Edit tour

Windows Analysis Report
self_updater.exe

Overview

General Information

Sample name:	self_updater.exe
Analysis ID:	1430873
MD5:	a6e4bd1b55655a29a1b25f2a567a65b7
SHA1:	7a40ce5381449e369042f7a9adc1ae49ff1b22d3
SHA256:	34077f9227c2fd9ee9949a0ff0ee436d80b0ac5322a02c524327be953be08c70
Tags:	exe
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

self_updater.exe (PID: 5748 cmdline: "C:\Users\user\Desktop\self_updater.exe" MD5: A6E4BD1B55655A29A1B25F2A567A65B7)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Desktop\self_updater.exe

Code function: 0_2_00007FF76B1B9A40 BCryptGenRandom,GetCurrentProcessId,BCryptGenRandom,CreateNamedPipeW,GetLastError,BCryptGenRandom,CloseHandle,BCryptGenRandom,

0_2_00007FF76B1B9A40

Source: self_updater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\a\clangen\clangen\self_updater\target\release\deps\self_updater.pdb source: self_updater.exe

Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B7CB0 CloseHandle,FindFirstFileW,FindClose,		0_2_00007FF76B1B7CB0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B6960 FindFirstFileW,GetLastError,		0_2_00007FF76B1B6960

Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B8150 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,		0_2_00007FF76B1B8150
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B6730 CloseHandle,NtCreateFile,RtlNtStatusToDosError,		0_2_00007FF76B1B6730

Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1AEC40	0_2_00007FF76B1AEC40
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1A2000	0_2_00007FF76B1A2000
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1AC430	0_2_00007FF76B1AC430
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1BFCC0	0_2_00007FF76B1BFCC0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1C3CD0	0_2_00007FF76B1C3CD0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1CD4A0	0_2_00007FF76B1CD4A0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1CDBA0	0_2_00007FF76B1CDBA0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B9A40	0_2_00007FF76B1B9A40
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1C2A50	0_2_00007FF76B1C2A50
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1C9260	0_2_00007FF76B1C9260
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1BA970	0_2_00007FF76B1BA970
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1A69A0	0_2_00007FF76B1A69A0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B5860	0_2_00007FF76B1B5860
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B8DC0	0_2_00007FF76B1B8DC0

Source: C:\Users\user\Desktop\self_updater.exe

Code function: String function: 00007FF76B1CCD60 appears 73 times

Source: classification engine

Classification label: clean5.winEXE@2/0@0/0

Source: C:\Users\user\Desktop\self_updater.exe

Code function: 0_2_00007FF76B1B82A0 GetModuleHandleW,FormatMessageW,GetLastError,

0_2_00007FF76B1B82A0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03

Source: self_updater.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\self_updater.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\self_updater.exe "C:\Users\user\Desktop\self_updater.exe"
Source: C:\Users\user\Desktop\self_updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\self_updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\self_updater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\self_updater.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: self_updater.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: self_updater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: self_updater.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\a\clangen\clangen\self_updater\target\release\deps\self_updater.pdb source: self_updater.exe

Source: C:\Users\user\Desktop\self_updater.exe

Code function: 0_2_00007FF76B1C26B0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,ReleaseMutex,

0_2_00007FF76B1C26B0

Source: self_updater.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\self_updater.exe

API coverage: 2.6 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B7CB0 CloseHandle,FindFirstFileW,FindClose,		0_2_00007FF76B1B7CB0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1B6960 FindFirstFileW,GetLastError,		0_2_00007FF76B1B6960

Source: C:\Users\user\Desktop\self_updater.exe

Code function: 0_2_00007FF76B1CFBB0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF76B1CFBB0

Source: C:\Users\user\Desktop\self_updater.exe

0_2_00007FF76B1C26B0

Source: C:\Users\user\Desktop\self_updater.exe

Code function: 0_2_00007FF76B1B5810 GetProcessHeap,HeapAlloc,

0_2_00007FF76B1B5810

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1AB260 RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetLastError,	0_2_00007FF76B1AB260
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1CFBB0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF76B1CFBB0
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1D398C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF76B1D398C
Source: C:\Users\user\Desktop\self_updater.exe	Code function: 0_2_00007FF76B1CFD54 SetUnhandledExceptionFilter,	0_2_00007FF76B1CFD54

Source: C:\Users\user\Desktop\self_updater.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\self_updater.exe

Code function: 0_2_00007FF76B1B9A40 BCryptGenRandom,GetCurrentProcessId,BCryptGenRandom,CreateNamedPipeW,GetLastError,BCryptGenRandom,CloseHandle,BCryptGenRandom,

0_2_00007FF76B1B9A40

Source: C:\Users\user\Desktop\self_updater.exe

Code function: 0_2_00007FF76B1CFA8C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF76B1CFA8C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	2 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
self_updater.exe	3%	Virustotal		Browse
self_updater.exe	0%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430873
Start date and time:	2024-04-24 10:16:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	self_updater.exe
Detection:	CLEAN
Classification:	clean5.winEXE@2/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.285441535396971
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	self_updater.exe
File size:	295'424 bytes
MD5:	a6e4bd1b55655a29a1b25f2a567a65b7
SHA1:	7a40ce5381449e369042f7a9adc1ae49ff1b22d3
SHA256:	34077f9227c2fd9ee9949a0ff0ee436d80b0ac5322a02c524327be953be08c70
SHA512:	d0cd269f9ac94be178f0428af048d077edad767c3a6c5ecde553ca36baf1dcab07bfc9353fb875d78b7e0c0c63dd92ef1624445e9318dbf7a3d5a154acccd328
SSDEEP:	3072:1naSAxCbhyHGsuHvWmDDkIOBiWGZzsmuW3hPMqCbQeLz8iCCWhjarxwJJJRJRJEl:AnwOuHOmDD8Gp9MbQeL4iCxwMfY
TLSH:	DD544C11FA562CEDD45AC07882464A327A7274C60B32F9FF06D486393F6BAE46E3C754
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c...c...c...j...m....?..K....?..o....?..r...(...n...c.......c...m....<..b...Richc...........PE..d......f.........."....'.N.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14002f7a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66118D1B [Sat Apr 6 17:57:47 2024 UTC]
TLS Callbacks:	0x40020e30, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	eacde63b8c5ae9b27d4f93898653d04e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FC77CF01238h
dec eax
add esp, 28h
jmp 00007FC77CF00DC7h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007FC77CF00F68h
inc cx
and edx, 8D4DF000h
wait
add al, dh

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x44f54	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x47000	0x2514	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3e690	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3e880	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3e550	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x428	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x34ca0	0x34e00	ab738233743b45f3b7591eb1dd3be364	False	0.49415447695035464	data	6.316762075438403	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x36000	0xfeba	0x10000	e1f4e0d258bf1ec0866661a96dda4388	False	0.3555908203125	data	5.332702349758107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0xab0	0x200	4492b54b160136623df598777f78a65a	False	0.30859375	data	2.6499731830800375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x47000	0x2514	0x2600	d1669707f79bd09b20a2da1a455dae97	False	0.48828125	PEX Binary Archive	5.414011644199359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x4a000	0x1f4	0x200	d554f566bbd80063e0c23db106eea2e7	False	0.517578125	data	4.169880245115774	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x594	0x600	345304e8d0e4920b0855150856d152c6	False	0.626953125	data	5.257851510935078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteProcThreadAttributeList, CompareStringOrdinal, GetLastError, AddVectoredExceptionHandler, SetThreadStackGuarantee, SwitchToThread, CreateWaitableTimerExW, SetWaitableTimer, WaitForSingleObject, Sleep, QueryPerformanceCounter, AcquireSRWLockExclusive, RtlCaptureContext, RtlVirtualUnwind, RtlLookupFunctionEntry, SetLastError, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetCurrentProcess, GetCommandLineW, SetFileInformationByHandle, DuplicateHandle, GetStdHandle, GetCurrentProcessId, WriteFileEx, SleepEx, TerminateProcess, TryAcquireSRWLockExclusive, HeapFree, HeapReAlloc, AcquireSRWLockShared, ReleaseSRWLockShared, ReleaseMutex, GetModuleHandleA, GetProcAddress, GetProcessHeap, FreeEnvironmentStringsW, FindNextFileW, FindClose, CreateFileW, GetFileInformationByHandle, GetFileInformationByHandleEx, CreateDirectoryW, FindFirstFileW, DeleteFileW, CopyFileExW, GetConsoleMode, GetModuleHandleW, FormatMessageW, GetModuleFileNameW, GetFullPathNameW, CreateNamedPipeW, ReadFileEx, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, MultiByteToWideChar, WriteConsoleW, CreateThread, GetCurrentThread, GetSystemTimeAsFileTime, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, FreeLibrary, ReleaseSRWLockExclusive, CloseHandle, HeapAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, EncodePointer, RaiseException, RtlPcToFileHeader, RtlUnwindEx, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, InitializeSListHead, GetCurrentThreadId, LoadLibraryExW
ADVAPI32.dll	SystemFunction036
bcrypt.dll	BCryptGenRandom
ntdll.dll	NtCreateFile, RtlNtStatusToDosError, NtWriteFile
api-ms-win-crt-string-l1-1-0.dll	strcpy_s, wcsncmp
api-ms-win-crt-runtime-l1-1-0.dll	_initialize_onexit_table, abort, _seh_filter_exe, _set_app_type, _crt_atexit, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _get_initial_narrow_environment, _initterm, _cexit, _initterm_e, _c_exit, _register_onexit_function, __p___argv, __p___argc, exit, _exit, terminate
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	__p__commode, _set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, calloc, malloc, free

Target ID:	0
Start time:	10:17:08
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\self_updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\self_updater.exe"
Imagebase:	0x7ff76b1a0000
File size:	295'424 bytes
MD5 hash:	A6E4BD1B55655A29A1B25F2A567A65B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:17:08
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.9%
Total number of Nodes:	413
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF76B1A2000 Relevance: 14.3, APIs: 2, Strings: 7, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76B1AB990: CreateWaitableTimerExW.KERNEL32(?,?,?,?,?,?,00007FF76B1A206F), ref: 00007FF76B1AB9BA
Part of subcall function 00007FF76B1AB990: SetWaitableTimer.KERNELBASE ref: 00007FF76B1ABA10
Part of subcall function 00007FF76B1AB990: WaitForSingleObject.KERNEL32 ref: 00007FF76B1ABA22
Part of subcall function 00007FF76B1AB990: FindCloseChangeNotification.KERNELBASE ref: 00007FF76B1ABA2D
Part of subcall function 00007FF76B1AB990: Sleep.KERNEL32(?,?,?,?,?,?,00007FF76B1A206F), ref: 00007FF76B1ABA89

CloseHandle.KERNEL32 ref: 00007FF76B1A2E7F

Strings

Download, xrefs: 00007FF76B1A2221
cmd.exe/CstartClangen.exe, xrefs: 00007FF76B1A2B67
auto-updatedStarting game, xrefs: 00007FF76B1A2A9D
a Display implementation returned an error unexpectedly/rustc/7cf61ebde7b22796c69757901dd346d0fe70bd97\library\alloc\src\string.rs, xrefs: 00007FF76B1A2F9E
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF76B1A2F71, 00007FF76B1A2FD2
DownloadsClangenApplying updated files, xrefs: 00007FF76B1A24B9
Download, xrefs: 00007FF76B1A282E

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CloseTimerWaitable$ChangeCreateFindHandleNotificationObjectSingleSleepWait
String ID: Download$Download$DownloadsClangenApplying updated files$a Display implementation returned an error unexpectedly/rustc/7cf61ebde7b22796c69757901dd346d0fe70bd97\library\alloc\src\string.rs$auto-updatedStarting game$called `Result::unwrap()` on an `Err` value$cmd.exe/CstartClangen.exe
API String ID: 3431879209-302005439
Opcode ID: 530b4051f85cb137c2640e3ec11604f1ba58faa2dd0f99c45bd66fb6216bca5c
Instruction ID: 4455a70104cd261af6c67e72aee2772f25870e5519ac683a0b0b61dd8b295203
Opcode Fuzzy Hash: 530b4051f85cb137c2640e3ec11604f1ba58faa2dd0f99c45bd66fb6216bca5c
Instruction Fuzzy Hash: 30925662615AC6D8FB74AF29E8507E96361FB4278CF804135DA4C0BEAADF3DE245C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1AB260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF76B1AB28A
SetThreadStackGuarantee.KERNELBASE ref: 00007FF76B1AB2A4
GetLastError.KERNEL32 ref: 00007FF76B1AB2AE

Strings

main, xrefs: 00007FF76B1AB2BD

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorExceptionGuaranteeHandlerLastStackThreadVectored
String ID: main
API String ID: 1207050972-3207122276
Opcode ID: d6936c2398ac65e231b754b425a5d3696dd2cab96e428a23b6a25428cfa8fee7
Instruction ID: dd7f3d46cecaa6fbdd4969dba669e455fca7afb7b73baad99c61bcf835d7c12f
Opcode Fuzzy Hash: d6936c2398ac65e231b754b425a5d3696dd2cab96e428a23b6a25428cfa8fee7
Instruction Fuzzy Hash: E4714C22A04B85E9EB18EF68E8503E977A4FB4634CFD04535DA4D42AA9DF38E585C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1AEC40 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorHandleLast
String ID:
API String ID: 2586478127-0
Opcode ID: 3c8e6f28b6e6637481e2718ad6d752708c67d8b475c7eb4cc220ec60e0d66943
Instruction ID: 52e998bc683c9100881f3ccd7a41ae6b30dfcf9796481bee8003f0d8034a4e52
Opcode Fuzzy Hash: 3c8e6f28b6e6637481e2718ad6d752708c67d8b475c7eb4cc220ec60e0d66943
Instruction Fuzzy Hash: 34F1E262B18646E2EE18AB19B9003BAA751FB4679CFD48531DE1D53BA4DF3CF581C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1CF624 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76B1CF888: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF76B1CF89C

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF76B1CF64D
__scrt_release_startup_lock.LIBCMT ref: 00007FF76B1CF6BB
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1CF709
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1CF70E
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1CF716
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1CF71E
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1CF740
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1CF79A

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1804101941-0
Opcode ID: 4b7976ab3a7e7515828f30066834e75d186cf6026e36aec12c915f118a6745c4
Instruction ID: aab527dfa8e7f1ff2d68995109aaef9028c79f089a4b17168b9cd0314af18575
Opcode Fuzzy Hash: 4b7976ab3a7e7515828f30066834e75d186cf6026e36aec12c915f118a6745c4
Instruction Fuzzy Hash: 91311A21A08647E1EA1CBB6CB4153B9E3619F4778CFD40035E65E476F7DF2CA8498A30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1AB990 Relevance: 9.1, APIs: 6, Instructions: 79
timesleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerExW.KERNEL32(?,?,?,?,?,?,00007FF76B1A206F), ref: 00007FF76B1AB9BA
SetWaitableTimer.KERNELBASE ref: 00007FF76B1ABA10
WaitForSingleObject.KERNEL32 ref: 00007FF76B1ABA22
FindCloseChangeNotification.KERNELBASE ref: 00007FF76B1ABA2D
CloseHandle.KERNEL32(?,?,?,?,?,?,00007FF76B1A206F), ref: 00007FF76B1ABA3D
Sleep.KERNEL32(?,?,?,?,?,?,00007FF76B1A206F), ref: 00007FF76B1ABA89

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CloseTimerWaitable$ChangeCreateFindHandleNotificationObjectSingleSleepWait
String ID:
API String ID: 3431879209-0
Opcode ID: fc1fe2e16af9744694a1f90e09089568cedd9f92e0ee075a955cdac10e5f64b4
Instruction ID: f0c1245791939e03778bb901be628ad3a8f806e4540f3f7568c1899d1577ef99
Opcode Fuzzy Hash: fc1fe2e16af9744694a1f90e09089568cedd9f92e0ee075a955cdac10e5f64b4
Instruction Fuzzy Hash: 2A210B21F0A6DA92EE5CAB69B91573AB2519F87758FC45234DD1F42BF0DE3C74018310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C0260 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF76B1C028F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF76B1C02A3
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF76B1C02DE
CloseHandle.KERNEL32 ref: 00007FF76B1C05BC

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF76B1C053A

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Handle$CloseConsoleErrorLastMode
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1170577072-2333694755
Opcode ID: f63e01cc2ab66731026f09ccb1b31abaabfa351fcc2c39ce0f63af8fcbc40e3a
Instruction ID: 902821f63e7d01e2b82e559d4eee85f1b652ad85914be32ca6077039ad743b9b
Opcode Fuzzy Hash: f63e01cc2ab66731026f09ccb1b31abaabfa351fcc2c39ce0f63af8fcbc40e3a
Instruction Fuzzy Hash: E8A19262A08B96E4FB14AB69F8443FDA760BB0679CFC44531DE9D126A9DF3CD185C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C05D0 Relevance: 7.7, APIs: 5, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?), ref: 00007FF76B1C0648
WriteConsoleW.KERNELBASE ref: 00007FF76B1C0685
WriteConsoleW.KERNEL32 ref: 00007FF76B1C06E4
GetLastError.KERNEL32 ref: 00007FF76B1C06EE
GetLastError.KERNEL32 ref: 00007FF76B1C077E

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID:
API String ID: 1956605914-0
Opcode ID: e4c5046e0223f60c82e2aafaece7b8b738f2cb250fa9fa7a01166a66f2fbcd3d
Instruction ID: c0f7a2c92c3c9c2a894f3c0ca2a7196ebd0ff0734bdaf7560b232da4b0911c60
Opcode Fuzzy Hash: e4c5046e0223f60c82e2aafaece7b8b738f2cb250fa9fa7a01166a66f2fbcd3d
Instruction Fuzzy Hash: 4251B362A08742D2F728AB19B4443BAE351FB86788FE44131D6CD42AF5DF7CD1858B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B4050 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF76B1B4206
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF76B1B425B

Strings

Box<dyn Any><unnamed>, xrefs: 00007FF76B1B411F
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF76B1B436D, 00007FF76B1B43AA

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: Box<dyn Any><unnamed>$cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs
API String ID: 17069307-3513654867
Opcode ID: 9e56891dbaaa2be37ae945aff01b3c740409319bc1c15ef59940a5850b45ce90
Instruction ID: cc7d40f86e4c4ddea9602a88ad398eadec53d6bd29588808fbfacd71f06beb4d
Opcode Fuzzy Hash: 9e56891dbaaa2be37ae945aff01b3c740409319bc1c15ef59940a5850b45ce90
Instruction Fuzzy Hash: 2CB16F22A08A42E9EB69EB68F4403B8B7A0FB5675CFC48135DA4D437A4DF3CE555C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1AE300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF76B1AEA43), ref: 00007FF76B1AE353
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF76B1AEA43), ref: 00007FF76B1AE3CC

Strings

lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs, xrefs: 00007FF76B1AE3F8

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs
API String ID: 17069307-2303981482
Opcode ID: ed33352e7b6040fd366c7ab2bdab19be1b2995ea5d4f83659e79aff401a97841
Instruction ID: 0d578acfca2bc32b7622b016ba7c1de1d20471d0095f5d3aae596b6089bc1087
Opcode Fuzzy Hash: ed33352e7b6040fd366c7ab2bdab19be1b2995ea5d4f83659e79aff401a97841
Instruction Fuzzy Hash: 0F413D32A08A45EAEB44EB59E4803BC7770FB45798F944531CE1D53BA5CF38EA99C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B4A30 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AcquireSRWLockShared.KERNEL32 ref: 00007FF76B1B4ADB
ReleaseSRWLockShared.KERNEL32 ref: 00007FF76B1B4B4A

Part of subcall function 00007FF76B1B4050: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF76B1B4206
Part of subcall function 00007FF76B1B4050: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF76B1B425B

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: 5e341088182c183f0d7d68509e4669679a9df31a7ef7eee532a90243b0e016df
Instruction ID: 5aafff9f47b7356930ac24bcc704acfc3a103a11499a8d3300aa4c6669604f23
Opcode Fuzzy Hash: 5e341088182c183f0d7d68509e4669679a9df31a7ef7eee532a90243b0e016df
Instruction Fuzzy Hash: 0A914B32A08B81E8E714DB68E8503EC7BB4FB5635CF844135DA4C57AA9DF7C9199C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C0B10 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00007FF76B1C0B67
SetThreadDescription.KERNELBASE ref: 00007FF76B1C0B7A

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Thread$CurrentDescription
String ID:
API String ID: 654298328-0
Opcode ID: 7464b5da271eee3547e64a4047024a25f405b5475353236b9fc7ec4c266b1c63
Instruction ID: e2810dce00180af8bb835e3888d2d4d4cd679f546fe4fbc0a6d0d212dd241aea
Opcode Fuzzy Hash: 7464b5da271eee3547e64a4047024a25f405b5475353236b9fc7ec4c266b1c63
Instruction Fuzzy Hash: 3A018455A0C996D1E914B719F8043AEE762AB83BC8F904032EE4D17BB9DE1CE9424B10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF76B1BA970 Relevance: 65.3, APIs: 30, Strings: 6, Instructions: 2309COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF76B1BAA08
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF76B1BAB8C
CloseHandle.KERNEL32 ref: 00007FF76B1BBEB3

Strings

assertion failed: self.height > 0, xrefs: 00007FF76B1BDDD3
]?\\, xrefs: 00007FF76B1BB437
exe\\.\NUL\cmd.exemaximum number of ProcThreadAttributes exceeded, xrefs: 00007FF76B1BB95E, 00007FF76B1BBB2C, 00007FF76B1BBBAF, 00007FF76B1BCAD9, 00007FF76B1BCCD7
\?\\, xrefs: 00007FF76B1BB42F
.exeprogram not found, xrefs: 00007FF76B1BB67A
PATHRUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none(), xrefs: 00007FF76B1BCC55

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: EnvironmentStrings$CloseFreeHandle
String ID: .exeprogram not found$PATHRUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none()$\?\\$]?\\$assertion failed: self.height > 0$exe\\.\NUL\cmd.exemaximum number of ProcThreadAttributes exceeded
API String ID: 1070102993-3723273602
Opcode ID: c0a569ba85f51ca923f5c5b309cb1ea40d53f37039219e3267504b114ac614ab
Instruction ID: b8f587001ad862794bbe4e3e8d6a5e3f79fc3b3d08cab10589a2975298470550
Opcode Fuzzy Hash: c0a569ba85f51ca923f5c5b309cb1ea40d53f37039219e3267504b114ac614ab
Instruction Fuzzy Hash: 91436362A19BC1D8EB789F29EC403FE6361FB4678DF945135DA4D4BBA9DF3892408310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C2A50 Relevance: 33.9, APIs: 9, Strings: 10, Instructions: 607libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF76B1C2AB9
GetCurrentProcess.KERNEL32 ref: 00007FF76B1C2AD2
GetCurrentProcess.KERNEL32(00000000,?,00000000,?,?,?,00000000), ref: 00007FF76B1C2E9A
GetProcAddress.KERNEL32(?,00000000,?,?,?,00000000), ref: 00007FF76B1C2ED3
GetProcAddress.KERNEL32(?,00000000,?,?,?,00000000), ref: 00007FF76B1C2F20

Strings

X, xrefs: 00007FF76B1C2A94
SymFromAddrW, xrefs: 00007FF76B1C2AB2
SymGetLineFromInlineContextW, xrefs: 00007FF76B1C341A
SymFromInlineContextW, xrefs: 00007FF76B1C3067
SymAddrIncludeInlineTrace, xrefs: 00007FF76B1C2ECC
SymGetLineFromAddrW64, xrefs: 00007FF76B1C2D4D
(, xrefs: 00007FF76B1C33F9
X, xrefs: 00007FF76B1C3049
(, xrefs: 00007FF76B1C2D32
SymQueryInlineTrace, xrefs: 00007FF76B1C2F19

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: ($($SymAddrIncludeInlineTrace$SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$SymQueryInlineTrace$X$X
API String ID: 2190909847-3202392857
Opcode ID: e30f1d612a7b3f430123cc6f6944f8b97de3b68347d457c5f1d03cbb938c8741
Instruction ID: 249d876b30793c7e827bdb8893298cf251a53a1d046fda0db4d78f53a4e2284d
Opcode Fuzzy Hash: e30f1d612a7b3f430123cc6f6944f8b97de3b68347d457c5f1d03cbb938c8741
Instruction Fuzzy Hash: 2F42D031A08A86E2E7799B18F4557FAB360FB86798F804135EA8D037A4DF3DD146CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C26B0 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 213libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C26F8
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C2711
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C274A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C2782
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C27BB
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C27D4
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C2812
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C286C
CreateMutexA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C28FE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C2923
ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00007FF76B1C2969
ReleaseMutex.KERNEL32(?,?,?,?,?,?), ref: 00007FF76B1C29EE

Strings

dbghelp.dll, xrefs: 00007FF76B1C270A
SymInitializeW, xrefs: 00007FF76B1C27B4
SymGetOptions, xrefs: 00007FF76B1C2740
SymSetOptions, xrefs: 00007FF76B1C277B
SymAddrIncludeInlineTrace, xrefs: 00007FF76B1C280B

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressProc$Mutex$CurrentProcessRelease$CloseCreateHandleLibraryLoadObjectSingleWait
String ID: SymAddrIncludeInlineTrace$SymGetOptions$SymInitializeW$SymSetOptions$dbghelp.dll
API String ID: 2119853198-1171149474
Opcode ID: 5c143e11d80fa01238cad2a36c58b413d208c860972f4d8c067e61fe3478eec1
Instruction ID: 4de3d84e8412e56faea7bc5de57f1a606bf71eee2b2b03acba16968c24199450
Opcode Fuzzy Hash: 5c143e11d80fa01238cad2a36c58b413d208c860972f4d8c067e61fe3478eec1
Instruction Fuzzy Hash: 6691D321A08A56E6FB19AB29F8402B4B3A0BF5676CFC45234DD5D066F4DF3CE185C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1CFBB0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF76B1CFBCC
RtlCaptureContext.KERNEL32 ref: 00007FF76B1CFBF9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF76B1CFC13
RtlVirtualUnwind.KERNEL32 ref: 00007FF76B1CFC54
IsDebuggerPresent.KERNEL32 ref: 00007FF76B1CFCA8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF76B1CFCC5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF76B1CFCD0

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2f7c665012475e383b50a7e4feef5da496d97ff880124e9ebb431658ca87039e
Instruction ID: 577233cf288ea2a3248bfcaa86e57ef51c5f50ef9a8fa71bc4e9d6e9a270887e
Opcode Fuzzy Hash: 2f7c665012475e383b50a7e4feef5da496d97ff880124e9ebb431658ca87039e
Instruction Fuzzy Hash: C4313D72604A81D5EB649F64F8503EDB364FB85708F80413ADA4E47BA9DF3CD548C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B82A0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF76B1B82FF
FormatMessageW.KERNEL32 ref: 00007FF76B1B8346
GetLastError.KERNEL32 ref: 00007FF76B1B840F

Strings

assertion failed: self.is_char_boundary(new_len)/rustc/7cf61ebde7b22796c69757901dd346d0fe70bd97\library\alloc\src\string.rs, xrefs: 00007FF76B1B8635
NTDLL.DLL, xrefs: 00007FF76B1B82F8

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorFormatHandleLastMessageModule
String ID: NTDLL.DLL$assertion failed: self.is_char_boundary(new_len)/rustc/7cf61ebde7b22796c69757901dd346d0fe70bd97\library\alloc\src\string.rs
API String ID: 1273946083-3255755980
Opcode ID: dc9a0ff53819d05abff7ad6778eb36332ce663dcdb25176ca01a1c0113792c81
Instruction ID: 820718cea7a257a283ede0e94cdc71069f247d84048cd8b756d1740fb7f69e5c
Opcode Fuzzy Hash: dc9a0ff53819d05abff7ad6778eb36332ce663dcdb25176ca01a1c0113792c81
Instruction Fuzzy Hash: 6CA1A732909BC3E5E779AF18F8447F8A6A0FB46788FC04135DA9D06AA4DF7C9685C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B9A40 Relevance: 8.0, APIs: 5, Instructions: 501COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF76B1B9AA0
BCryptGenRandom.BCRYPT ref: 00007FF76B1B9ADD

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CryptCurrentProcessRandom
String ID:
API String ID: 2610850170-0
Opcode ID: c3a735419c04b427e6235cb2523904521c08a23222624fd95fdaf660f038e33d
Instruction ID: 38fad5d695754896ac8b54ec42f937fbe438845a599e5955091c71c575f5975b
Opcode Fuzzy Hash: c3a735419c04b427e6235cb2523904521c08a23222624fd95fdaf660f038e33d
Instruction Fuzzy Hash: 15220432A08A91D9E7689F39E8003E97BA0FB067ACF844235DA5D47BE9DF3DD1458310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1BFCC0 Relevance: 7.8, APIs: 5, Instructions: 266threadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32(?,?,?,?,?,?,?,?,00000006,?,00000000,00000000,00000000,?,00000002,?), ref: 00007FF76B1BFD0D
InitializeProcThreadAttributeList.KERNEL32(?,?,?,?,?,?,?,?,00000006,?,00000000,00000000,00000000,?,00000002,?), ref: 00007FF76B1BFDE8
UpdateProcThreadAttribute.KERNEL32(?,?,?,?,?,?,?,?,00000006,?,00000000,00000000,00000000,?,00000002,?), ref: 00007FF76B1BFE4A

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AttributeProcThread$InitializeList$Update
String ID:
API String ID: 3806694049-0
Opcode ID: 3f891653aa825eb9896c4be18cd4e604ece7826b97c5aa8137a607a2f2d07589
Instruction ID: 76f053b73088606683dc14d0c1f5996f842e8e88726dd6c570e4d887a15d0cee
Opcode Fuzzy Hash: 3f891653aa825eb9896c4be18cd4e604ece7826b97c5aa8137a607a2f2d07589
Instruction Fuzzy Hash: 95A1F366B18651E1EA58AB2DB8007B9A361BF46BACFD44231DE2D037E5DF3DE1418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1CFA8C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF76B1CFAB8
GetCurrentThreadId.KERNEL32 ref: 00007FF76B1CFAC6
GetCurrentProcessId.KERNEL32 ref: 00007FF76B1CFAD2
QueryPerformanceCounter.KERNEL32 ref: 00007FF76B1CFAE2

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4e93f7aa9f3647e63532af7c9a3772d2089fa29f58837dfee3430276709b2387
Instruction ID: 61228a07d5590bd2b6197752183602b3c95949442c1deaf21490524e94e7c82a
Opcode Fuzzy Hash: 4e93f7aa9f3647e63532af7c9a3772d2089fa29f58837dfee3430276709b2387
Instruction Fuzzy Hash: 31115A26B14F05DAEB00DFA4F8542B873A4FB5A758F840E35EA2D427A4DF3CD1588350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B6960 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 241fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF76B1B6B44
GetLastError.KERNEL32 ref: 00007FF76B1B6C0D

Strings

*fatal runtime error: I/O error: operation failed to complete synchronously, xrefs: 00007FF76B1B6A13

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID: *fatal runtime error: I/O error: operation failed to complete synchronously
API String ID: 873889042-4008212719
Opcode ID: 8e95f0ae28ca3cf809c66deda672534361a78f7da1a6f862b70e750a47e51a5e
Instruction ID: 6771bc78ca02b46d2ec28172559171612d1938cb5c04025c824e65da225c8574
Opcode Fuzzy Hash: 8e95f0ae28ca3cf809c66deda672534361a78f7da1a6f862b70e750a47e51a5e
Instruction Fuzzy Hash: FAB19372604781D9E778AF65B8443E9A761FB56798F844234CE9C0BBE6CF7DE2418320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B6730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL ref: 00007FF76B1B67FB

Strings

0, xrefs: 00007FF76B1B677B

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CreateFile
String ID: 0
API String ID: 823142352-4108050209
Opcode ID: 1f5587e6a1e539bc8a9299c409c0ef51a7c478529580d9e67c296f333410daec
Instruction ID: 4076b4b0526e66fcf7ffff4209c4027cfcfa6e7ce5e4b9887b41f35fb4ec6aab
Opcode Fuzzy Hash: 1f5587e6a1e539bc8a9299c409c0ef51a7c478529580d9e67c296f333410daec
Instruction Fuzzy Hash: 0F31AD71A08785D6E7249B15F45076BF7A1FB95788FA04135EA8C47BA8DB3CE089CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B7CB0 Relevance: 4.6, APIs: 3, Instructions: 140fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF76B1B7E15
FindFirstFileW.KERNEL32 ref: 00007FF76B1B7E48
FindClose.KERNEL32 ref: 00007FF76B1B7E57

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CloseFind$FileFirstHandle
String ID:
API String ID: 1310327803-0
Opcode ID: 80f011b68834025ddfa1f61b05ef0b423719805564b2731f054c41e10fb18034
Instruction ID: 70ae7c197f69f64a561b50b70a4e3f369693f8bdfee89cff26af714c35cd7104
Opcode Fuzzy Hash: 80f011b68834025ddfa1f61b05ef0b423719805564b2731f054c41e10fb18034
Instruction Fuzzy Hash: 6851A332A04A81D6E7789F65F8853F9B3A1FB46798F504136CE5D4ABA5CF3CA581C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B8150 Relevance: 4.6, APIs: 3, Instructions: 84filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 00007FF76B1B81D4
WaitForSingleObject.KERNEL32 ref: 00007FF76B1B81E9
RtlNtStatusToDosError.NTDLL ref: 00007FF76B1B820D

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: eb09fd271d010e560206acd353a80b97ef9794b1cf1333827320dc82e794b2ae
Instruction ID: ec6b27cc1fb955636af75e7213e6b569cab6317c2a848dd507325138160acd60
Opcode Fuzzy Hash: eb09fd271d010e560206acd353a80b97ef9794b1cf1333827320dc82e794b2ae
Instruction Fuzzy Hash: 91315232608BC5D6EB649B68F4503AAB3A5FB85794F908135E6DD43BA4DF3CD085CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C9260 Relevance: 4.6, Strings: 3, Instructions: 813COMMON

Download Yara Rule

Strings

`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 00007FF76B1C9EC9
__ZN, xrefs: 00007FF76B1C95A9
.llvm./rust/deps\rustc-demangle-0.1.23\src\lib.rs, xrefs: 00007FF76B1C9285

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID: .llvm./rust/deps\rustc-demangle-0.1.23\src\lib.rs$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 0-487299250
Opcode ID: 81fc0bb4c3b1ff33ec179745e0f23ef89c81ce5d0feb31fe5fc3840f289c6949
Instruction ID: a8a2d31700700e3cd12048f4769825db32f00f05acdfd8876913061450c516fd
Opcode Fuzzy Hash: 81fc0bb4c3b1ff33ec179745e0f23ef89c81ce5d0feb31fe5fc3840f289c6949
Instruction Fuzzy Hash: 2A624862E1C5A1E1E61EAB18B4242BAE751BB437DCFD44132DA5E076E6DF3CD904CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C3CD0 Relevance: 2.0, Strings: 1, Instructions: 763COMMON

Download Yara Rule

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF76B1C50D0

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 0-2333694755
Opcode ID: d68fad7b39bfdf4c578b6fb2b532da45912ff277e0d1555ae71e116505d6a641
Instruction ID: 34840434a089ca8e51d68b81fe96735fa365e26bbce4ddb03e6128839a44ece7
Opcode Fuzzy Hash: d68fad7b39bfdf4c578b6fb2b532da45912ff277e0d1555ae71e116505d6a641
Instruction Fuzzy Hash: 51524762E1C692E4EA6CAB1DB4053B9E751AB4379CFC44131DA9E06AF5DF3CE540CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1AC430 Relevance: 1.9, APIs: 1, Instructions: 398COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF76B1AC45A

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 844decedbaa837878010cfaa839551df27b44ee64a0a4f3d49fa6c395bb9e05a
Instruction ID: 4c8bfe0f8b5d845be814f77ec877978f2b7fc2def78445cbe9a31227a324c1dc
Opcode Fuzzy Hash: 844decedbaa837878010cfaa839551df27b44ee64a0a4f3d49fa6c395bb9e05a
Instruction Fuzzy Hash: 1102CE62F04A41E5EB18AF69E8403BDA7A0FB1678CF808535DE5D57BA9DF38F1808350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1A69A0 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

__rust_begin_short_backtrace__rust_end_short_backtrace [... omitted frame ...], xrefs: 00007FF76B1CC9F6

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID: __rust_begin_short_backtrace__rust_end_short_backtrace [... omitted frame ...]
API String ID: 0-995930526
Opcode ID: 24379d1c2ebbadc21cf1e8ca2c49d255fd141b423caa978de448b0efec41e044
Instruction ID: 4345cd35639afd7790d3043e12cd93f67a3c91f2bf9a18795ebbb08baddcdec9
Opcode Fuzzy Hash: 24379d1c2ebbadc21cf1e8ca2c49d255fd141b423caa978de448b0efec41e044
Instruction Fuzzy Hash: A5221A62B18696E1EA19972DB000BB9E751EB577C8FC04732EE8D12EA5DF3CE245C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B5810 Relevance: 1.3, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,?,00007FF76B1B3D6B), ref: 00007FF76B1B5827

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 14ac4927e505c4f6aa781bd607a9469e5a821b8fbf5627c5552f9330d94c81d3
Instruction ID: 128586d9cc128fc4df797bb0f00a2b13b41977da7c542ad65715cde61f16ea7a
Opcode Fuzzy Hash: 14ac4927e505c4f6aa781bd607a9469e5a821b8fbf5627c5552f9330d94c81d3
Instruction Fuzzy Hash: CBE01211F4A51AE6ED4D675EBC50164B5945F89BA5ED44538CE0D86370EE7C58C34320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1CD4A0 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52843f1eca68d6a779899b64636ee7b6a2e58c99602275efc37fdde2f1557059
Instruction ID: 159255b6059f23b78d9e778882e1d4061609ff0abaf6d6ef46f98c5667b59ee6
Opcode Fuzzy Hash: 52843f1eca68d6a779899b64636ee7b6a2e58c99602275efc37fdde2f1557059
Instruction Fuzzy Hash: 3ED19E96E6CB9651F727533D64022B4E6105FA37E8B41D337FDA970BE1EB2CE2429210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1CDBA0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644e70d3fb7c65d9d407019c930283e087c5e7ee85078521807f28daf183145c
Instruction ID: a03e15d4d57a04a71750a88fd73c49ba4b2f6ec76b443822c5d1e48f6f7196eb
Opcode Fuzzy Hash: 644e70d3fb7c65d9d407019c930283e087c5e7ee85078521807f28daf183145c
Instruction Fuzzy Hash: E2C17F22B6C6A1E2FA58DB29B814BB9A651F712B98FC08630DD4E43BD0DF3CF5519710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B8DC0 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd543841c77471fcb559c0387deec644fe0ff909e8754954326cc5700ac1e31d
Instruction ID: e17801bb08e797e4bee13ada8db1c34c4794260209bffc7120e997286ef45b01
Opcode Fuzzy Hash: cd543841c77471fcb559c0387deec644fe0ff909e8754954326cc5700ac1e31d
Instruction Fuzzy Hash: 4CD16B52D0C7D7E5FA69AA2CA8646B9F6819713BACFD44330CA6D171E1CB3C59839320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B5860 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682fb22f5141cdb78e5009e42f6fc980a948712962f4942fa13b689a086268a7
Instruction ID: 6b049fff0b5d2b9171733dc8468a3b7b61e46cbd24a7e65f06c26d434fc7a46d
Opcode Fuzzy Hash: 682fb22f5141cdb78e5009e42f6fc980a948712962f4942fa13b689a086268a7
Instruction Fuzzy Hash: 3EC10752A1CA52E1FA6D5B2DF160239E652FF16798FD09132DB9F036F4EF6CE5408220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1CFD54 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc933b88206a89432bb9de169a6bf0952246a86e69e8a1840aadcb0ab781e13
Instruction ID: eb31900c27b8d76db4908c2f4a29ab2665235cfefb5886fda2daf19a322abf57
Opcode Fuzzy Hash: 9bc933b88206a89432bb9de169a6bf0952246a86e69e8a1840aadcb0ab781e13
Instruction Fuzzy Hash: BDA0022190CD46F4EA1CAB08F950035B334EB5330DBC10531C01D810709F7CA544C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1D105C Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF76B1D10B8

Part of subcall function 00007FF76B1D2000: __GetUnwindTryBlock.LIBCMT ref: 00007FF76B1D2043
Part of subcall function 00007FF76B1D2000: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF76B1D2068

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF76B1D1190
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF76B1D13DF
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF76B1D14EB
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1D1501
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1D151E
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1D1524

Strings

csm, xrefs: 00007FF76B1D10D2
csm, xrefs: 00007FF76B1D1139
csm, xrefs: 00007FF76B1D11B3

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStateabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 9366333-393685449
Opcode ID: 4db23257a1ffe9602b1ae6b05eadb8d77a8eba41a8fa1286e9baab5ad55bcb10
Instruction ID: 4b858a9c63fa4cba7d9319f3ad4fef913b61c7d3a5fb391dcf532360788030f4
Opcode Fuzzy Hash: 4db23257a1ffe9602b1ae6b05eadb8d77a8eba41a8fa1286e9baab5ad55bcb10
Instruction Fuzzy Hash: 44D1B272A08752D6EB28AF69E4402ADB7A0FB4679CFD00235EE4D57B66CF38E151C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B71E0 Relevance: 16.8, APIs: 11, Instructions: 328COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF76B1B725E
DuplicateHandle.KERNEL32 ref: 00007FF76B1B7289
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF76B1B72F8
GetLastError.KERNEL32 ref: 00007FF76B1B7305
GetLastError.KERNEL32 ref: 00007FF76B1B78A1
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00007FF76B1B79D0

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Handle$ErrorLast$CloseCurrentDuplicateFileInformationProcess
String ID:
API String ID: 780345077-0
Opcode ID: fcdb98fa43bcfcaf4a7cf7f95531ab42402ee7eb9e775a187d3c7e4a74268bac
Instruction ID: fded00aa45a7f76587a22703aa8ee929bca1dcadf1473fe9c92e199996fcd75d
Opcode Fuzzy Hash: fcdb98fa43bcfcaf4a7cf7f95531ab42402ee7eb9e775a187d3c7e4a74268bac
Instruction Fuzzy Hash: 94D19062B04B41D9EB58AF29E8403AC6BA1FB4579CF944036EE4D57BA8DF3CE445C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1BF431 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF76B1BF446
DuplicateHandle.KERNEL32 ref: 00007FF76B1BF471
GetLastError.KERNEL32 ref: 00007FF76B1BF520
CloseHandle.KERNEL32 ref: 00007FF76B1BF57B
CloseHandle.KERNEL32 ref: 00007FF76B1BF792

Strings

failed to spawn thread, xrefs: 00007FF76B1BF822
cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs, xrefs: 00007FF76B1BF8A0

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Handle$Close$CurrentDuplicateErrorLastProcess
String ID: cannot access a Thread Local Storage value during or after destructionlibrary\std\src\thread\local.rs$failed to spawn thread
API String ID: 1869159801-1840047577
Opcode ID: 3768b047db84bf36f1a201df8fb6ffc46e238987e66d82805ec25a2eef6fbe95
Instruction ID: a4c3119c8ad90348c0782457abb15533214ec0eed36ee33ba76e7de8207eda77
Opcode Fuzzy Hash: 3768b047db84bf36f1a201df8fb6ffc46e238987e66d82805ec25a2eef6fbe95
Instruction Fuzzy Hash: 0CC19126908B81D9E709AF68E8403AD77A0FB4634CFD44139EA4C43BA5DF3CE084C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1CF410 Relevance: 12.2, APIs: 8, Instructions: 150COMMON

Download Yara Rule

APIs

_set_app_type.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FF76B1CF54B
_set_fmode.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FF76B1CF557
__p__commode.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FF76B1CF563
_RTC_Initialize.LIBCMT ref: 00007FF76B1CF578
_configure_narrow_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FF76B1CF590
__setusermatherr.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FF76B1CF5AE
_configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FF76B1CF5C4
_initialize_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00007FF76B1CF5D2

Part of subcall function 00007FF76B1CFBB0: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF76B1CFBCC
Part of subcall function 00007FF76B1CFBB0: RtlCaptureContext.KERNEL32 ref: 00007FF76B1CFBF9
Part of subcall function 00007FF76B1CFBB0: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF76B1CFC13
Part of subcall function 00007FF76B1CFBB0: RtlVirtualUnwind.KERNEL32 ref: 00007FF76B1CFC54
Part of subcall function 00007FF76B1CFBB0: IsDebuggerPresent.KERNEL32 ref: 00007FF76B1CFCA8
Part of subcall function 00007FF76B1CFBB0: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF76B1CFCC5
Part of subcall function 00007FF76B1CFBB0: UnhandledExceptionFilter.KERNEL32 ref: 00007FF76B1CFCD0

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionInitializeLookupProcessorUnwindVirtual__p__commode__setusermatherr_configthreadlocale_configure_narrow_argv_initialize_narrow_environment_set_app_type_set_fmode
String ID:
API String ID: 29627993-0
Opcode ID: 045e8b5eed07a9d748c48f644600d479bfe3312b0cd4c2ab463d0cfb90c6f4e9
Instruction ID: 49eefc284ec8c8ad85b584b6a27913923fe3ac6378587f42e7421fecb74ea88e
Opcode Fuzzy Hash: 045e8b5eed07a9d748c48f644600d479bfe3312b0cd4c2ab463d0cfb90c6f4e9
Instruction Fuzzy Hash: E2418091E1C146F2FA2C7BADB0556B8D3519F13788FC00131EA2D476E6DF1CA94A8A31

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B9280 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 451COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF76B1B9496
GetFullPathNameW.KERNEL32 ref: 00007FF76B1B94B3
GetLastError.KERNEL32 ref: 00007FF76B1B94BF
GetLastError.KERNEL32 ref: 00007FF76B1B94D9

Strings

\\?\\\?\UNC\, xrefs: 00007FF76B1B95A5, 00007FF76B1B9614

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\\\?\UNC\
API String ID: 2482867836-3975371117
Opcode ID: 82e59c754d98a8ecbe457e8138b033daf94a3c10d81d4b27b5380f03cf14760e
Instruction ID: 46ad1bdecc9dbfb5c866b6a5ad81455086e8053878e7ad4ee3b53bccd6b65ab5
Opcode Fuzzy Hash: 82e59c754d98a8ecbe457e8138b033daf94a3c10d81d4b27b5380f03cf14760e
Instruction Fuzzy Hash: 8B12C762A08681E5EB78AF19E4543B8A354FB56BDCFD04135DA1C477E6DF38D6828320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B2AC0 Relevance: 10.6, APIs: 7, Instructions: 140fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76B1BA440: ReadFileEx.KERNEL32 ref: 00007FF76B1BA493
Part of subcall function 00007FF76B1BA440: SleepEx.KERNEL32 ref: 00007FF76B1BA4BA

WriteFileEx.KERNEL32 ref: 00007FF76B1B2BD3
SleepEx.KERNEL32 ref: 00007FF76B1B2BEA
GetLastError.KERNEL32 ref: 00007FF76B1B2C37
CloseHandle.KERNEL32 ref: 00007FF76B1B2C71
CloseHandle.KERNEL32 ref: 00007FF76B1B2C7A
CloseHandle.KERNEL32 ref: 00007FF76B1B2CFF
CloseHandle.KERNEL32 ref: 00007FF76B1B2D08

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CloseHandle$FileSleep$ErrorLastReadWrite
String ID:
API String ID: 4082512061-0
Opcode ID: 0c52dfe888c4c7a10e73f3b637704110da0204bb6e597128e2bf2fc60ffc9a92
Instruction ID: 9adb3c62dca16307a4114bb5f7db9625411c59ad2f129f8c1912a53807791e51
Opcode Fuzzy Hash: 0c52dfe888c4c7a10e73f3b637704110da0204bb6e597128e2bf2fc60ffc9a92
Instruction Fuzzy Hash: F8516122604AD6E4E735AF29EC007F96760FB4579CF844132ED5C07BA8CF78928AC350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1D235C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF76B1D260E,?,?,?,00007FF76B1D2300,?,?,?,00007FF76B1D0899), ref: 00007FF76B1D23E1
GetLastError.KERNEL32(?,?,?,00007FF76B1D260E,?,?,?,00007FF76B1D2300,?,?,?,00007FF76B1D0899), ref: 00007FF76B1D23EF
LoadLibraryExW.KERNEL32(?,?,?,00007FF76B1D260E,?,?,?,00007FF76B1D2300,?,?,?,00007FF76B1D0899), ref: 00007FF76B1D2419
FreeLibrary.KERNEL32(?,?,?,00007FF76B1D260E,?,?,?,00007FF76B1D2300,?,?,?,00007FF76B1D0899), ref: 00007FF76B1D2487
GetProcAddress.KERNEL32(?,?,?,00007FF76B1D260E,?,?,?,00007FF76B1D2300,?,?,?,00007FF76B1D0899), ref: 00007FF76B1D2493

Strings

api-ms-, xrefs: 00007FF76B1D2401

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: cb260bd937c65e242a68903e736a124fea4f73a3765b753fa9b9c6204c1ec33f
Instruction ID: e1fe5e15beee4346ee9334b2b4904d1196d34c5f380b7b7c9aa06db23c469932
Opcode Fuzzy Hash: cb260bd937c65e242a68903e736a124fea4f73a3765b753fa9b9c6204c1ec33f
Instruction Fuzzy Hash: 3431C421B1AA42E1EE29EF0AF400575A394BF4ABA8FD90534DD2D477B4EF3CE4418360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B57B0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF76B1B57BD
GetProcAddress.KERNEL32 ref: 00007FF76B1B57D5
GetProcAddress.KERNEL32 ref: 00007FF76B1B57ED

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 00007FF76B1B57B6
WakeByAddressSingle, xrefs: 00007FF76B1B57E3
WaitOnAddress, xrefs: 00007FF76B1B57CB

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: WaitOnAddress$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 667068680-1826242509
Opcode ID: 27b1b8f2a122d04b867da6f154c84ee9e1ca1c9e4c0363349d757333e655d78d
Instruction ID: babf20d14651efe1fbe0f4bd5c830e449b8356a51c92bb72acbd6460cf9a9635
Opcode Fuzzy Hash: 27b1b8f2a122d04b867da6f154c84ee9e1ca1c9e4c0363349d757333e655d78d
Instruction Fuzzy Hash: F5F0FE10F0A607E2FD4DBB0AF994574B2A16F4AB98BD85535C94D06370EF3CA5468320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B6100 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF76B1B633D
CloseHandle.KERNEL32 ref: 00007FF76B1B6351

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 919eda4852ac05a2f183bfb42560dcb6aed247972bfc7f49e1ec108d0b900e36
Instruction ID: 57249e7609e438e2513e4527bc77e6cc37eb8ada55bacb2bce6f603f7f5246ec
Opcode Fuzzy Hash: 919eda4852ac05a2f183bfb42560dcb6aed247972bfc7f49e1ec108d0b900e36
Instruction Fuzzy Hash: 4561E62290C24AE2F778AB19B504B79FBA1AB67798F840170DD5E036E5CF3DE944C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1D152C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF76B1D158B
_CallSETranslator.LIBVCRUNTIME ref: 00007FF76B1D15D7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1D1793

Strings

MOC, xrefs: 00007FF76B1D159F
RCC, xrefs: 00007FF76B1D15A7

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CallEncodePointerTranslatorabort
String ID: MOC$RCC
API String ID: 292945357-2084237596
Opcode ID: ebac8a4507f754e44c2ea5af6660bb82e0796862396a14e6eee0b8d41a579373
Instruction ID: ebf362b0f9052cfdfcbcf12ca209e7357ebea92b77e6588b2be9c5c24ab9df23
Opcode Fuzzy Hash: ebac8a4507f754e44c2ea5af6660bb82e0796862396a14e6eee0b8d41a579373
Instruction Fuzzy Hash: D8619232908BC5D5EB649B19F4407AAF7A0FB86788F844225EB9D43B65DF7CE190CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1D18DC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76B1D1904
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF76B1D19EC
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1D1B0D

Strings

csm, xrefs: 00007FF76B1D1926
csm, xrefs: 00007FF76B1D1A3E

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_recordabort
String ID: csm$csm
API String ID: 4198837600-3733052814
Opcode ID: 466989bb71a8ea23887ea4057c09fb05afca9bb959bcfb556cb456a0ad34e15e
Instruction ID: 2bae6164861b961d218a83a9c02a10f80db00a49602577ac6c2a14b3da7e6f96
Opcode Fuzzy Hash: 466989bb71a8ea23887ea4057c09fb05afca9bb959bcfb556cb456a0ad34e15e
Instruction Fuzzy Hash: 2C518332A08292D6EB7CAB19A544369B7A0FB42B8CFD44135DA9D47BE5CF3CE460C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B5E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00007FF76B1B5EB5
FindNextFileW.KERNEL32 ref: 00007FF76B1B5ED6
GetLastError.KERNEL32 ref: 00007FF76B1B5F30
GetLastError.KERNEL32 ref: 00007FF76B1B5F96

Strings

., xrefs: 00007FF76B1B5EDD

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorFileFindLastNext
String ID: .
API String ID: 32741936-248832578
Opcode ID: 86a8e2d15f33eb580f2a18ae36d98b8a049f8e48fa8fdc23ee8cce633b930277
Instruction ID: 61fc5a51bf87ff0ad72d38e372c15c371f41b975854c88f637da60dbb2bb93c0
Opcode Fuzzy Hash: 86a8e2d15f33eb580f2a18ae36d98b8a049f8e48fa8fdc23ee8cce633b930277
Instruction Fuzzy Hash: 6241A122A18642E2FA78AB19F45037AF760FB46798F848135DF9D426E1EF3CE491C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C1230 Relevance: 7.8, APIs: 5, Instructions: 264COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF76B1C1352
GetFullPathNameW.KERNEL32 ref: 00007FF76B1C1368
GetLastError.KERNEL32 ref: 00007FF76B1C1375
GetLastError.KERNEL32 ref: 00007FF76B1C138F
GetLastError.KERNEL32 ref: 00007FF76B1C142B

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: 02a2b469bfe0cd203cb85d2176ac0b081d7d4556e7ff3479cda31afaea49fe2c
Instruction ID: 2e5cc634a714cfe0b265d0707455750743d36c967e208162cb83c6b32d23ff00
Opcode Fuzzy Hash: 02a2b469bfe0cd203cb85d2176ac0b081d7d4556e7ff3479cda31afaea49fe2c
Instruction Fuzzy Hash: B1B19E62A04BD2D5EB39AF29E8043E9A358FB06B9CF844131DE5D5B7A5CF3CD2518310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C1760 Relevance: 7.8, APIs: 5, Instructions: 262COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF76B1C1882
GetFullPathNameW.KERNEL32 ref: 00007FF76B1C1898
GetLastError.KERNEL32 ref: 00007FF76B1C18A4
GetLastError.KERNEL32 ref: 00007FF76B1C18BE

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: 7fe263e6b4eec2224ad380847dbf759fb68a03e07a408829a7520380af5b5c08
Instruction ID: 4b541e2ae20deff428dabb45373cd3704627938e8c0a0b036220463b30ccdfb5
Opcode Fuzzy Hash: 7fe263e6b4eec2224ad380847dbf759fb68a03e07a408829a7520380af5b5c08
Instruction Fuzzy Hash: F1B19062A04BD1D5E779AF29A8443E9A365FB06BDCF908031DE5C1B7A9DF3CD2518310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1AC060 Relevance: 7.7, APIs: 5, Instructions: 191COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF76B1AC19A
GetEnvironmentVariableW.KERNEL32 ref: 00007FF76B1AC1AD
GetLastError.KERNEL32 ref: 00007FF76B1AC1B9
GetLastError.KERNEL32 ref: 00007FF76B1AC1D3

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID:
API String ID: 2691138088-0
Opcode ID: a538f91335d07f080f458b9ec3de09e658a5f90ec25ba0f97c1bc8fdf4e7dfff
Instruction ID: 32e7724cacb32ab899e2d4d6edec0e25885c624fd334784628d0a8830108bfaf
Opcode Fuzzy Hash: a538f91335d07f080f458b9ec3de09e658a5f90ec25ba0f97c1bc8fdf4e7dfff
Instruction Fuzzy Hash: DF81B462B04AC1D5EB79AF69BC043E9A354FB067ACF844135DE5C1BAA5DF38A2858310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B8B20 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF76B1B8C1A
GetModuleFileNameW.KERNEL32 ref: 00007FF76B1B8C28
GetLastError.KERNEL32 ref: 00007FF76B1B8C35
GetLastError.KERNEL32 ref: 00007FF76B1B8C4F
GetLastError.KERNEL32 ref: 00007FF76B1B8CE8

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID:
API String ID: 1026760046-0
Opcode ID: 35b729bc5b2faef23462f7f580b3249dfd3c2dee02791afbcd3fed5f6c4c9c37
Instruction ID: 994b73ccc45ddd89e1a246146664852d2b01f283a0d94542fad661ce3c3fc0f0
Opcode Fuzzy Hash: 35b729bc5b2faef23462f7f580b3249dfd3c2dee02791afbcd3fed5f6c4c9c37
Instruction Fuzzy Hash: DE51C152A05B82EAEB29AF29F8447E9A254BB06BACFC44531DD1C477E5DF3C92858210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1ABDE0 Relevance: 7.7, APIs: 5, Instructions: 154COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF76B1ABEDA
GetCurrentDirectoryW.KERNEL32 ref: 00007FF76B1ABEE6
GetLastError.KERNEL32 ref: 00007FF76B1ABEF3
GetLastError.KERNEL32 ref: 00007FF76B1ABF0D
GetLastError.KERNEL32 ref: 00007FF76B1ABFA8

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory
String ID:
API String ID: 3993060814-0
Opcode ID: c7e4a2eabca3ae27c6855f893a186cc77744f66eee6899f4d39c442f1123e74c
Instruction ID: 0c0410a65020bec15d1edb540686bcdd863c30f356a260ede8738fc1eedf3667
Opcode Fuzzy Hash: c7e4a2eabca3ae27c6855f893a186cc77744f66eee6899f4d39c442f1123e74c
Instruction Fuzzy Hash: 8951D412A04BC5E5EB39AF69B8447A9A254BB067ACFC44131DE5C46BE5DF3CE2848310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1BF342 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF76B1BF344
GetLastError.KERNEL32 ref: 00007FF76B1BF35C
GetCurrentProcess.KERNEL32 ref: 00007FF76B1BF4E5
DuplicateHandle.KERNEL32 ref: 00007FF76B1BF510
GetLastError.KERNEL32 ref: 00007FF76B1BF520

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ErrorHandleLast$CurrentDuplicateProcess
String ID:
API String ID: 3697983210-0
Opcode ID: a6ad88a9eb947a9be9580e1552350e558f5ef02581152435a4b984705802f174
Instruction ID: 55ace1d39d812e90bfb8675ba9bc2cadf235f6d6a7c81910b426ad9f7cfa36b3
Opcode Fuzzy Hash: a6ad88a9eb947a9be9580e1552350e558f5ef02581152435a4b984705802f174
Instruction Fuzzy Hash: 4C115135A08745D6FB28AF68B4443A9B750FB0A7ACF840634D96E067E4DF7CE448C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1D0678 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF76B1D06A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF76B1D073A
RtlUnwindEx.KERNEL32 ref: 00007FF76B1D0794

Strings

csm, xrefs: 00007FF76B1D0721

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 27591038149c9af5ffa8d572dab95272378691d4b3eec5ffb0208b8300f09546
Instruction ID: e9f9dc88809036add1774739d736a24b444d8333b111db81e08580f9514d5a16
Opcode Fuzzy Hash: 27591038149c9af5ffa8d572dab95272378691d4b3eec5ffb0208b8300f09546
Instruction Fuzzy Hash: C151C031B09602EADB18EB19F458A79B391EB41B8CFE18130DA8D47768DF7DE841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B1EF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF76B1B1F7F
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF76B1B2075
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF76B1B20F8

Strings

lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs, xrefs: 00007FF76B1B1F60

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID: lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs
API String ID: 1021914862-2303981482
Opcode ID: 7fdfd6061eb74f23f46a935c5f81b3f65ee50a0c0bce0bc39f2a1b5c47bb8538
Instruction ID: b9d860adef9613f3e7284190140641423706da4e525f2c73320ec9bb105da2a1
Opcode Fuzzy Hash: 7fdfd6061eb74f23f46a935c5f81b3f65ee50a0c0bce0bc39f2a1b5c47bb8538
Instruction Fuzzy Hash: 99514F21E18A47E6FB59AB6CF8403B8B761AB5671CFC44235CA1D062B1DF7CA589C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C1E40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF76B1C1ECC
GetProcAddress.KERNEL32 ref: 00007FF76B1C1EE1

Strings

NtWaitForKeyedEvent, xrefs: 00007FF76B1C1ED7
ntdll, xrefs: 00007FF76B1C1EC5

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: 5605c037a7f1637b5a2055bd2c68ebdc6f6dc87fa6c6936eab38aba99def1047
Instruction ID: da73fc5505f54dab480760718ec0a82776a551f53751d7c51e585f73482cd883
Opcode Fuzzy Hash: 5605c037a7f1637b5a2055bd2c68ebdc6f6dc87fa6c6936eab38aba99def1047
Instruction Fuzzy Hash: 9A11D321F14B59E8EB08EB55F8906A8B364BB5A7A8FC44231DD5C03BB4EF3CA185C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C1D60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF76B1C1DEC
GetProcAddress.KERNEL32 ref: 00007FF76B1C1E01

Strings

ntdll, xrefs: 00007FF76B1C1DE5
NtReleaseKeyedEvent, xrefs: 00007FF76B1C1DF7

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 66ca23fc0375b2fad908a5f4ee6f1490cd6860924373dda1255e45f67e84ed0b
Instruction ID: 15301406f67339e055e46606711fd422415d2bf3a429f9e42fa3c3fc6fd32b91
Opcode Fuzzy Hash: 66ca23fc0375b2fad908a5f4ee6f1490cd6860924373dda1255e45f67e84ed0b
Instruction Fuzzy Hash: DF11D321F18B15E8EB08EB55F8906A8B764BB5A7A8FC44231DD5C03BB0EF3CA195C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1D09C4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF76B1D0A24

Strings

RCC, xrefs: 00007FF76B1D09D4
MOC, xrefs: 00007FF76B1D09DC
csm, xrefs: 00007FF76B1D09E4

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: terminate
String ID: MOC$RCC$csm
API String ID: 1821763600-2671469338
Opcode ID: e49db6fce0e62a705b3c6109e8bff775fdd04af1617c30532567f6d03f532d2b
Instruction ID: 4ef6b96baf945e9ef51e999aaccf71d9efb2ae646b9bb3f10e7ef2de9de66857
Opcode Fuzzy Hash: e49db6fce0e62a705b3c6109e8bff775fdd04af1617c30532567f6d03f532d2b
Instruction Fuzzy Hash: 7DF08136908247D2EB2CBB18F15916CB360EB89748FD89131D7090767ACF3DE890C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C1D00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF76B1C1D1B
GetProcAddress.KERNEL32 ref: 00007FF76B1C1D30

Strings

NtCreateKeyedEvent, xrefs: 00007FF76B1C1D26
ntdll, xrefs: 00007FF76B1C1D14

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: f7a5984812882c593a168cede2d152d5d06132866907aad3018c4feb248cb540
Instruction ID: 81d3e143a1cb2e770d1720489f5d084fd7e525dbabab1ba7e199eac20ae087a7
Opcode Fuzzy Hash: f7a5984812882c593a168cede2d152d5d06132866907aad3018c4feb248cb540
Instruction Fuzzy Hash: 1CF08260B0A655E1E919EB4ABC949B1A6506F5EBD9BC44835CD0D43770EE7CA4498310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1C1C90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF76B1C1CA3
GetProcAddress.KERNEL32 ref: 00007FF76B1C1CB8

Strings

kernel32, xrefs: 00007FF76B1C1C9C
SetThreadDescription, xrefs: 00007FF76B1C1CAE

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 9868180155e8931076107b8065a7bf8abff35a57433a7bc67fcd419b7df7e6bf
Instruction ID: 55c5273575d93b75b551622f2f3416d0524dcbb828a22b9c0909316bd1867f3a
Opcode Fuzzy Hash: 9868180155e8931076107b8065a7bf8abff35a57433a7bc67fcd419b7df7e6bf
Instruction Fuzzy Hash: 46E06D10B4AA12E2ED0DAB0ABCA4564B2906F4EBD8BC48135CC0D02371EF2CA8558320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1B7010 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileInformationByHandleEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76B1A22B9), ref: 00007FF76B1B708D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76B1A22B9), ref: 00007FF76B1B70A9
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76B1A22B9), ref: 00007FF76B1B70BC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76B1A22B9), ref: 00007FF76B1B7132

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: Handle$Close$ErrorFileInformationLast
String ID:
API String ID: 4143594976-0
Opcode ID: 8a07d68d36f7574e3910cc60e3d45fc0ae667bce7b77ff743a67128da87d72e2
Instruction ID: 4afa139961dd234cefa29406d8305bfbd07d5870ae1b844b6a0ea5d98c90050c
Opcode Fuzzy Hash: 8a07d68d36f7574e3910cc60e3d45fc0ae667bce7b77ff743a67128da87d72e2
Instruction Fuzzy Hash: 8731B321F04656E8FB25AB69E8043FCA2B0AF5639CF940132CD1C12AF8DF38A585C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1ABAA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

WaitOnAddress.KERNELBASE ref: 00007FF76B1ABB12
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF76B1D4FA5), ref: 00007FF76B1ABB89

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyed, xrefs: 00007FF76B1ABBBC

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: AddressCloseHandleWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyed
API String ID: 592885855-1431102515
Opcode ID: 491c28aeaf2714e82fc8cc9131e4b8f3fc4f5d8aa86424585c62a59521a3ce2e
Instruction ID: 1ab8df6176cfcbe23b61a93fbd918dd197602a252f9a81f1bf878406c8d47efe
Opcode Fuzzy Hash: 491c28aeaf2714e82fc8cc9131e4b8f3fc4f5d8aa86424585c62a59521a3ce2e
Instruction Fuzzy Hash: C9519222A14A55E4FB15AB69F8007AEB770BB46778FC44231DE6C13BE4DF38A545C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1D05D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF76B1C36CE), ref: 00007FF76B1D0620
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF76B1C36CE), ref: 00007FF76B1D0661

Strings

csm, xrefs: 00007FF76B1D064E

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 6a81bbdcec365e21280b58dc8c61b272a021d984169798c78d8d9c09953759dc
Instruction ID: 99dccde1f260a38134944092099d2bd9a251f673d4be07e52589836b43d0ac56
Opcode Fuzzy Hash: 6a81bbdcec365e21280b58dc8c61b272a021d984169798c78d8d9c09953759dc
Instruction Fuzzy Hash: 9A116D32608B8492EB659F19F414269B7E0FB89B98F984234EE8C07768DF3CD551CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF76B1A1080 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF76B1A10A5
CloseHandle.KERNEL32 ref: 00007FF76B1A10AF
CloseHandle.KERNEL32 ref: 00007FF76B1A10C7
CloseHandle.KERNEL32 ref: 00007FF76B1A10E0

Memory Dump Source

Source File: 00000000.00000002.2090051465.00007FF76B1A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76B1A0000, based on PE: true

Associated: 00000000.00000002.2090036461.00007FF76B1A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090081670.00007FF76B1D6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090101256.00007FF76B1E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2090115520.00007FF76B1E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76b1a0000_self_updater.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b0f6824349de5c88cb93edb3be6d05ecf4bebeffc60c20bc8f98a448d2f6a5a4
Instruction ID: d6ae547990999cb7ac063f582ae85527465c32c038040e4e995da10dac0bb067
Opcode Fuzzy Hash: b0f6824349de5c88cb93edb3be6d05ecf4bebeffc60c20bc8f98a448d2f6a5a4
Instruction Fuzzy Hash: 2911B026A04F15D9E7149B6AE84437C7770F79ABA8F804A21CE2E577F4CF38E891C210

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report self_updater.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: self_updater.exePID: 5748, Parent PID: 4004

General

Chronological Activities

Analysis Process: conhost.exePID: 7144, Parent PID: 5748

General

Chronological Activities

Disassembly

Analysis Process: self_updater.exePID: 5748, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF76B1A2000 Relevance: 14.3, APIs: 2, Strings: 7, Instructions: 761COMMON

Control-flow Graph

Windows Analysis Report
self_updater.exe

Function 00007FF76B1A2000 Relevance: 14.3, APIs: 2, Strings: 7, Instructions: 761
COMMON

Function 00007FF76B1AB260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143
threadCOMMON

Function 00007FF76B1CF624 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Function 00007FF76B1AB990 Relevance: 9.1, APIs: 6, Instructions: 79
timesleepsynchronizationCOMMON

Function 00007FF76B1C0260 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218
COMMON

Function 00007FF76B1C05D0 Relevance: 7.7, APIs: 5, Instructions: 155
COMMON

Function 00007FF76B1B4050 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 235
COMMON

Function 00007FF76B1AE300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87
COMMON

Function 00007FF76B1B4A30 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00007FF76B1C0B10 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON