D30 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON