Play interactive tour

Edit tour

Windows Analysis Report nV5Wu77N8J

Overview

General Information

Sample Name:	nV5Wu77N8J (renamed file extension from none to dll)
Analysis ID:	553353
MD5:	a0306b7a6a12022e4fc8e586b0bc90ec
SHA1:	ee7d221826a725a2110bbddbea34bd14522b5ab4
SHA256:	9b1ca060b5a969f03c4c8d99ad487a454742e47fff97343a90afacb5da7d9589
Tags:	32dllexe
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Sigma detected: Suspicious Call by Ordinal

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7128 cmdline: loaddll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 7148 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 3296 cmdline: rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6344 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

regsvr32.exe (PID: 7160 cmdline: regsvr32.exe /s C:\Users\user\Desktop\nV5Wu77N8J.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

rundll32.exe (PID: 6192 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6244 cmdline: rundll32.exe C:\Users\user\Desktop\nV5Wu77N8J.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5356 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bdaefwhkzqb\lrinxnmhyts.ogu",XLurkV MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6040 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Bdaefwhkzqb\lrinxnmhyts.ogu",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 3660 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 568 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5672 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6676 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6712 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7128 -ip 7128 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 808 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4296 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["45.138.98.34:80", "69.16.218.101:8080", "51.210.242.234:8080", "185.148.168.220:8080", "142.4.219.173:8080", "54.38.242.185:443", "191.252.103.16:80", "104.131.62.48:8080", "62.171.178.147:8080", "217.182.143.207:443", "168.197.250.14:80", "37.44.244.177:8080", "66.42.57.149:443", "210.57.209.142:8080", "159.69.237.188:443", "116.124.128.206:8080", "128.199.192.135:8080", "195.154.146.35:443", "185.148.168.15:8080", "195.77.239.39:8080", "207.148.81.119:8080", "85.214.67.203:8080", "190.90.233.66:443", "78.46.73.125:443", "78.47.204.80:443", "37.59.209.141:8080", "54.37.228.122:443"], "Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188125968.00000000049D1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1190726376.00000000059A0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.718904101.00000000034D0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.719243124.0000000005161000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.719379711.00000000052A1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.719211601.0000000005130000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1190213897.00000000057D1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.719345888.0000000005270000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719826672.00000000053B0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719773637.00000000052F1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188426833.0000000005110000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188330842.0000000005030000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.719316941.0000000005241000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719898030.0000000005510000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000002.723238837.0000000004750000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188469714.0000000005141000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.670020972.0000000004740000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1186610997.0000000002E00000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188598739.00000000052A1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719919636.0000000005541000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188659452.0000000005301000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.720219818.0000000000DE0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.669938310.0000000002541000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.720240608.0000000000E11000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719503580.0000000004C80000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188052400.00000000049A0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719747240.00000000052B0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1190813785.0000000005A20000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719938381.0000000005570000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1190127401.00000000057A0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.719857103.00000000053E1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.722455601.0000000000E11000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.719284878.0000000005210000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188878871.00000000055E1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1186687872.0000000002E31000.00000020.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188363449.0000000005061000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1190848028.0000000005A51000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188631120.00000000052D0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.722263663.0000000000DE0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188973289.00000000056F1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188839400.00000000055B0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000002.723309788.0000000004781000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.670044528.0000000004771000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188934735.00000000056C0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.742599060.0000000000DE0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1188553677.0000000005270000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.669913455.0000000002510000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000E.00000002.1190787571.00000000059D1000.00000020.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 45 entries

Unpacked PEs

Source	Rule	Description	Author
14.2.rundll32.exe.55b0000.12.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5030000.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.4770000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.53b0000.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.de0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.5510000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.2e30000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.52a0000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.56f0000.15.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.de0000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.59a0000.18.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.de0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.rundll32.exe.4780000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.4cb0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.49a0000.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.53e0000.5.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.52d0000.10.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.5570000.8.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e10000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5270000.8.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.5570000.8.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.49d0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.5540000.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.de0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.de0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.59d0000.19.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.34d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.2510000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5a20000.20.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5a20000.20.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.53b0000.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.52d0000.10.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.de0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.4740000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.rundll32.exe.4750000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.4c80000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5300000.11.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.52a0000.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.2540000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.55e0000.13.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.4c80000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5110000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.55b0000.12.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.57a0000.16.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5a50000.21.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5030000.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.57d0000.17.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.57a0000.16.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.56c0000.14.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5210000.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.52f0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.2e00000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.3500000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.2510000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5140000.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.52b0000.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.5510000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.rundll32.exe.4750000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5060000.5.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5110000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.5270000.8.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5130000.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e10000.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5270000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.49a0000.2.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.34d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.59a0000.18.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5160000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5130000.2.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.56c0000.14.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5240000.5.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5270000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.5210000.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
14.2.rundll32.exe.2e00000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.4740000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.52b0000.2.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 71 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Call by Ordinal

Show sources

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7148, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1, ProcessId: 3296

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.0.loaddll32.exe.de0000.3.raw.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["45.138.98.34:80", "69.16.218.101:8080", "51.210.242.234:8080", "185.148.168.220:8080", "142.4.219.173:8080", "54.38.242.185:443", "191.252.103.16:80", "104.131.62.48:8080", "62.171.178.147:8080", "217.182.143.207:443", "168.197.250.14:80", "37.44.244.177:8080", "66.42.57.149:443", "210.57.209.142:8080", "159.69.237.188:443", "116.124.128.206:8080", "128.199.192.135:8080", "195.154.146.35:443", "185.148.168.15:8080", "195.77.239.39:8080", "207.148.81.119:8080", "85.214.67.203:8080", "190.90.233.66:443", "78.46.73.125:443", "78.47.204.80:443", "37.59.209.141:8080", "54.37.228.122:443"], "Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"]}

Multi AV Scanner detection for submitted file

Show sources

Source: nV5Wu77N8J.dll	Virustotal: Detection: 16%			Perma Link
Source: nV5Wu77N8J.dll	ReversingLabs: Detection: 13%

Source: nV5Wu77N8J.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726747041.0000000002F12000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726920017.0000000002F12000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726719293.00000000049D6000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.727134531.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726928256.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726753757.0000000002F18000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000010.00000003.727134531.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726928256.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726753757.0000000002F18000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726739926.0000000002F0C000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.727328906.0000000002F0C000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000010.00000003.726747041.0000000002F12000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726920017.0000000002F12000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: a[ojr^oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000010.00000002.741443173.0000000000A72000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000010.00000003.726739926.0000000002F0C000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.727328906.0000000002F0C000.00000004.00000001.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.4:49770 -> 45.138.98.34:80
Source: Traffic	Snort IDS: 2404338 ET CNC Feodo Tracker Reported CnC Server TCP group 20 192.168.2.4:49771 -> 69.16.218.101:8080

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 69.16.218.101 144			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.138.98.34 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 45.138.98.34:80
Source: Malware configuration extractor	IPs: 69.16.218.101:8080
Source: Malware configuration extractor	IPs: 51.210.242.234:8080
Source: Malware configuration extractor	IPs: 185.148.168.220:8080
Source: Malware configuration extractor	IPs: 142.4.219.173:8080
Source: Malware configuration extractor	IPs: 54.38.242.185:443
Source: Malware configuration extractor	IPs: 191.252.103.16:80
Source: Malware configuration extractor	IPs: 104.131.62.48:8080
Source: Malware configuration extractor	IPs: 62.171.178.147:8080
Source: Malware configuration extractor	IPs: 217.182.143.207:443
Source: Malware configuration extractor	IPs: 168.197.250.14:80
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 66.42.57.149:443
Source: Malware configuration extractor	IPs: 210.57.209.142:8080
Source: Malware configuration extractor	IPs: 159.69.237.188:443
Source: Malware configuration extractor	IPs: 116.124.128.206:8080
Source: Malware configuration extractor	IPs: 128.199.192.135:8080
Source: Malware configuration extractor	IPs: 195.154.146.35:443
Source: Malware configuration extractor	IPs: 185.148.168.15:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 207.148.81.119:8080
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 190.90.233.66:443
Source: Malware configuration extractor	IPs: 78.46.73.125:443
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 37.59.209.141:8080
Source: Malware configuration extractor	IPs: 54.37.228.122:443

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View	IP Address: 207.148.81.119 207.148.81.119
Source: Joe Sandbox View	IP Address: 104.131.62.48 104.131.62.48

Source: global traffic

TCP traffic: 192.168.2.4:49771 -> 69.16.218.101:8080

Source: unknown

Network traffic detected: IP country count 11

Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 45.138.98.34
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101
Source: unknown	TCP traffic detected without corresponding DNS query: 69.16.218.101

Source: svchost.exe, 00000014.00000003.805231702.0000020B3A794000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000014.00000003.805231702.0000020B3A794000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000014.00000003.805310657.0000020B3A7A5000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.805231702.0000020B3A794000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000014.00000003.805310657.0000020B3A7A5000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.805231702.0000020B3A794000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000014.00000003.805231702.0000020B3A794000.00000004.00000001.sdmp	String found in binary or memory: trings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":104380919,"MaxInstallSizeInBytes":203345920,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0","PackageId":"3fbafb47-f476-4c26-4445-49acb9a726e6-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"leve
Source: svchost.exe, 00000014.00000003.805231702.0000020B3A794000.00000004.00000001.sdmp	String found in binary or memory: trings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":104380919,"MaxInstallSizeInBytes":203345920,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0","PackageId":"3fbafb47-f476-4c26-4445-49acb9a726e6-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.176.447.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"leve

Source: svchost.exe, 00000014.00000002.822439687.0000020B3A700000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.799118884.0000020B3A70D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000014.00000002.822309970.0000020B39EE9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: Amcache.hve.16.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000014.00000003.800900762.0000020B3AC02000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800918679.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800834222.0000020B3AC19000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800807896.0000020B3AC19000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800791461.0000020B3A7A1000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800774631.0000020B3A790000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10001280 recvfrom,

2_2_10001280

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		2_2_10027958
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10027958 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		3_2_10027958

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 14.2.rundll32.exe.55b0000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5030000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4770000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.53b0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5510000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.52a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.56f0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.59a0000.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4780000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4cb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.49a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.53e0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.52d0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5570000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5270000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5570000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.49d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5540000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.59d0000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5a20000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5a20000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.53b0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.52d0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5300000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.52a0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.55e0000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4c80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5110000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.55b0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.57a0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5a50000.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5030000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.57d0000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.57a0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.56c0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5210000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.52f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5140000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.52b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5510000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5060000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5110000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5270000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5270000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.49a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.59a0000.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5160000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.56c0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5240000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5270000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5210000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4740000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.52b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188125968.00000000049D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190726376.00000000059A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.718904101.00000000034D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719243124.0000000005161000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719379711.00000000052A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719211601.0000000005130000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190213897.00000000057D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719345888.0000000005270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719826672.00000000053B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719773637.00000000052F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188426833.0000000005110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188330842.0000000005030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719316941.0000000005241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719898030.0000000005510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.723238837.0000000004750000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188469714.0000000005141000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.670020972.0000000004740000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1186610997.0000000002E00000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188598739.00000000052A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719919636.0000000005541000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188659452.0000000005301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.720219818.0000000000DE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.669938310.0000000002541000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.720240608.0000000000E11000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719503580.0000000004C80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188052400.00000000049A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719747240.00000000052B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190813785.0000000005A20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719938381.0000000005570000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190127401.00000000057A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719857103.00000000053E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.722455601.0000000000E11000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719284878.0000000005210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188878871.00000000055E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1186687872.0000000002E31000.00000020.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188363449.0000000005061000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190848028.0000000005A51000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188631120.00000000052D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.722263663.0000000000DE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188973289.00000000056F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188839400.00000000055B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.723309788.0000000004781000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.670044528.0000000004771000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188934735.00000000056C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.742599060.0000000000DE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188553677.0000000005270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.669913455.0000000002510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190787571.00000000059D1000.00000020.00000001.sdmp, type: MEMORY

System Summary:

Source: nV5Wu77N8J.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7128 -ip 7128

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Bdaefwhkzqb\lrinxnmhyts.ogu:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Bdaefwhkzqb\

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_100291F6	2_2_100291F6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002F378	2_2_1002F378
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_100403D7	2_2_100403D7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1004250B	2_2_1004250B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10041557	2_2_10041557
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_100395A1	2_2_100395A1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002F784	2_2_1002F784
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1004091B	2_2_1004091B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002EACF	2_2_1002EACF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002FBA4	2_2_1002FBA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100291F6	3_2_100291F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F378	3_2_1002F378
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100403D7	3_2_100403D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1004250B	3_2_1004250B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10041557	3_2_10041557
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100395A1	3_2_100395A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002F784	3_2_1002F784
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1004091B	3_2_1004091B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002EACF	3_2_1002EACF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002FBA4	3_2_1002FBA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10035D96	3_2_10035D96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10040E5F	3_2_10040E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002EFA4	3_2_1002EFA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBA445	4_2_04CBA445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCB257	4_2_04CCB257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC4A66	4_2_04CC4A66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBDE74	4_2_04CBDE74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC7A0F	4_2_04CC7A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD2009	4_2_04CD2009
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB8636	4_2_04CB8636
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCEFDD	4_2_04CCEFDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBC5D8	4_2_04CBC5D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC85FF	4_2_04CC85FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD17BD	4_2_04CD17BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC654A	4_2_04CC654A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC2142	4_2_04CC2142
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCFF58	4_2_04CCFF58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCE955	4_2_04CCE955
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB670B	4_2_04CB670B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD2B09	4_2_04CD2B09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCAD08	4_2_04CCAD08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB80C0	4_2_04CB80C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCCCD9	4_2_04CCCCD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCD8DB	4_2_04CCD8DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCCAD5	4_2_04CCCAD5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBF0E9	4_2_04CBF0E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD00EF	4_2_04CD00EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD3EE9	4_2_04CD3EE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCE4E5	4_2_04CCE4E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCBEFD	4_2_04CCBEFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBBAA9	4_2_04CBBAA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC3EAA	4_2_04CC3EAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD36AA	4_2_04CD36AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCA2A5	4_2_04CCA2A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB1CA1	4_2_04CB1CA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD46BD	4_2_04CD46BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC0EBC	4_2_04CC0EBC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBC6B8	4_2_04CBC6B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC0ABA	4_2_04CC0ABA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC4244	4_2_04CC4244
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB7442	4_2_04CB7442
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBE640	4_2_04CBE640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCF840	4_2_04CCF840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC2E5D	4_2_04CC2E5D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD0A64	4_2_04CD0A64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD3263	4_2_04CD3263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB7E79	4_2_04CB7E79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB7078	4_2_04CB7078
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC567B	4_2_04CC567B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCA474	4_2_04CCA474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBA871	4_2_04CBA871
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCDC71	4_2_04CCDC71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC8806	4_2_04CC8806
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC9A01	4_2_04CC9A01
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBB820	4_2_04CBB820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB3431	4_2_04CB3431
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCFBDE	4_2_04CCFBDE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBE7DE	4_2_04CBE7DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCC5D5	4_2_04CCC5D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC67E6	4_2_04CC67E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCE1F8	4_2_04CCE1F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB55FF	4_2_04CB55FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC27F9	4_2_04CC27F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB4BFC	4_2_04CB4BFC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC07F4	4_2_04CC07F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC9DF5	4_2_04CC9DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBFB8E	4_2_04CBFB8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB238C	4_2_04CB238C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC3D85	4_2_04CC3D85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC0F86	4_2_04CC0F86
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC6187	4_2_04CC6187
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB2194	4_2_04CB2194
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC8FAE	4_2_04CC8FAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD07AA	4_2_04CD07AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB77A3	4_2_04CB77A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CCD1BC	4_2_04CCD1BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB57B8	4_2_04CB57B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBBFBE	4_2_04CBBFBE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBD14C	4_2_04CBD14C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC7D5B	4_2_04CC7D5B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CD2D53	4_2_04CD2D53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBF369	4_2_04CBF369
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB6B7A	4_2_04CB6B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC5779	4_2_04CC5779
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC437A	4_2_04CC437A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC017B	4_2_04CC017B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC4F74	4_2_04CC4F74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC9774	4_2_04CC9774
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBEF0C	4_2_04CBEF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC5515	4_2_04CC5515
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC8D3D	4_2_04CC8D3D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB1F38	4_2_04CB1F38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CC5333	4_2_04CC5333
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351FF58	6_2_0351FF58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03512142	6_2_03512142
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351654A	6_2_0351654A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351AD08	6_2_0351AD08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350670B	6_2_0350670B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350C5D8	6_2_0350C5D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351EFDD	6_2_0351EFDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350A445	6_2_0350A445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350DE74	6_2_0350DE74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03514A66	6_2_03514A66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03522009	6_2_03522009
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03517A0F	6_2_03517A0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03508636	6_2_03508636
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03522D53	6_2_03522D53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351E955	6_2_0351E955
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03517D5B	6_2_03517D5B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350D14C	6_2_0350D14C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03514F74	6_2_03514F74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03519774	6_2_03519774
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03515779	6_2_03515779
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03506B7A	6_2_03506B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351017B	6_2_0351017B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351437A	6_2_0351437A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350F369	6_2_0350F369
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03515515	6_2_03515515
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03522B09	6_2_03522B09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350EF0C	6_2_0350EF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03515333	6_2_03515333
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03501F38	6_2_03501F38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03518D3D	6_2_03518D3D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351C5D5	6_2_0351C5D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350E7DE	6_2_0350E7DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351FBDE	6_2_0351FBDE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03519DF5	6_2_03519DF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035107F4	6_2_035107F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035127F9	6_2_035127F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351E1F8	6_2_0351E1F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03504BFC	6_2_03504BFC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035185FF	6_2_035185FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035055FF	6_2_035055FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035167E6	6_2_035167E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03502194	6_2_03502194
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03513D85	6_2_03513D85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03516187	6_2_03516187
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03510F86	6_2_03510F86
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350238C	6_2_0350238C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350FB8E	6_2_0350FB8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035057B8	6_2_035057B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351D1BC	6_2_0351D1BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350BFBE	6_2_0350BFBE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035217BD	6_2_035217BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035077A3	6_2_035077A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035207AA	6_2_035207AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03518FAE	6_2_03518FAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351B257	6_2_0351B257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03512E5D	6_2_03512E5D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350E640	6_2_0350E640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351F840	6_2_0351F840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03507442	6_2_03507442
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03514244	6_2_03514244
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351DC71	6_2_0351DC71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350A871	6_2_0350A871
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351A474	6_2_0351A474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03507078	6_2_03507078
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03507E79	6_2_03507E79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351567B	6_2_0351567B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03523263	6_2_03523263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03520A64	6_2_03520A64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03519A01	6_2_03519A01
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03518806	6_2_03518806
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03503431	6_2_03503431
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350B820	6_2_0350B820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351CAD5	6_2_0351CAD5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351CCD9	6_2_0351CCD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351D8DB	6_2_0351D8DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035080C0	6_2_035080C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351BEFD	6_2_0351BEFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351E4E5	6_2_0351E4E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350F0E9	6_2_0350F0E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03523EE9	6_2_03523EE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035200EF	6_2_035200EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350C6B8	6_2_0350C6B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03510ABA	6_2_03510ABA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03510EBC	6_2_03510EBC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035246BD	6_2_035246BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03501CA1	6_2_03501CA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0351A2A5	6_2_0351A2A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_035236AA	6_2_035236AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350BAA9	6_2_0350BAA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03513EAA	6_2_03513EAA

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10030E38 appears 48 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 10030535 appears 69 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10030E38 appears 58 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10030535 appears 87 times

Source: nV5Wu77N8J.dll

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Source: nV5Wu77N8J.dll	Virustotal: Detection: 16%
Source: nV5Wu77N8J.dll	ReversingLabs: Detection: 13%

Source: nV5Wu77N8J.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nV5Wu77N8J.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nV5Wu77N8J.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bdaefwhkzqb\lrinxnmhyts.ogu",XLurkV
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7128 -ip 7128
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Bdaefwhkzqb\lrinxnmhyts.ogu",DllRegisterServer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 568
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nV5Wu77N8J.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nV5Wu77N8J.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bdaefwhkzqb\lrinxnmhyts.ogu",XLurkV	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Bdaefwhkzqb\lrinxnmhyts.ogu",DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7128 -ip 7128	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 568	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER37B8.tmp

Jump to behavior

Source: classification engine

Classification label: mal92.troj.evad.winDLL@27/10@0/27

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6712:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7128

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10021183 LoadResource,LockResource,SizeofResource,

2_2_10021183

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726747041.0000000002F12000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726920017.0000000002F12000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726719293.00000000049D6000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.727134531.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726928256.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726753757.0000000002F18000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000010.00000003.727134531.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726928256.0000000002F18000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726753757.0000000002F18000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726739926.0000000002F0C000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.727328906.0000000002F0C000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000010.00000003.726747041.0000000002F12000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.726920017.0000000002F12000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: a[ojr^oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000010.00000002.741443173.0000000000A72000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000010.00000003.730451291.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000010.00000003.726739926.0000000002F0C000.00000004.00000001.sdmp, WerFault.exe, 00000010.00000003.727328906.0000000002F0C000.00000004.00000001.sdmp

Source: nV5Wu77N8J.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nV5Wu77N8J.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nV5Wu77N8J.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nV5Wu77N8J.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nV5Wu77N8J.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1003060D push ecx; ret	2_2_10030620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1003060D push ecx; ret	3_2_10030620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10030E7D push ecx; ret	3_2_10030E90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CB1195 push cs; iretd	4_2_04CB1197
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03501195 push cs; iretd	6_2_03501197

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_1003E278 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

2_2_1003E278

Source: nV5Wu77N8J.dll

Static PE information: real checksum: 0x970bf should be: 0x91c5b

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\nV5Wu77N8J.dll

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Bdaefwhkzqb\lrinxnmhyts.ogu

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Bdaefwhkzqb\lrinxnmhyts.ogu:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Rejasxmfwpqnhtgn\jdiy.puy:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect,	2_2_100250A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100250A3 IsIconic,GetWindowPlacement,GetWindowRect,	3_2_100250A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001DFC0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	3_2_1001DFC0

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 6048

Thread sleep time: -150000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_2-16653
Source: C:\Windows\SysWOW64\rundll32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_3-21435

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 4.8 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 5.2 %

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node			graph_2-16655
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_3-21136

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.16.dr	Binary or memory string: VMware
Source: Amcache.hve.16.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.16.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.16.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.16.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.16.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000014.00000002.822285678.0000020B39ED1000.00000004.00000001.sdmp, svchost.exe, 00000014.00000002.822309970.0000020B39EE9000.00000004.00000001.sdmp, svchost.exe, 00000014.00000002.822205344.0000020B39E82000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.16.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.16.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.16.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.16.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_1002DB0D

Source: C:\Windows\SysWOW64\regsvr32.exe

2_2_1003E278

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_10002D40 SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,VirtualAlloc,VirtualAlloc,SetLastError,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,SetLastError,

2_2_10002D40

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CBF7F7 mov eax, dword ptr fs:[00000030h]		4_2_04CBF7F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0350F7F7 mov eax, dword ptr fs:[00000030h]		6_2_0350F7F7

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_1003A8D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_1002DB0D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1003A8D4 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_1003A8D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002DB0D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_1002DB0D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10032CB9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_10032CB9

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 69.16.218.101 144			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.138.98.34 80			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7128 -ip 7128	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 568	Jump to behavior

Source: loaddll32.exe, 00000000.00000000.720426982.0000000001260000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.722595476.0000000001260000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.1187914001.00000000033E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.720426982.0000000001260000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.722595476.0000000001260000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.1187914001.00000000033E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.720426982.0000000001260000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.722595476.0000000001260000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.1187914001.00000000033E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.720426982.0000000001260000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.722595476.0000000001260000.00000002.00020000.sdmp, rundll32.exe, 0000000E.00000002.1187914001.00000000033E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	2_2_1003E000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	2_2_1003D098
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	2_2_1002129B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	2_2_1003D35E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	2_2_1003850E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	2_2_1003D7AE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_1003C7D2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	2_2_1003D8C5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	2_2_1003D95D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	2_2_1003D9D1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	2_2_1003F9F4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	2_2_1003EA86
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	2_2_1003EABA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	2_2_1003DBA3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_1003EBF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	3_2_1003E000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	3_2_1003D098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	3_2_1002129B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	3_2_1003D35E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	3_2_1003850E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	3_2_1003D7AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_1003C7D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_1003D8C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	3_2_1003D95D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_1003D9D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_1003F9F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	3_2_1003EA86
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	3_2_1003EABA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_1003DBA3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_1003EBF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_1003DC64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_1003DCCB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	3_2_1003DD07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	3_2_1003CE40

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_1003732F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_1003732F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10024F01 _memset,GetVersionExA,

3_2_10024F01

Source: Amcache.hve.16.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 14.2.rundll32.exe.55b0000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5030000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4770000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.53b0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5510000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.52a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.56f0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.59a0000.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4780000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4cb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.49a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.53e0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.52d0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5570000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5270000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5570000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.49d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5540000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.59d0000.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5a20000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5a20000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.53b0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.52d0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5300000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.52a0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2540000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.55e0000.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4c80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5110000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.55b0000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.57a0000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5a50000.21.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5030000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.57d0000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.57a0000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.56c0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5210000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.52f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5140000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.52b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.5510000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.4750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5060000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5110000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.5270000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5270000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.49a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.34d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.59a0000.18.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5160000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.56c0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5240000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5270000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.5210000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rundll32.exe.2e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4740000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.52b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188125968.00000000049D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190726376.00000000059A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.718904101.00000000034D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719243124.0000000005161000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719379711.00000000052A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719211601.0000000005130000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190213897.00000000057D1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719345888.0000000005270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719826672.00000000053B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719773637.00000000052F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188426833.0000000005110000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188330842.0000000005030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719316941.0000000005241000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719898030.0000000005510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.723238837.0000000004750000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188469714.0000000005141000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.670020972.0000000004740000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1186610997.0000000002E00000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188598739.00000000052A1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719919636.0000000005541000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188659452.0000000005301000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.720219818.0000000000DE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.669938310.0000000002541000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.720240608.0000000000E11000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719503580.0000000004C80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188052400.00000000049A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719747240.00000000052B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190813785.0000000005A20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719938381.0000000005570000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190127401.00000000057A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.719857103.00000000053E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.722455601.0000000000E11000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.719284878.0000000005210000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188878871.00000000055E1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1186687872.0000000002E31000.00000020.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188363449.0000000005061000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190848028.0000000005A51000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188631120.00000000052D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.722263663.0000000000DE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188973289.00000000056F1000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188839400.00000000055B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.723309788.0000000004781000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.670044528.0000000004771000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188934735.00000000056C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.742599060.0000000000DE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1188553677.0000000005270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.669913455.0000000002510000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1190787571.00000000059D1000.00000020.00000001.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,		2_2_10001160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001160 WSAStartup,_memset,htonl,htons,socket,bind,setsockopt,		3_2_10001160

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API2	DLL Side-Loading1	DLL Side-Loading1	Deobfuscate/Decode Files or Information1	Input Capture1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Obfuscated Files or Information2	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	DLL Side-Loading1	Security Account Manager	System Information Discovery25	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	File Deletion1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading2	LSA Secrets	Security Software Discovery41	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion2	Cached Domain Credentials	Virtualization/Sandbox Evasion2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Hidden Files and Directories1	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Regsvr321	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Rundll321	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
nV5Wu77N8J.dll	17%	Virustotal		Browse
nV5Wu77N8J.dll	14%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.2.rundll32.exe.5030000.4.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.55b0000.12.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
4.2.rundll32.exe.5510000.6.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
4.2.rundll32.exe.53e0000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.loaddll32.exe.de0000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
11.2.rundll32.exe.4780000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.52a0000.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.53b0000.4.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
4.2.rundll32.exe.4cb0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.52d0000.10.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.2e30000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.rundll32.exe.4770000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.0.loaddll32.exe.de0000.3.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
0.0.loaddll32.exe.de0000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
0.0.loaddll32.exe.e10000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.56f0000.15.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.5570000.8.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
4.2.rundll32.exe.5540000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.49d0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.5a20000.20.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.59d0000.19.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.regsvr32.exe.2510000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
3.2.rundll32.exe.4740000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
11.2.rundll32.exe.4750000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.5300000.11.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.4c80000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
2.2.regsvr32.exe.2540000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.rundll32.exe.52a0000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.55e0000.13.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.57a0000.16.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.5a50000.21.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.57d0000.17.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.52f0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.rundll32.exe.5210000.4.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
6.2.rundll32.exe.3500000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.5140000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.5060000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.5270000.8.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.5110000.6.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
0.0.loaddll32.exe.e10000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.49a0000.2.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.59a0000.18.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
6.2.rundll32.exe.34d0000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
6.2.rundll32.exe.5160000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.rundll32.exe.5130000.2.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
4.2.rundll32.exe.52b0000.2.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
6.2.rundll32.exe.5270000.6.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
14.2.rundll32.exe.56c0000.14.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
6.2.rundll32.exe.5240000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.rundll32.exe.2e00000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000014.00000002.822309970.0000020B39EE9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.16.dr	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000014.00000003.800900762.0000020B3AC02000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800918679.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800834222.0000020B3AC19000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800807896.0000020B3AC19000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800791461.0000020B3A7A1000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.800774631.0000020B3A790000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://help.disneyplus.com.	svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 00000014.00000003.798251058.0000020B3A790000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.798329573.0000020B3A76E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
207.148.81.119	unknown	United States	20473	AS-CHOOPAUS	true
104.131.62.48	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
191.252.103.16	unknown	Brazil	27715	LocawebServicosdeInternetSABR	true
168.197.250.14	unknown	Argentina	264776	OmarAnselmoRipollTDCNETAR	true
66.42.57.149	unknown	United States	20473	AS-CHOOPAUS	true
185.148.168.15	unknown	Germany	44780	EVERSCALE-ASDE	true
51.210.242.234	unknown	France	16276	OVHFR	true
217.182.143.207	unknown	France	16276	OVHFR	true
69.16.218.101	unknown	United States	32244	LIQUIDWEBUS	true
159.69.237.188	unknown	Germany	24940	HETZNER-ASDE	true
45.138.98.34	unknown	Germany	9009	M247GB	true
116.124.128.206	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
78.46.73.125	unknown	Germany	24940	HETZNER-ASDE	true
37.59.209.141	unknown	France	16276	OVHFR	true
210.57.209.142	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
185.148.168.220	unknown	Germany	44780	EVERSCALE-ASDE	true
54.37.228.122	unknown	France	16276	OVHFR	true
190.90.233.66	unknown	Colombia	18678	INTERNEXASAESPCO	true
142.4.219.173	unknown	Canada	16276	OVHFR	true
54.38.242.185	unknown	France	16276	OVHFR	true
195.154.146.35	unknown	France	12876	OnlineSASFR	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
62.171.178.147	unknown	United Kingdom	51167	CONTABODE	true
128.199.192.135	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553353
Start date:	14.01.2022
Start time:	18:49:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	nV5Wu77N8J (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.evad.winDLL@27/10@0/27
EGA Information:	Successful, ratio: 80%
HDC Information:	Successful, ratio: 31.9% (good quality ratio 30%) Quality average: 74.1% Quality standard deviation: 26.4%
HCA Information:	Successful, ratio: 80% Number of executed functions: 51 Number of non-executed functions: 135
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.107.4.50, 20.54.110.249, 40.91.112.76 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, c-0001.c-msedge.net, b1ns.c-0001.c-msedge.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, b1ns.au-msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:51:13	API Interceptor	7x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
207.148.81.119	OZra.dll	Get hash	malicious	Browse
	RQ6mxb6ssDtBoLUIE.dll	Get hash	malicious	Browse
	EcJ8rbg.dll	Get hash	malicious	Browse
	gyZm68Cgwf.dll	Get hash	malicious	Browse
	5o8zdV3GU3.dll	Get hash	malicious	Browse
	aoPHg7b78c.dll	Get hash	malicious	Browse
	xxWrY2YG7s.dll	Get hash	malicious	Browse
	7MhGa3iotM.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	M2hsMd9hTq.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	8ozP45Xn3V.dll	Get hash	malicious	Browse
	pugKLanrj3.dll	Get hash	malicious	Browse
	CSxylfUJcL.dll	Get hash	malicious	Browse
	nCiZXrlB39.dll	Get hash	malicious	Browse
	bEK6Xc41qp.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.37.xlsm	Get hash	malicious	Browse
	qJQ5zHpsbm.dll	Get hash	malicious	Browse
104.131.62.48	OZra.dll	Get hash	malicious	Browse
	RQ6mxb6ssDtBoLUIE.dll	Get hash	malicious	Browse
	EcJ8rbg.dll	Get hash	malicious	Browse
	gyZm68Cgwf.dll	Get hash	malicious	Browse
	5o8zdV3GU3.dll	Get hash	malicious	Browse
	aoPHg7b78c.dll	Get hash	malicious	Browse
	xxWrY2YG7s.dll	Get hash	malicious	Browse
	7MhGa3iotM.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	M2hsMd9hTq.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	8ozP45Xn3V.dll	Get hash	malicious	Browse
	pugKLanrj3.dll	Get hash	malicious	Browse
	CSxylfUJcL.dll	Get hash	malicious	Browse
	nCiZXrlB39.dll	Get hash	malicious	Browse
	bEK6Xc41qp.dll	Get hash	malicious	Browse
	vHwdqVl8yP.dll	Get hash	malicious	Browse
	wg1bXKYOOs.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Agent.FRJZ.37.xlsm	Get hash	malicious	Browse
	qJQ5zHpsbm.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-CHOOPAUS	1nJGU59JPU.exe	Get hash	malicious	Browse	136.244.117.138
	kGl1qp3Ox8.exe	Get hash	malicious	Browse	149.28.78.238
	OZra.dll	Get hash	malicious	Browse	66.42.57.149
	RQ6mxb6ssDtBoLUIE.dll	Get hash	malicious	Browse	66.42.57.149
	EcJ8rbg.dll	Get hash	malicious	Browse	66.42.57.149
	Comrpobante_60.vbs	Get hash	malicious	Browse	149.248.50.230
	sample.js	Get hash	malicious	Browse	45.76.154.237
	gyZm68Cgwf.dll	Get hash	malicious	Browse	66.42.57.149
	5o8zdV3GU3.dll	Get hash	malicious	Browse	66.42.57.149
	aoPHg7b78c.dll	Get hash	malicious	Browse	66.42.57.149
	xxWrY2YG7s.dll	Get hash	malicious	Browse	66.42.57.149
	7MhGa3iotM.dll	Get hash	malicious	Browse	66.42.57.149
	vHwdqVl8yP.dll	Get hash	malicious	Browse	66.42.57.149
	M2hsMd9hTq.dll	Get hash	malicious	Browse	66.42.57.149
	wg1bXKYOOs.dll	Get hash	malicious	Browse	66.42.57.149
	8ozP45Xn3V.dll	Get hash	malicious	Browse	66.42.57.149
	pugKLanrj3.dll	Get hash	malicious	Browse	66.42.57.149
	CSxylfUJcL.dll	Get hash	malicious	Browse	66.42.57.149
	nCiZXrlB39.dll	Get hash	malicious	Browse	66.42.57.149
	bEK6Xc41qp.dll	Get hash	malicious	Browse	66.42.57.149
DIGITALOCEAN-ASNUS	vk8A1dXh5C.exe	Get hash	malicious	Browse	188.166.28.199
	GahImDA8DA.exe	Get hash	malicious	Browse	188.166.28.199
	prkVkqYIwv.exe	Get hash	malicious	Browse	188.166.28.199
	OZra.dll	Get hash	malicious	Browse	128.199.192.135
	RQ6mxb6ssDtBoLUIE.dll	Get hash	malicious	Browse	128.199.192.135
	EcJ8rbg.dll	Get hash	malicious	Browse	128.199.192.135
	P42zLwaJQk.exe	Get hash	malicious	Browse	188.166.28.199
	9ro85QVN0F.exe	Get hash	malicious	Browse	188.166.28.199
	hWLlYv2MAX	Get hash	malicious	Browse	159.89.53.206
	sample.js	Get hash	malicious	Browse	138.197.222.36
	Mc7TWWp1Vp.exe	Get hash	malicious	Browse	188.166.28.199
	sbxGIUIhRd.exe	Get hash	malicious	Browse	188.166.28.199
	6zsU4O4WHq.exe	Get hash	malicious	Browse	188.166.28.199
	Bank Swift Copy 1027263738.exe	Get hash	malicious	Browse	178.128.244.245
	gyZm68Cgwf.dll	Get hash	malicious	Browse	128.199.192.135
	5o8zdV3GU3.dll	Get hash	malicious	Browse	128.199.192.135
	aoPHg7b78c.dll	Get hash	malicious	Browse	128.199.192.135
	xxWrY2YG7s.dll	Get hash	malicious	Browse	128.199.192.135
	7MhGa3iotM.dll	Get hash	malicious	Browse	128.199.192.135
	urMpgNNXPM.exe	Get hash	malicious	Browse	188.166.28.199

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_12a180e49793e381a8b848106c2e1caa7a6a4277_7cac0383_0ffd4626\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7958908003747792
Encrypted:	false
SSDEEP:	96:gtrh2nYyay9haol7Jf0pXIQcQSc6mcEUcw3/s+a+z+HbHg1VG4rmMoVazWvMOpNZ:gdunoHsieryjNq/u7seS274ItW
MD5:	CC2ED1887CF43DF87605ACE581A8646C
SHA1:	550A0F8D4875DDE3241376F32EA4319F995E80AA
SHA-256:	2A1C0F968CC272E23942C7A0DE2550330F1D6BAA7B5D7CDB3D0C9EDF63E4704D
SHA-512:	A05A8654EBB4CDEAA2C964D7880CC6640A68CF90BE7EB2CE7110CF774751F2FA6546123E45FF9763CD84B39B5C79B07F085D870C3A4B24F92863B9ECF2B1A7FE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.5.6.2.4.0.2.0.6.0.7.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.7.b.5.1.f.7.2.-.7.4.5.f.-.4.6.c.a.-.9.4.6.d.-.0.f.2.2.d.a.9.f.6.1.f.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.d.6.1.2.2.8.-.d.a.4.6.-.4.e.3.3.-.a.1.3.6.-.9.d.3.d.a.e.5.6.8.a.e.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.d.8.-.0.0.0.1.-.0.0.1.b.-.0.8.4.5.-.4.1.2.c.6.f.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.2././.1.3.:.0.9.:.0.7.:.1.6.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F33.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Jan 14 17:50:41 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	44328
Entropy (8bit):	2.1255697233673803
Encrypted:	false
SSDEEP:	192:6vUI/5hbOiYNH+PieACib4nfnzOgPUEYMw/xZUWbKboJyrPun+MN:8biiYH+aaOgTYMw/kWbKboQMN
MD5:	DC01F206F671FB8F58F9AA9658616573
SHA1:	698402D4CB0A56F16C96CC6FF9C7B2CC51C8D6F1
SHA-256:	43038B7DC644076824E4557DE0C176126850EE890D718752E4997773D5948B2C
SHA-512:	5887CCEE773D35B702C9AF1A452D57C7C288A8E63141269152E4556787331FCD37A7B60B7F77E92B740B69409D5416CC87030CCE2E898ED17A5E0901EB784EC9
Malicious:	false
Preview:	MDMP....... .........a....................................$...T............%..........`.......8...........T...............(...........x...........d....................................................................U...........B..............GenuineIntelW...........T.............a.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER357E.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.698245170232573
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNieg6HDG6Yr8SUJzzgmfdSwGY+pB289bqHsfBdum:RrlsNix6HDG6YgSUJzzgmfdSwAqMf7
MD5:	7E0377FAAB1AD65AB85DA6CD5994D55C
SHA1:	BAE2C81841F7387CEF5D048B0822AD874695907B
SHA-256:	D187E67B5FFD076BFFCB4C6A7A3C0ACC88655A148F03ADFEDF52B2F2917884CF
SHA-512:	C203C207A0759E8037725128528C0E628973195243726B8FE4A122C3288D821AA40DC2E15BA5DC97CAF5A8110F94EBAFDB809389078545027B3EF494F809039C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.2.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37B8.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	54294
Entropy (8bit):	3.065453431295334
Encrypted:	false
SSDEEP:	768:NZHDXSE66uT4rWXV/ZKGzWZXf+tJYRzdvs1sj+nKztt4o:NZHDXruT4rWX1ZKGz2Pz3s1sjmYtt3
MD5:	9349FAC214CA4C81AB05C77F4A2C7D4D
SHA1:	3AAEB9C25AF62BDCC9495E193D9352D5A98454DE
SHA-256:	A5673DCE88CE81C3441A2D16BF605813E6F99D24354F81F24CC9C333E15133CE
SHA-512:	119E25AF4398FEABC300138E337B697DC9AF0DD61D2D9DA2139F227C2C366D35C785896C4C47027421DCB949377989B61AD3BFCBBA1200877C9E91F158D6A81C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER380F.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	4.472230205116493
Encrypted:	false
SSDEEP:	48:cvIwSD8zs3JgtWI9i8WSC8B5T8fm8M4J2+SZFriK+q84pz/KcQIcQw0Fd:uITfZJ1SN4JQaKx/Kkw0Fd
MD5:	AD542CDFC04F3D3E21C591306272E1F2
SHA1:	75DCC0382297711450AA500834D42ABD25E00A84
SHA-256:	94CE388EDFAABD0604FF750318ED3358F74120AD6B82D85BADD173DF09C9CC32
SHA-512:	BA14E776E54168A2FE6CB337B251455021408E7D28A199E9E04FB2349C858E3DFBFE7F37486CD15415AB0552DE2631CF09FC813AF9D43E440CCAEFCABDB8472E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1342261" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40B2.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694612449693779
Encrypted:	false
SSDEEP:	96:9GiZYWvXIp9YRYVLHW2zH3UYEZCftFiSP3DG5wCEBFZUahVHixcZzQIaD3:9jZDk2oDDUSUahVHicZznaD3
MD5:	5F5477C2598625553616383B8D034BF9
SHA1:	93356F37C9678412A30B9CDFEE671FFC31D10926
SHA-256:	E34358D64E33055A271962E7C83522C5557B2420100ADFAF553438CCE8DFAB6D
SHA-512:	57FAFBBDE767CE5B3C0691E6F3802C93986B87710A0A12B23A429D9DE94A8242705779133007B198DA2FDFFE7CCE866E31D0F1CD2E91F57ED4966105BB874BA8
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Microsoft Cabinet archive data, 61414 bytes, 1 file
Category:	dropped
Size (bytes):	61414
Entropy (8bit):	7.995245868798237
Encrypted:	true
SSDEEP:	1536:EysgU6qmzixT64jYMZ8HbVPGfVDwm/xLZ9rP:wF6qmeo4eH1m9wmLvrP
MD5:	ACAEDA60C79C6BCAC925EEB3653F45E0
SHA1:	2AAAE490BCDACCC6172240FF1697753B37AC5578
SHA-256:	6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
SHA-512:	FEAA6E7ED7DDA1583739B3E531AB5C562A222EE6ECD042690AE7DCFF966717C6E968469A7797265A11F6E899479AE0F3031E8CF5BEBE1492D5205E9C59690900
Malicious:	false
Preview:	MSCF............,...................I.......;w........RSNj .authroot.stl..>.(.5..CK..8T....c_.d...A.K...+.d.H..i.RJJ.IQIR..$t)Kd.-[..T\{..ne......<.w......A..B........c...wi......D....c.0D,L........fy....Rg...=........i,3.3..Z....~^ve<...TF....f.zy.,...m.@.0.0...m.3..I(..+..v#...(.2....e...L..y..V.......~U...."<ke.....l.X:Dt..R<7.5\A7L0=..T.V...IDr..8<....r&...I-.^..b.b.".Af....E.._..r.>.`;,.Hob..S.....7'..\.R$.".g..+..64..@nP.....k3...B.`.G..@D.....L.....`^...#OpW.....!....`.....rf:.}.R.@....gR.#7....l..H.#...d.Qh..3..fCX....==#..M.l..~&....[.J9.\..Ww.....Tx.%....]..a4E...q.+...#.a..x..O..V.t..Y1!.T..`U...-...< _@...\|(.....0..3.`.LU...E0.Gu.4KN....5...?.....I.p..'..........N<.d.O..dH@c1t...[w/...T....cYK.X>.0..Z.....O>..9.3.#9X.%.b...5.YK.E.V.....`./.3.._..nN]..=..M.o.F.._..z....._...gY..!Z..?l....vp.l.:.d.Z..W.....~...N.._.k...&.....$......i.F.d.....D!e.....Y..,.E..m.;.1... $.F..O.F.o_}.uG....,.%.>,.Zx.......o....c../.;....g&.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.097530992147587
Encrypted:	false
SSDEEP:	6:kKa0k8SN+SkQlPlEGYRMY9z+4KlDA3RUeYlUmlUR/t:f9kPlE99SNxAhUeYlUSA/t
MD5:	FE852652A83C35ED73C16EB984F0A0BB
SHA1:	903E0D354606447141921F368FFF881F8B39D314
SHA-256:	544F8EC2994A6E7AE27B6E6716551CED5B9DA560112E0983051DD85BD10A38D3
SHA-512:	262D92433CCBCF768B271A5CD0E0FEA9FFD91773D8BEECE487C9BC110661D0FF92BFDF59C9934F83B897A65B11E885A63361AD24CE9F94C86F7592643C7D946A
Malicious:	false
Preview:	p...... ........d.Eo...(....................................................... ........q.\].......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.7.1.e.1.5.c.5.d.c.4.d.7.1.:.0."...

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.2353877146837755
Encrypted:	false
SSDEEP:	12288:AXebQWU7wCwgLXGMpf9a2sYrwl8X6ixnD72RGDQfK+kGVZWa:cebQWU7wCwYXGMmuw
MD5:	A0557199ADDFB27CF6464B5654E5A8D2
SHA1:	A1E5B548CF78A926C58CF4F8896D6F5AF36EA689
SHA-256:	57BEABDE5C4A76F562D6BC875F323212DD287C45BB05BAE5B1EAD7E60A1B3A7C
SHA-512:	06DB0E8FA45D8FD906539407ABEC8DE47B01D10FE91FD379BDE0E8ED0242299888405E4ACA66B0856C90EF95559C50B9A8C83B0B347B7F8BDC7D35321F57D5BB
Malicious:	false
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmZ^.=o...............................................................................................................................................................................................................................................................................................................................................u..`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.717963317220201
Encrypted:	false
SSDEEP:	384:bou5K5Rcv4KgnVVeeDzeu1NKZtjWT8GRFwlnz:UgKCg/eeDzeANYtjzGRFwl
MD5:	6F59FBDE4F71430F9292DA90FE383B99
SHA1:	4726D40666BF4E921633D743DC6763542696A4EC
SHA-256:	BCBC1BEB1BA771B7C4B1C28484C56FACB5D44B9AE7F92AD4585349840177A5B8
SHA-512:	2709BD600E9FBAEF8069E1197E29A79AB36F18BA3DAFA11849C9B0CA81EA0B45C4B46E8D896F195207EEC23FFA9D4AD04D03DA4316ED61DE0AA5DDED6E07F9AB
Malicious:	false
Preview:	regfG...G...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmZ^.=o...............................................................................................................................................................................................................................................................................................................................................s..`HvLE.>......G............-'_....2....J..........................hbin................p.\..,..........nk,....=o................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ....=o....... ........................... .......Z.......................Root........lf......Root....nk ....=o................................... ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.767601853206896
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nV5Wu77N8J.dll
File size:	588288
MD5:	a0306b7a6a12022e4fc8e586b0bc90ec
SHA1:	ee7d221826a725a2110bbddbea34bd14522b5ab4
SHA256:	9b1ca060b5a969f03c4c8d99ad487a454742e47fff97343a90afacb5da7d9589
SHA512:	9bf807e5b79ec4d6c24db9106db43d6e4e2211d70caf8ca71101d96001a7fb6c31dad9ac4d72b8e6646e03a7bfa70b296968be6a24f3d11dd8e90090de94d7dc
SSDEEP:	6144:cNU5LwA22222GgngDrDRVyYli/ci2tEGW78ODQiE3tvOSk5DKXOW14IkFxVFgY4E:x5w7YM/cYVV7EsOpOJyvnHtytFyQ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m.......................................^F......^P.n....^W.t....^Y......^A......^G......^B.....Rich....................PE..L..

File Icon


Icon Hash:	71b018ccc6577131

Static PE Info

General
Entrypoint:	0x1002eaac
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x61E03DE6 [Thu Jan 13 14:57:42 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	7f57698bb210fa88a6b01b1feaf20957

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F3750B90317h
call 00007F3750B98B88h
push dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+10h]
mov edx, dword ptr [ebp+0Ch]
call 00007F3750B90201h
pop ecx
pop ebp
retn 000Ch
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword ptr [ebp+10h]
mov eax, edi
sub eax, 00000000h
je 00007F3750B918FBh
dec eax
je 00007F3750B918E3h
dec eax
je 00007F3750B918AEh
dec eax
je 00007F3750B9185Fh
dec eax
je 00007F3750B917CFh
mov ecx, dword ptr [ebp+0Ch]
mov eax, dword ptr [ebp+08h]
push ebx
push 00000020h
pop edx
jmp 00007F3750B90787h
mov esi, dword ptr [eax]
cmp esi, dword ptr [ecx]
je 00007F3750B9038Eh
movzx esi, byte ptr [eax]
movzx ebx, byte ptr [ecx]
sub esi, ebx
je 00007F3750B90327h
xor ebx, ebx
test esi, esi
setnle bl
lea ebx, dword ptr [ebx+ebx-01h]
mov esi, ebx
test esi, esi
jne 00007F3750B9077Fh
movzx esi, byte ptr [eax+01h]
movzx ebx, byte ptr [ecx+01h]
sub esi, ebx
je 00007F3750B90327h
xor ebx, ebx
test esi, esi
setnle bl
lea ebx, dword ptr [ebx+ebx-01h]
mov esi, ebx
test esi, esi
jne 00007F3750B9075Eh
movzx esi, byte ptr [eax+02h]
movzx ebx, byte ptr [ecx+02h]
sub esi, ebx
je 00007F3750B90327h
xor ebx, ebx
test esi, esi
setnle bl
lea ebx, dword ptr [ebx+ebx-01h]
mov esi, ebx
test esi, esi
jne 00007F3750B9073Dh

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ C ] VS2005 build 50727
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[EXP] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x50bc0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f538	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x89000	0x3410	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8d000	0x415c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4bd00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x47000	0x454	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4f4b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x45bb9	0x45c00	False	0.379756804435	data	6.37093799262	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x47000	0x9c10	0x9e00	False	0.357397151899	data	5.22192082052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x51000	0x3735c	0x33800	False	0.741035535498	data	6.11335979295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x89000	0x3410	0x3600	False	0.306640625	data	4.34913645958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8d000	0x8c34	0x8e00	False	0.346308318662	data	4.00973830682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x89ac0	0x134	data	Chinese	China
RT_CURSOR	0x89bf4	0xb4	data	Chinese	China
RT_CURSOR	0x89ca8	0x134	AmigaOS bitmap font	Chinese	China
RT_CURSOR	0x89ddc	0x134	data	Chinese	China
RT_CURSOR	0x89f10	0x134	data	Chinese	China
RT_CURSOR	0x8a044	0x134	data	Chinese	China
RT_CURSOR	0x8a178	0x134	data	Chinese	China
RT_CURSOR	0x8a2ac	0x134	data	Chinese	China
RT_CURSOR	0x8a3e0	0x134	data	Chinese	China
RT_CURSOR	0x8a514	0x134	data	Chinese	China
RT_CURSOR	0x8a648	0x134	data	Chinese	China
RT_CURSOR	0x8a77c	0x134	data	Chinese	China
RT_CURSOR	0x8a8b0	0x134	AmigaOS bitmap font	Chinese	China
RT_CURSOR	0x8a9e4	0x134	data	Chinese	China
RT_CURSOR	0x8ab18	0x134	data	Chinese	China
RT_CURSOR	0x8ac4c	0x134	data	Chinese	China
RT_BITMAP	0x8ad80	0xb8	data	Chinese	China
RT_BITMAP	0x8ae38	0x144	data	Chinese	China
RT_ICON	0x8af7c	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 67108992, next used block 3293332676	Chinese	China
RT_ICON	0x8b264	0x128	GLS_BINARY_LSB_FIRST	Chinese	China
RT_DIALOG	0x8b38c	0x33c	data	Chinese	China
RT_DIALOG	0x8b6c8	0xe2	data	Chinese	China
RT_DIALOG	0x8b7ac	0x34	data	Chinese	China
RT_STRING	0x8b7e0	0x4e	data	Chinese	China
RT_STRING	0x8b830	0x2c	data	Chinese	China
RT_STRING	0x8b85c	0x82	data	Chinese	China
RT_STRING	0x8b8e0	0x1d6	data	Chinese	China
RT_STRING	0x8bab8	0x160	data	Chinese	China
RT_STRING	0x8bc18	0x12e	data	Chinese	China
RT_STRING	0x8bd48	0x50	data	Chinese	China
RT_STRING	0x8bd98	0x44	data	Chinese	China
RT_STRING	0x8bddc	0x68	data	Chinese	China
RT_STRING	0x8be44	0x1b8	data	Chinese	China
RT_STRING	0x8bffc	0x104	data	Chinese	China
RT_STRING	0x8c100	0x24	data	Chinese	China
RT_STRING	0x8c124	0x30	data	Chinese	China
RT_GROUP_CURSOR	0x8c154	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China
RT_GROUP_CURSOR	0x8c178	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c18c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c1a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c1b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c1c8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c1dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c1f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c204	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c218	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c22c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c240	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c254	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c268	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_CURSOR	0x8c27c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China
RT_GROUP_ICON	0x8c290	0x22	data	Chinese	China
RT_MANIFEST	0x8c2b4	0x15a	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetOEMCP, GetCommandLineA, RtlUnwind, ExitProcess, HeapReAlloc, RaiseException, HeapSize, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetACP, IsValidCodePage, LCMapStringA, LCMapStringW, HeapCreate, HeapDestroy, GetStdHandle, GetCPInfo, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetConsoleCP, GetConsoleMode, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, GetLocaleInfoW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetModuleHandleW, CreateFileA, GetCurrentProcess, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, InterlockedIncrement, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, GlobalHandle, GlobalReAlloc, TlsGetValue, LocalAlloc, WritePrivateProfileStringA, GlobalFlags, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GlobalGetAtomNameA, GlobalFindAtomA, lstrcmpW, GetVersionExA, FormatMessageA, LocalFree, lstrlenA, InterlockedDecrement, MulDiv, MultiByteToWideChar, GlobalUnlock, GlobalFree, FreeResource, GlobalAddAtomA, GetCurrentProcessId, GetLastError, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, EnumResourceLanguagesA, GetModuleFileNameA, GetLocaleInfoA, WideCharToMultiByte, CompareStringA, FindResourceA, LoadResource, LockResource, SizeofResource, InterlockedExchange, GlobalLock, lstrcmpA, GlobalAlloc, GetModuleHandleA, CreateThread, CloseHandle, VirtualProtect, LoadLibraryA, VirtualAlloc, GetProcAddress, SetLastError, Sleep, IsBadReadPtr, GetProcessHeap, VirtualFree, HeapFree, HeapAlloc, FreeLibrary, VirtualQuery, SetHandleCount, GetNativeSystemInfo
USER32.dll	LoadCursorA, GetSysColorBrush, SetWindowTextA, IsDialogMessageA, SetDlgItemTextA, GetDlgItemTextA, RegisterWindowMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, GetForegroundWindow, GetTopWindow, GetMessageTime, GetMessagePos, MapWindowPoints, SetMenu, SetForegroundWindow, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, AdjustWindowRectEx, CopyRect, PtInRect, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, SetWindowLongA, SetWindowPos, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, GetMenuItemID, GetMenuItemCount, GetSubMenu, UnhookWindowsHookEx, GetSysColor, EndPaint, BeginPaint, ReleaseDC, GetDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, GetWindowTextLengthA, GetWindowTextA, GetWindow, SetFocus, GetDesktopWindow, SetActiveWindow, CreateDialogIndirectParamA, DestroyWindow, IsWindow, GetDlgItem, GetNextDlgTabItem, EndDialog, SetWindowsHookExA, CallNextHookEx, GetMessageA, DestroyMenu, UpdateWindow, TranslateMessage, DispatchMessageA, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageA, GetCursorPos, ValidateRect, GetWindowThreadProcessId, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, MessageBoxA, SetCursor, PostQuitMessage, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapA, GetFocus, GetParent, ModifyMenuA, GetMenuState, EnableMenuItem, CheckMenuItem, SetTimer, IsIconic, KillTimer, LoadIconA, DrawIcon, GetClientRect, SendMessageA, ShowWindow, PostMessageA, GetSystemMetrics, EnableWindow, GetMenu
GDI32.dll	GetStockObject, SelectObject, GetDeviceCaps, DeleteDC, Escape, ExtTextOutA, TextOutA, RectVisible, ScaleWindowExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, CreateBitmap, PtVisible, GetObjectA, DeleteObject, GetClipBox, SetMapMode, SetTextColor, SetBkColor, RestoreDC, SaveDC, SetViewportOrgEx
WINSPOOL.DRV	DocumentPropertiesA, ClosePrinter, OpenPrinterA
ADVAPI32.dll	RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegOpenKeyA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey
SHLWAPI.dll	PathFindExtensionA
OLEAUT32.dll	VariantClear, VariantChangeType, VariantInit
WS2_32.dll	htons, setsockopt, sendto, htonl, bind, socket, closesocket, inet_addr, recvfrom, WSACleanup, WSAStartup

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x1001df20

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/14/22-18:50:50.021159	TCP	2404332	ET CNC Feodo Tracker Reported CnC Server TCP group 17	49770	80	192.168.2.4	45.138.98.34
01/14/22-18:50:51.303705	TCP	2404338	ET CNC Feodo Tracker Reported CnC Server TCP group 20	49771	8080	192.168.2.4	69.16.218.101

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 18:50:50.021158934 CET	49770	80	192.168.2.4	45.138.98.34
Jan 14, 2022 18:50:50.038119078 CET	80	49770	45.138.98.34	192.168.2.4
Jan 14, 2022 18:50:50.591777086 CET	49770	80	192.168.2.4	45.138.98.34
Jan 14, 2022 18:50:50.608776093 CET	80	49770	45.138.98.34	192.168.2.4
Jan 14, 2022 18:50:51.279369116 CET	49770	80	192.168.2.4	45.138.98.34
Jan 14, 2022 18:50:51.298029900 CET	80	49770	45.138.98.34	192.168.2.4
Jan 14, 2022 18:50:51.303704977 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:51.431086063 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:51.431241035 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:51.456213951 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:51.582878113 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:51.595963001 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:51.595987082 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:51.596095085 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:55.157601118 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:55.284152985 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:55.284693003 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:55.284796000 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:55.288050890 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:55.414614916 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:56.054250002 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:56.054380894 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:59.054255962 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:59.054287910 CET	8080	49771	69.16.218.101	192.168.2.4
Jan 14, 2022 18:50:59.054326057 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:50:59.054374933 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:52:39.992589951 CET	49771	8080	192.168.2.4	69.16.218.101
Jan 14, 2022 18:52:39.992621899 CET	49771	8080	192.168.2.4	69.16.218.101

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 7128 Parent PID: 5400

General

Start time:	18:50:09
Start date:	14/01/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll"
Imagebase:	0x1230000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.720219818.0000000000DE0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.720240608.0000000000E11000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.722455601.0000000000E11000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.722263663.0000000000DE0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.742599060.0000000000DE0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 7148 Parent PID: 7128

General

Start time:	18:50:10
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 7160 Parent PID: 7128

General

Start time:	18:50:10
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\nV5Wu77N8J.dll
Imagebase:	0x20000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.669938310.0000000002541000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.669913455.0000000002510000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3296 Parent PID: 7148

General

Start time:	18:50:10
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",#1
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.670020972.0000000004740000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.670044528.0000000004771000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6244 Parent PID: 7128

General

Start time:	18:50:10
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nV5Wu77N8J.dll,DllRegisterServer
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719826672.00000000053B0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719773637.00000000052F1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719898030.0000000005510000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719919636.0000000005541000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719503580.0000000004C80000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719747240.00000000052B0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719938381.0000000005570000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.719857103.00000000053E1000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6192 Parent PID: 7160

General

Start time:	18:50:11
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6344 Parent PID: 3296

General

Start time:	18:50:11
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\nV5Wu77N8J.dll",DllRegisterServer
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.718904101.00000000034D0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.719243124.0000000005161000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.719379711.00000000052A1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.719211601.0000000005130000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.719345888.0000000005270000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.719316941.0000000005241000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.719284878.0000000005210000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5672 Parent PID: 568

General

Start time:	18:50:23
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5356 Parent PID: 6244

General

Start time:	18:50:34
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bdaefwhkzqb\lrinxnmhyts.ogu",XLurkV
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.723238837.0000000004750000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.723309788.0000000004781000.00000020.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6676 Parent PID: 568

General

Start time:	18:50:35
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6712 Parent PID: 6676

General

Start time:	18:50:36
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7128 -ip 7128
Imagebase:	0xcc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6040 Parent PID: 5356

General

Start time:	18:50:36
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Bdaefwhkzqb\lrinxnmhyts.ogu",DllRegisterServer
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188125968.00000000049D1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1190726376.00000000059A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1190213897.00000000057D1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188426833.0000000005110000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188330842.0000000005030000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188469714.0000000005141000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1186610997.0000000002E00000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188598739.00000000052A1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188659452.0000000005301000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188052400.00000000049A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1190813785.0000000005A20000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1190127401.00000000057A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188878871.00000000055E1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1186687872.0000000002E31000.00000020.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188363449.0000000005061000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1190848028.0000000005A51000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188631120.00000000052D0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188973289.00000000056F1000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188839400.00000000055B0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188934735.00000000056C0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1188553677.0000000005270000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000E.00000002.1190787571.00000000059D1000.00000020.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: WerFault.exe PID: 3660 Parent PID: 7128

General

Start time:	18:50:38
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 568
Imagebase:	0xcc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 808 Parent PID: 568

General

Start time:	18:50:40
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7064 Parent PID: 568

General

Start time:	18:50:58
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 4296 Parent PID: 568

General

Start time:	18:51:11
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: regsvr32.exe PID: 7160 Parent PID: 7128 regsvr32.exeCOMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.5%
Total number of Nodes:	1053
Total number of Limit Nodes:	38

Executed Functions

Function 10002D40, Relevance: 22.8, APIs: 15, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100024A0: SetLastError.KERNEL32(0000000D,?,?,10002D65,1001DF0A,00000040), ref: 100024B1

SetLastError.KERNEL32(000000C1,1001DF0A,00000040), ref: 10002D88

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6650c2dd50d65ac3f23d73d252b9ed4773b7d6bfb551cac519879840267a53eb
Instruction ID: 8eda3ac1f8f3e078098bdc719848e1594ce6d4798074e02e4610946cd2a58ef5
Opcode Fuzzy Hash: 6650c2dd50d65ac3f23d73d252b9ed4773b7d6bfb551cac519879840267a53eb
Instruction Fuzzy Hash: 7CE1E774A00209DFEB05CF94C994AAEB7B6FF8C344F208559E909AB399D770ED42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1002ADAC, Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(100863DC,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002ADBF
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004), ref: 1002AE15
GlobalHandle.KERNEL32(027A48A8), ref: 1002AE1E
GlobalUnlock.KERNEL32(00000000,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002AE28
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 1002AE41
GlobalHandle.KERNEL32(027A48A8), ref: 1002AE53
GlobalLock.KERNEL32 ref: 1002AE5A
LeaveCriticalSection.KERNEL32(?,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002AE63
GlobalLock.KERNEL32 ref: 1002AE6F
_memset.LIBCMT ref: 1002AE89
LeaveCriticalSection.KERNEL32(?), ref: 1002AEB7

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 0164f1c6eb9680f14c75084477ec16f681797b22eeba17cddfee44694ed90e92
Instruction ID: 1a22abfe9f33a297b41a0f192d06fc5d98366496c497f4e189800256e1e6bccf
Opcode Fuzzy Hash: 0164f1c6eb9680f14c75084477ec16f681797b22eeba17cddfee44694ed90e92
Instruction Fuzzy Hash: 1E31AD71600715AFEB21CF68DD89A1BBBF9FF46301B42892DE55AD3661DB30F8818B50

Uniqueness

Uniqueness Score: -1.00%

Function 1002E577, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 1002E595

Part of subcall function 10035865: __mtinitlocknum.LIBCMT ref: 1003587B
Part of subcall function 10035865: __amsg_exit.LIBCMT ref: 10035887
Part of subcall function 10035865: EnterCriticalSection.KERNEL32(00000000,00000000,?,1003481B,0000000D,1004E828,00000008,10034912,00000000,?,1002E9AC,00000000,?,?,?,1002EA0F), ref: 1003588F

___sbh_find_block.LIBCMT ref: 1002E5A0
___sbh_free_block.LIBCMT ref: 1002E5AF
RtlFreeHeap.NTDLL(00000000,00000000,1004E648,0000000C,10034761,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C), ref: 1002E5DF
GetLastError.KERNEL32(?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880,00000000,00000000,?,1003481B,0000000D), ref: 1002E5F0

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 4be1625d71f223fd5a529c098bfd6286ab20592f98f3d388c1b792f7bfa5bc77
Instruction ID: 15e9110145b1e9c1bde58837c3f2254f90dacbefcca8cfa7097211139088966e
Opcode Fuzzy Hash: 4be1625d71f223fd5a529c098bfd6286ab20592f98f3d388c1b792f7bfa5bc77
Instruction Fuzzy Hash: E001A7358567669EEB21DBB1AC0574D3BE4FF01796F900415F404AA4D1DF34AD40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 100036A0, Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 937
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 100036BB

Part of subcall function 1002E654: __FF_MSGBANNER.LIBCMT ref: 1002E677
Part of subcall function 1002E654: __NMSG_WRITE.LIBCMT ref: 1002E67E
Part of subcall function 1002E654: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880), ref: 1002E6CB

Strings

+';, xrefs: 100036A0

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID: +';
API String ID: 501242067-2694261586
Opcode ID: 0b326109276fce54ba6433786671c084a7be121183821a19a2d99cb653a252e6
Instruction ID: 8c5fde967666ed0afc5dc7c826d0591e9b318715144b3c37a2536eafdc0580d3
Opcode Fuzzy Hash: 0b326109276fce54ba6433786671c084a7be121183821a19a2d99cb653a252e6
Instruction Fuzzy Hash: 8FB21B369120218FE70ADFACDED5F257BA6F794608747B21FC4018737ADE306464CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 10003440, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100033F0: _malloc.LIBCMT ref: 100033F9

_malloc.LIBCMT ref: 100034B7

Strings

+';, xrefs: 10003440

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: _malloc
String ID: +';
API String ID: 1579825452-2694261586
Opcode ID: 03de1ce98db81d32a198f84050ea0a9e1233ff5b21d79efe49771c2647b1339e
Instruction ID: 6db3f6523064f320fd84e53d4013fc8a18f56f5699846b59c9fd9a4c566afa3d
Opcode Fuzzy Hash: 03de1ce98db81d32a198f84050ea0a9e1233ff5b21d79efe49771c2647b1339e
Instruction Fuzzy Hash: B891E770E04649AFDB09CF98C490AAEBBB2FF85345F24C199D915AB359C335AA90CF44

Uniqueness

Uniqueness Score: -1.00%

Function 10002690, Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000,?,10002928,00000001,00000000,?,100030A8,?,?,?,?,100030A8,00000000,00000000), ref: 10002704

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3c4ab6a1de08e5656c1cdd8e190091452f899426c6fe537940d40abfc070cfe1
Instruction ID: e47a27f64338b3e84d430cb899d867ed3d67d72a97b2c0655aeaec8263a425f7
Opcode Fuzzy Hash: 3c4ab6a1de08e5656c1cdd8e190091452f899426c6fe537940d40abfc070cfe1
Instruction Fuzzy Hash: 8841B77461410AAFEB48CF58C490BA9B7B2FB88364F14C659EC1A9F355C731EE41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 100024D0, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,1000303F,00000000), ref: 10002551
VirtualAlloc.KERNELBASE(4D8B0000,8B118BBC,00001000,00000004,1001DF0A,8B118BBC,?,1000303F,00000000,1001DF0A,?), ref: 100025CC

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d05fb9c1b52efa1b656e8a9f1121a2f78f34b5e3947038098bbbc68630c54fe
Instruction ID: f227e8c1e280d8d0b8d11f9a2f1445d4c625449e48c39147985fdcb30a9e5b67
Opcode Fuzzy Hash: 1d05fb9c1b52efa1b656e8a9f1121a2f78f34b5e3947038098bbbc68630c54fe
Instruction Fuzzy Hash: FE51E9B4A0010AEFDB04CF94C990AAEB7F1FF48345F248598E905AB345D370EE91CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 10024BD0, Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 10024BD7

Part of subcall function 10020421: _malloc.LIBCMT ref: 1002043F

Part of subcall function 1002AC5C: LocalAlloc.KERNEL32(00000040,?,?,1002AFE7,00000010,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004), ref: 1002AC66

Part of subcall function 100248E2: __EH_prolog3.LIBCMT ref: 100248E9

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocH_prolog3H_prolog3_catchLocal_malloc
String ID:
API String ID: 1104862767-0
Opcode ID: fd7fb294918823335492a66fe64f990aaa4eeed4153628f3b589ca3afe8965ee
Instruction ID: a1f779584784c66b6c6d6693aa33ee417c0f7bf9ec3ebef889974536428868aa
Opcode Fuzzy Hash: fd7fb294918823335492a66fe64f990aaa4eeed4153628f3b589ca3afe8965ee
Instruction Fuzzy Hash: 87317AB4A05B40CFD761CF69904125EFBF0FF94700FA08A1EA19A87791CB71A640CB15

Uniqueness

Uniqueness Score: -1.00%

Function 1001FB60, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memcpy_s.LIBCMT ref: 1001FBE6

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: d3dc88160a5e56be7f368e8a08c7792e6ef88e5c4e6cc4fd85bb2cebbcebf868
Instruction ID: f5ed4905dd4460340b5ac9a4a0a7973f6bbe06acb99917e18be8531ceafe8f55
Opcode Fuzzy Hash: d3dc88160a5e56be7f368e8a08c7792e6ef88e5c4e6cc4fd85bb2cebbcebf868
Instruction Fuzzy Hash: EA3197B4E0060ADFCB04DF98C891AAEB7B1FF88310F148699E915AB355D730AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1002B0BB, Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 1002B0C2

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: 4f981416dc5ef7bbdfecb2dfbb495584922b02ae1a1aa31fe3482948e2cc2218
Instruction ID: c80a5d1f5578f8721dbd374575b215f2d5835d67e27bcfac389e5dd05e3c6f9c
Opcode Fuzzy Hash: 4f981416dc5ef7bbdfecb2dfbb495584922b02ae1a1aa31fe3482948e2cc2218
Instruction Fuzzy Hash: FE017C386006438BDB26DF64DC6172E76E2EB843A1FA2442EE9518B291EF359D41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 10008000, Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000800B

Part of subcall function 1002E654: __FF_MSGBANNER.LIBCMT ref: 1002E677
Part of subcall function 1002E654: __NMSG_WRITE.LIBCMT ref: 1002E67E
Part of subcall function 1002E654: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880), ref: 1002E6CB

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 9844e1e0ea7d25e2d8370f8d0841ec7162df559c8b01d3b16c313ebecebe2b95
Instruction ID: 9a20b1d8cf5172607ffba420905976db52b7852b2de11c78eab645b8586f80a8
Opcode Fuzzy Hash: 9844e1e0ea7d25e2d8370f8d0841ec7162df559c8b01d3b16c313ebecebe2b95
Instruction Fuzzy Hash: BD012CB4D08158EBEB00CFA4D85569EBBB4FB00394F108895D9516B305D376AB18DB91

Uniqueness

Uniqueness Score: -1.00%

Function 100236CE, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 100236ED

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: f1b84940060e793f2024458e4c8e5a4687c3363722e5127f1986a87a664482b3
Instruction ID: 890261fd43258a4c098dfe067f91bb2ba3d5f49a8a728e9457d7994589d2c75f
Opcode Fuzzy Hash: f1b84940060e793f2024458e4c8e5a4687c3363722e5127f1986a87a664482b3
Instruction Fuzzy Hash: 4CE06D766006156BC700CB4AE408A46BBDCDFA13B0F56C466E808CB252CAB1E8048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1002ACFB, Relevance: 1.5, APIs: 1, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 1002AD02

Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6E5
Part of subcall function 1002A6AB: InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6F7
Part of subcall function 1002A6AB: LeaveCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A704
Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A714

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$H_prolog3_catchInitializeLeave
String ID:
API String ID: 1641187343-0
Opcode ID: 66fe0e46e7327439d87287bd7a4e421fc252772a67af4eb91e5b37aeeae1f300
Instruction ID: 3b67d6bb43f4ea54dfbebb57807521158ddd2742ca645746548a7aae3598e2fb
Opcode Fuzzy Hash: 66fe0e46e7327439d87287bd7a4e421fc252772a67af4eb91e5b37aeeae1f300
Instruction Fuzzy Hash: F3E04F386442069BE760DFA4D846B4DB6E0EF01762FA04628F9D1EB2C2DF70AD80DB15

Uniqueness

Uniqueness Score: -1.00%

Function 10035645, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,1002E896,00000001,?,?,?,1002EA0F,?,?,?,1004E6A8,0000000C,1002EACA), ref: 1003565A

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 11ed1c273bd328d3672869b0a3b6640a53f1cfb0cc5beffffd0de0ee24041fc5
Instruction ID: 0df5893edc33e170cd9319f6da52f4968d67da800731ff8b92bc7feba6a3d305
Opcode Fuzzy Hash: 11ed1c273bd328d3672869b0a3b6640a53f1cfb0cc5beffffd0de0ee24041fc5
Instruction Fuzzy Hash: 17D05E329507559EF7029F716C49B223BDCE384A96F048436F80CC61A0E670C6418A04

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1003C7D2, Relevance: 66.4, APIs: 44, Instructions: 432COMMON

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 1003C809
___getlocaleinfo.LIBCMT ref: 1003C81E
___getlocaleinfo.LIBCMT ref: 1003C833
___getlocaleinfo.LIBCMT ref: 1003C848
___getlocaleinfo.LIBCMT ref: 1003C860
___getlocaleinfo.LIBCMT ref: 1003C875
___getlocaleinfo.LIBCMT ref: 1003C887
___getlocaleinfo.LIBCMT ref: 1003C89C
___getlocaleinfo.LIBCMT ref: 1003C8B4
___getlocaleinfo.LIBCMT ref: 1003C8C9

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 140fc5ec8b9a87e1cb2285073580b9a6ca86accc3e2e9ca1bcb8d5ec2949de64
Instruction ID: b04c4d7f6a57d8df90e79b3f21b47685716bac7d418787b81275d3872e324d7c
Opcode Fuzzy Hash: 140fc5ec8b9a87e1cb2285073580b9a6ca86accc3e2e9ca1bcb8d5ec2949de64
Instruction Fuzzy Hash: 0DE1DDB294060DBEEF12CAE1CC85DFFB7BDFB04744F14096AB255E6041EA71AB059B60

Uniqueness

Uniqueness Score: -1.00%

Function 10001160, Relevance: 10.6, APIs: 7, Instructions: 71networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(?,?), ref: 10001194
_memset.LIBCMT ref: 100011A8
htonl.WS2_32(00000000), ref: 100011C1
htons.WS2_32(?), ref: 100011D5
socket.WS2_32(00000002,00000002,00000000), ref: 100011EB
bind.WS2_32(?,?,00000010), ref: 10001210
setsockopt.WS2_32(?,0000FFFF,00001006,00000001,00000008), ref: 10001252

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Startup_memsetbindhtonlhtonssetsockoptsocket
String ID:
API String ID: 1003240404-0
Opcode ID: 4267394abd7b2fe00b1ee463b318e0afc4881c9e2497cd05d0da4904e14a920c
Instruction ID: 8b71fe392eebb4791ef10e00b80357e65c28fbed0d3ec8f38f9f26760835bea4
Opcode Fuzzy Hash: 4267394abd7b2fe00b1ee463b318e0afc4881c9e2497cd05d0da4904e14a920c
Instruction Fuzzy Hash: D6317C74A01228AFE760CB54CC85BE9B7B4FF8A714F0041D8E949AB281CB71AD80DF55

Uniqueness

Uniqueness Score: -1.00%

Function 1002129B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 100212CD

Part of subcall function 100210FF: __CxxThrowException@8.LIBCMT ref: 10023B71
Part of subcall function 100210FF: __cftof.LIBCMT ref: 10023B88

Part of subcall function 10030D24: __getptd_noexit.LIBCMT ref: 10030D24

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 100212E5
__snwprintf_s.LIBCMT ref: 1002131A
LoadLibraryA.KERNEL32(?), ref: 10021355

Strings

LOC, xrefs: 100212C5

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Exception@8InfoLibraryLoadLocaleThrow__cftof__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1016519223-519433814
Opcode ID: 8ad2e179110c5fc4a63ba0c3a506fe82720806b71859df2b9a9481073aac2a1f
Instruction ID: e5882df6752d869781cd97db702e75e799ef83d3d4dcb43d327d0f518dc3dfd8
Opcode Fuzzy Hash: 8ad2e179110c5fc4a63ba0c3a506fe82720806b71859df2b9a9481073aac2a1f
Instruction Fuzzy Hash: A021063990121CAFDB11EBA0EC46BDD33EEEB05751F9004A1FA04DB491DB70AE45C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 1002DB0D, Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 10031D3A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10031D4F
UnhandledExceptionFilter.KERNEL32(10049478), ref: 10031D5A
GetCurrentProcess.KERNEL32(C0000409), ref: 10031D76
TerminateProcess.KERNEL32(00000000), ref: 10031D7D

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 71874975056eb2054f9aced908419e2b906654dc85cf8b7fbf46a45a6eae212a
Instruction ID: eb2889493d924e234dee94db6a5018ee6042f58a5b7914c10149dcbc3be7d463
Opcode Fuzzy Hash: 71874975056eb2054f9aced908419e2b906654dc85cf8b7fbf46a45a6eae212a
Instruction Fuzzy Hash: C8219AB8C01A24DFF742DF68DDC96883BB4FB1C345F52102AE9088B665E7B06985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 10027958, Relevance: 6.0, APIs: 4, Instructions: 42keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 1002A3F0: GetWindowLongA.USER32 ref: 1002A3FB

GetKeyState.USER32 ref: 1002797E
GetKeyState.USER32 ref: 10027987
GetKeyState.USER32 ref: 10027990
SendMessageA.USER32 ref: 100279A6

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: a9509507a0c3cd732412f6ac1bfcc6ca4a4eab2c6e7fc2ddd7a5ec5eb68b4cea
Instruction ID: a80f2be592eaa4d0f51a0e10a6f75c43a55355dd3138243e3a8160c71d5bf3bd
Opcode Fuzzy Hash: a9509507a0c3cd732412f6ac1bfcc6ca4a4eab2c6e7fc2ddd7a5ec5eb68b4cea
Instruction Fuzzy Hash: 0AF0E93A7C035B66EA10E6707C81F950814FF45BD4FC11431BF49EA1D2DFA0C89119B0

Uniqueness

Uniqueness Score: -1.00%

Function 10021183, Relevance: 4.5, APIs: 3, Instructions: 40COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,?,?,1002120D,00000000,00000000,?,?,1002189A,00000000,?,?,?,?,10021950,00000000), ref: 1002118E
LockResource.KERNEL32(00000000,?,?,1002120D,00000000,00000000,?,?,1002189A,00000000,?,?,?,?,10021950,00000000), ref: 1002119C
SizeofResource.KERNEL32(00000000,?,?,1002120D,00000000,00000000,?,?,1002189A,00000000,?,?,?,?,10021950,00000000), ref: 100211AE

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 8b420e262c7312fbbd320bda05a88a884026fa2b8a5d750ea2b9a6c299d0f1d4
Instruction ID: 5885e8a255633e1cc81cd5e62f2e9d9df206611330dfebe0406f5a0ab521e5b9
Opcode Fuzzy Hash: 8b420e262c7312fbbd320bda05a88a884026fa2b8a5d750ea2b9a6c299d0f1d4
Instruction Fuzzy Hash: 7FF0F03A60013BA7CF219F69FC044E97BD5FF107E67414425FEA9C2060E231D870D680

Uniqueness

Uniqueness Score: -1.00%

Function 100250A3, Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3cc7cabb4d58ad44b84df687ee6d4ed92987b137f1ec63db657d71093bb1ad
Instruction ID: 0d7c4b7ad1d73a1697217a780c63f05e975ccc5f711293de909a3a3b9b9d2103
Opcode Fuzzy Hash: 8d3cc7cabb4d58ad44b84df687ee6d4ed92987b137f1ec63db657d71093bb1ad
Instruction Fuzzy Hash: 16F0A431600109ABDF11DF60DD88A9E7FB8FF05346F908021FC1AC5061DB32CA55EB99

Uniqueness

Uniqueness Score: -1.00%

Function 100291F6, Relevance: 2.0, APIs: 1, Instructions: 452COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100291FD

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 1217f1ca601d0389ec3f5c1c288cc429db0f350fe1057340691c20e11584fb44
Instruction ID: 7aa724dcfe317f1d1dbd5d4486dba1b6deee93e66c4b17b022368e02ca0af700
Opcode Fuzzy Hash: 1217f1ca601d0389ec3f5c1c288cc429db0f350fe1057340691c20e11584fb44
Instruction Fuzzy Hash: AAF18F74600219EFDF15CF54E880EAE7BE9FF08390F918559F8199B292DB34EA11DB60

Uniqueness

Uniqueness Score: -1.00%

Function 10001280, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,00000400,00000000,?,00000010), ref: 100012CF

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: recvfrom
String ID:
API String ID: 846543921-0
Opcode ID: cdd5b8fa6bd2be514b31e1496784718f03a02615474b077ae9b11ea931df357f
Instruction ID: 69fb0fddd724ab168ece224e86e76236123086ad7b1ad86b3e1ae6067053412b
Opcode Fuzzy Hash: cdd5b8fa6bd2be514b31e1496784718f03a02615474b077ae9b11ea931df357f
Instruction Fuzzy Hash: 1B0125B5A0011C9FDB14CF58CD54BEEBBB9FF88304F4045A9E609A7241D7B46A84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1002FBA4, Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: e461c5ceb4082b2a3bfba79310045b5265001ed38dfd5d36d50f4efd431a1f71
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 7BD16273C0A5F30A87B6C52D516823EEEA2AFC26D136BC7F59CE02F28A91275D1095D0

Uniqueness

Uniqueness Score: -1.00%

Function 1002F784, Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: e099078e729fc0aa79c9c736f0f3383331c6c98ba1816dfa590606459c4e72e6
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 6FD14F73C0A9F30A83B5C52D616823AEEA2AFC16D036BC7F59CE43F289D6275D0495D0

Uniqueness

Uniqueness Score: -1.00%

Function 1002F378, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 0249e3902306f3ab000ed27b9437b08394f89c485674606c9f26e524861a3e45
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: C0C15073C0A9F30A83B5C52D615823AEEA2AFC16D136BC7F5DCE43F28992276D0595D0

Uniqueness

Uniqueness Score: -1.00%

Function 100214CB, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100214D5
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,1002179C,?,?), ref: 10021505
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 10021519
ConvertDefaultLocale.KERNEL32(?), ref: 10021555
ConvertDefaultLocale.KERNEL32(?), ref: 10021563
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 10021580
ConvertDefaultLocale.KERNEL32(?), ref: 100215AB
ConvertDefaultLocale.KERNEL32(000003FF), ref: 100215B4
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 100215CD
EnumResourceLanguagesA.KERNEL32 ref: 100215EA
ConvertDefaultLocale.KERNEL32(?), ref: 1002161D
ConvertDefaultLocale.KERNEL32(00000000), ref: 10021626
GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 10021669
_memset.LIBCMT ref: 10021689

Strings

ntdll.dll, xrefs: 100215C8
GetSystemDefaultUILanguage, xrefs: 10021565
kernel32.dll, xrefs: 100214EE
GetUserDefaultUILanguage, xrefs: 1002150D

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: 482ed3ff8adc9dfca9f4a6a5a3eecf6aee0f7f9e6cd518195f59097e54c4c985
Instruction ID: 3754a4cc769aa270db1ce7901eb040107ed5b3d0b04ae9dca27c5b132e5f9257
Opcode Fuzzy Hash: 482ed3ff8adc9dfca9f4a6a5a3eecf6aee0f7f9e6cd518195f59097e54c4c985
Instruction Fuzzy Hash: 77515974C002289BCB61DF659C44BEDBAF4EB59300F5002EAE988E3291DB749E81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 10034610, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,1004E800,0000000C,1003474B,00000000,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C), ref: 10034622
__crt_waiting_on_module_handle.LIBCMT ref: 1003462D

Part of subcall function 1003065C: Sleep.KERNEL32(000003E8,00000000,?,10034573,KERNEL32.DLL,?,?,10034907,00000000,?,1002E9AC,00000000,?,?,?,1002EA0F), ref: 10030668
Part of subcall function 1003065C: GetModuleHandleW.KERNEL32(00000000,?,10034573,KERNEL32.DLL,?,?,10034907,00000000,?,1002E9AC,00000000,?,?,?,1002EA0F,?), ref: 10030671

GetProcAddress.KERNEL32(00000000,EncodePointer,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880,00000000,00000000), ref: 10034656
GetProcAddress.KERNEL32(00000000,DecodePointer,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880,00000000,00000000), ref: 10034666
__lock.LIBCMT ref: 10034688
InterlockedIncrement.KERNEL32(?), ref: 10034695
__lock.LIBCMT ref: 100346A9
___addlocaleref.LIBCMT ref: 100346C7

Strings

EncodePointer, xrefs: 1003464A
KERNEL32.DLL, xrefs: 1003461C, 10034621, 1003462C
DecodePointer, xrefs: 1003465E

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 5b83938148a6bc88c1e014cfaa9ba3fc415054042f6b227dce2f604cd513625e
Instruction ID: 0d6301bb9ab871ffe84231295dfe76788f8a31cd98ef4b571f500b89faff28c9
Opcode Fuzzy Hash: 5b83938148a6bc88c1e014cfaa9ba3fc415054042f6b227dce2f604cd513625e
Instruction Fuzzy Hash: 1C11AF79801741AFE711CF79CD42B8ABBF0EF45311F214969E499EB2A0CB74AA40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 10020C3F, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 10020C68
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 10020C85
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 10020C92
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 10020C9F
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 10020CAC

Strings

ReleaseActCtx, xrefs: 10020C87
CreateActCtxA, xrefs: 10020C7F
DeactivateActCtx, xrefs: 10020CA1
ActivateActCtx, xrefs: 10020C94
KERNEL32, xrefs: 10020C63

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: dac128db901c47e6bb8252af25d8797b23f4122bed0c2a723d77acf103c536fb
Instruction ID: 164c5ab3b4a161f1fd64f3c59e5fc8043f34cbc47aed943c162e41eaa6e30758
Opcode Fuzzy Hash: dac128db901c47e6bb8252af25d8797b23f4122bed0c2a723d77acf103c536fb
Instruction Fuzzy Hash: 621130F1C002A19BDB11DF99ADC484ABFE9F656240363427FF218D3221EB708854CE17

Uniqueness

Uniqueness Score: -1.00%

Function 10043A65, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10043A6C
std::_Lockit::_Lockit.LIBCPMT ref: 10043A76
int.LIBCPMT ref: 10043A8D

Part of subcall function 100427A3: std::_Lockit::_Lockit.LIBCPMT ref: 100427B6

std::locale::_Getfacet.LIBCPMT ref: 10043A96
ctype.LIBCPMT ref: 10043AB0
std::bad_exception::bad_exception.LIBCMT ref: 10043AC4
__CxxThrowException@8.LIBCMT ref: 10043AD2
std::locale::facet::_Incref.LIBCPMT ref: 10043AE2
std::locale::facet::facet_Register.LIBCPMT ref: 10043AE8

Strings

bad cast, xrefs: 10043ABC

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 2535038987-3145022300
Opcode ID: 3269a5203a73611e901993287b551c215e6cb5b556df1f504442498d94acef6b
Instruction ID: 41e516e335ea381e6c6cf3992b6e31462ccd823a1db2d0b16548d00875c41f3f
Opcode Fuzzy Hash: 3269a5203a73611e901993287b551c215e6cb5b556df1f504442498d94acef6b
Instruction Fuzzy Hash: 7E01C039D401699BCB02DBA4DC42AEE7375FF84760F724129F110EB1D1DF74AA008799

Uniqueness

Uniqueness Score: -1.00%

Function 1002341C, Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 10023423
FindResourceA.KERNEL32(?,?,00000005), ref: 10023456
LoadResource.KERNEL32(?,00000000), ref: 1002345E

Part of subcall function 100275EC: UnhookWindowsHookEx.USER32(?), ref: 1002761C

LockResource.KERNEL32(?,00000024,1000150C,00000000,2B815A64), ref: 1002346F
GetDesktopWindow.USER32 ref: 100234A2
IsWindowEnabled.USER32(?), ref: 100234B0
EnableWindow.USER32(?,00000000), ref: 100234BF

Part of subcall function 1002A492: IsWindowEnabled.USER32(?), ref: 1002A49B

Part of subcall function 1002A4AD: EnableWindow.USER32(?,00000000), ref: 1002A4BE

EnableWindow.USER32(?,00000001), ref: 100235A4
GetActiveWindow.USER32 ref: 100235AF
SetActiveWindow.USER32(?,?,00000024,1000150C,00000000,2B815A64), ref: 100235BD
FreeResource.KERNEL32(?,?,00000024,1000150C,00000000,2B815A64), ref: 100235D9

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 9f51e5419fd464f8870fff1869e5699930f25b995303faded1736d57e07594c8
Instruction ID: c961092801c59ee9409441e3dbe49a4a333b051d42b2e552560430daa244bbc0
Opcode Fuzzy Hash: 9f51e5419fd464f8870fff1869e5699930f25b995303faded1736d57e07594c8
Instruction Fuzzy Hash: AA51A034A00B15DFDF11DFA4E9856AEBBF0FF48711F904029E54AA21A1CB719E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 1002B9A0, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 1002B9C8
GetStockObject.GDI32(0000000D), ref: 1002B9D0
GetObjectA.GDI32(00000000,0000003C,?), ref: 1002B9DD
GetDC.USER32(00000000), ref: 1002B9EC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1002BA00
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 1002BA0C
ReleaseDC.USER32 ref: 1002BA18

Strings

System, xrefs: 1002B9C3, 1002BA2D

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 95aa6347fd842ffca335552be3f3c7f3934e69caa990673b5ebc058802f1fbd6
Instruction ID: 22c60c461008f25a8b5f8ebf610b65477afa905285395b5dac6d7a6a43a1c48b
Opcode Fuzzy Hash: 95aa6347fd842ffca335552be3f3c7f3934e69caa990673b5ebc058802f1fbd6
Instruction Fuzzy Hash: F611C171A01228EBEB10DBA5DD89FAE7BB8FF05781F400015FA05E61C1DB709D01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1001E790, Relevance: 13.6, APIs: 9, Instructions: 105windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 1001E7D5
SendMessageA.USER32 ref: 1001E7FB
SendMessageA.USER32 ref: 1001E815
SendMessageA.USER32 ref: 1001E839
SendMessageA.USER32 ref: 1001E86E
SendMessageA.USER32 ref: 1001E888
SendMessageA.USER32 ref: 1001E8A4
SendMessageA.USER32 ref: 1001E8BD
SendMessageA.USER32 ref: 1001E8DB

Part of subcall function 1001E520: _strlen.LIBCMT ref: 1001E5FA
Part of subcall function 1001E520: _strlen.LIBCMT ref: 1001E614

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$_strlen
String ID:
API String ID: 3697954797-0
Opcode ID: 50909218d121ae73ae8b47ddfd2900abd0d565cb3fc4bb7cb040f620d48819e1
Instruction ID: 0edfc11e8551d9ebf0957f65f3a3322fb23760369c1f09792b2f79df2d73aaf8
Opcode Fuzzy Hash: 50909218d121ae73ae8b47ddfd2900abd0d565cb3fc4bb7cb040f620d48819e1
Instruction Fuzzy Hash: 22413A74F00306ABE704CF94CD85FAEB7B5FB88B41F208159FA19AB291C670A941DB54

Uniqueness

Uniqueness Score: -1.00%

Function 10001920, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 10001982

Strings

ios_base::eofbit set, xrefs: 10001A88
ios_base::failbit set, xrefs: 10001A1E
ios_base::badbit set, xrefs: 100019A3

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 51a00e0988f626f2dae953a8ada664ba94390563386f7a615b68e84484e52bf4
Instruction ID: 1c38ab3b2c14ee1c247bdf225933c46791fcea5bd7c47801f16d03e79e27f587
Opcode Fuzzy Hash: 51a00e0988f626f2dae953a8ada664ba94390563386f7a615b68e84484e52bf4
Instruction Fuzzy Hash: 29518A34904688EEDB14DFA0CC85BDDB7B1EF45300F6081ADE5056B285CBB46E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1002102D, Relevance: 12.1, APIs: 8, Instructions: 66memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 1002104C
lstrcmpA.KERNEL32(?,?), ref: 10021058
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 1002106A
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1002108A
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 10021092
GlobalLock.KERNEL32 ref: 1002109C
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 100210A9
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 100210C1

Part of subcall function 1002A801: GlobalFlags.KERNEL32(?), ref: 1002A810
Part of subcall function 1002A801: GlobalUnlock.KERNEL32(?,?,?,?,10021A27,?,00000214,1000148F), ref: 1002A822
Part of subcall function 1002A801: GlobalFree.KERNEL32 ref: 1002A82D

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 85f582fc0fa2d760b393ed167a5d421003042f2adcf672044b7dbfb8b9eda5cc
Instruction ID: 1e26f6493bbdf61cc617228eadb58d3a13350607a0778397bdab265459f41c03
Opcode Fuzzy Hash: 85f582fc0fa2d760b393ed167a5d421003042f2adcf672044b7dbfb8b9eda5cc
Instruction Fuzzy Hash: 6E11E079600640BBDB228BA5CD89DAFBAFDFB867407500529F605D2020DA72ED81DB64

Uniqueness

Uniqueness Score: -1.00%

Function 1002A98E, Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 1002A99D
GetSystemMetrics.USER32 ref: 1002A9A4
GetSystemMetrics.USER32 ref: 1002A9AB
GetSystemMetrics.USER32 ref: 1002A9B5
GetDC.USER32(00000000), ref: 1002A9BF
GetDeviceCaps.GDI32(00000000,00000058), ref: 1002A9D0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1002A9D8
ReleaseDC.USER32 ref: 1002A9E0

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: 97df97701bdba165d7bd0f3935d33a7940ab39bf43f5bcde9822dd001b09b376
Instruction ID: 4b18a5fc2a191a652713761d43d2b2da4b0cc28fbe92607e78cb1662e9ca01b2
Opcode Fuzzy Hash: 97df97701bdba165d7bd0f3935d33a7940ab39bf43f5bcde9822dd001b09b376
Instruction Fuzzy Hash: 0CF0F9B1E40724BAF7105F728C89B167EA8FB49761F004456E6199B281DAB599118FD0

Uniqueness

Uniqueness Score: -1.00%

Function 1002B84C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 1002B878
lstrlenA.KERNEL32(?), ref: 1002B8C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 1002B8DD
_wcslen.LIBCMT ref: 1002B901

Strings

System, xrefs: 1002B874

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWide_wcslenlstrlen
String ID: System
API String ID: 4253822919-3470857405
Opcode ID: d5816cacfd0a332e5282f5be394baf9a0c0f2a364455dc9baade1f500cebd3c2
Instruction ID: 7b5a175680f670ca79b6c2ec9272e95e82f354ff2106dbd97111df154043a3f4
Opcode Fuzzy Hash: d5816cacfd0a332e5282f5be394baf9a0c0f2a364455dc9baade1f500cebd3c2
Instruction Fuzzy Hash: C8412671D00619DFDB14CFA4DC85AAEBBB9FF04310F64812AE516EB285E770AD85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 100270BC, Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 100270EF
PeekMessageA.USER32(00000024,00000000,00000000,00000000,00000000), ref: 10027113
UpdateWindow.USER32(?), ref: 1002712E
SendMessageA.USER32 ref: 1002714F
SendMessageA.USER32 ref: 10027167
UpdateWindow.USER32(?), ref: 100271AA
PeekMessageA.USER32(00000024,00000000,00000000,00000000,00000000), ref: 100271DB

Part of subcall function 1002A3F0: GetWindowLongA.USER32 ref: 1002A3FB

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 5e6b9223f0a1804046a8fbfe378e80d9714a9eacbb44f0fef3914e7058a9bdf9
Instruction ID: e439185c47b7e5e34c348b8e0b3dbe5bb3c4b57b45cec7e657144295835a6737
Opcode Fuzzy Hash: 5e6b9223f0a1804046a8fbfe378e80d9714a9eacbb44f0fef3914e7058a9bdf9
Instruction Fuzzy Hash: 9041C370E00246EBDB11CF69DC84E9FBBF8FF82B81F90815DE949A2150D7719A50DB10

Uniqueness

Uniqueness Score: -1.00%

Function 10027676, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10027705
SendMessageA.USER32 ref: 1002772E
GetWindowLongA.USER32 ref: 10027740
GetWindowLongA.USER32 ref: 10027751
SetWindowLongA.USER32 ref: 1002776D

Strings

,, xrefs: 10027724

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: ,
API String ID: 2997958587-3772416878
Opcode ID: 1276ef7f4d5813a713450155f5ae2d4635a7a3024c65db1a6c5f2f6a990dd864
Instruction ID: f848ae84a4977e1a31b52bc52376e27e10e8709ed1b3efe9ee7841c93cdd6a05
Opcode Fuzzy Hash: 1276ef7f4d5813a713450155f5ae2d4635a7a3024c65db1a6c5f2f6a990dd864
Instruction Fuzzy Hash: 1431C134600B119FC715DF78E888A6AB7F5FF48350B92056DE58997691DB70E800CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1002245E, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10022468
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 1002254E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 1002256B
RegCloseKey.ADVAPI32(?), ref: 1002258B
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 100225A6

Strings

Software\, xrefs: 100224CC

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseEnumH_prolog3_OpenQueryValue
String ID: Software\
API String ID: 1666054129-964853688
Opcode ID: 3dcc581e61560c1b2a89a559af4b2aadf043690cbf44cd43855230fa8fe55520
Instruction ID: 3764a028f082780bf1b34d3e1a3aecc110f1b9c57831791e493d608046546682
Opcode Fuzzy Hash: 3dcc581e61560c1b2a89a559af4b2aadf043690cbf44cd43855230fa8fe55520
Instruction Fuzzy Hash: 3C41AC35800128EBCB22DBA0CC81AEEB3B8FF49310F5045D9F249E2191DB34AB958F94

Uniqueness

Uniqueness Score: -1.00%

Function 100222E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 100222EA
RegOpenKeyA.ADVAPI32(?,?,?), ref: 10022378
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 1002239B

Part of subcall function 1002228B: __EH_prolog3.LIBCMT ref: 10022292

Strings

Software\Classes\, xrefs: 1002232B

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: EnumH_prolog3H_prolog3_catch_Open
String ID: Software\Classes\
API String ID: 3518408925-1121929649
Opcode ID: 148a9a07ce493e8523daa3725bf67091589f603dbf0392a59fe7285a5da600ad
Instruction ID: 704202dc6e21b2fa8b48efa6eea704b7fc6a1643c8ca87a9ade3220d51c06aab
Opcode Fuzzy Hash: 148a9a07ce493e8523daa3725bf67091589f603dbf0392a59fe7285a5da600ad
Instruction Fuzzy Hash: A1317C36C00068EBDB22EBA4CD44BDDB6B8FB09350F5141D5F999A3252DA306FA49F91

Uniqueness

Uniqueness Score: -1.00%

Function 1002B26C, Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 1002B279
SendMessageA.USER32 ref: 1002B294
GetFocus.USER32 ref: 1002B2A9
SendMessageA.USER32 ref: 1002B2B7
GetLastActivePopup.USER32(?), ref: 1002B2E0
SendMessageA.USER32 ref: 1002B2ED

Part of subcall function 1002881E: GetWindowLongA.USER32 ref: 10028844
Part of subcall function 1002881E: GetParent.USER32(?), ref: 10028852

SendMessageA.USER32 ref: 1002B313

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
String ID:
API String ID: 3338174999-0
Opcode ID: 8b045ddbd33b9174f1829eda3b456e63d99d5e6e5f6e5226114c782d6a6a23be
Instruction ID: 3a08670cfc868389e080b955865bcb0f045f405a5b874c30a2897e43bb08e3ed
Opcode Fuzzy Hash: 8b045ddbd33b9174f1829eda3b456e63d99d5e6e5f6e5226114c782d6a6a23be
Instruction Fuzzy Hash: 7F1146B590065AFFEB11DFA1DD8AC9E7E7CEF41788B910075F504A2121EB719F04AB20

Uniqueness

Uniqueness Score: -1.00%

Function 1002AAF8, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 1002AB28
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 1002AB4B
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 1002AB67
RegCloseKey.ADVAPI32(?), ref: 1002AB77
RegCloseKey.ADVAPI32(?), ref: 1002AB81

Strings

software, xrefs: 1002AB10

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: ccb9b6360ff57769a68f726ed1728c19480870e0bb9bbd8d9feb64ffad4441d4
Instruction ID: fb36ca9c2f952ecb3db15ddf6cda8d32fba402c4719dfc4725c3bd37d29a496b
Opcode Fuzzy Hash: ccb9b6360ff57769a68f726ed1728c19480870e0bb9bbd8d9feb64ffad4441d4
Instruction Fuzzy Hash: 6B11E672900158FBDB11DB9ADD88CDFBFBDEB8A750B5000AAF504A2122D7319E44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1002B00C, Relevance: 10.6, APIs: 7, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?), ref: 1002B013
__CxxThrowException@8.LIBCMT ref: 1002B01D

Part of subcall function 100312CD: RaiseException.KERNEL32(?,?,1004B6B4,1004F1B8,?,?,?,100203CA,1004B6B4,1004F1B8,00000000,00000000), ref: 1003130F

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004), ref: 1002B034
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461,00000000), ref: 1002B041

Part of subcall function 10023B23: __CxxThrowException@8.LIBCMT ref: 10023B39

_memset.LIBCMT ref: 1002B060
TlsSetValue.KERNEL32(?,00000000), ref: 1002B071
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461,00000000), ref: 1002B092

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: 57ffba166e203e5f771fa8df9200c34d4f09cabdb1cbb7fcc74f3b72e3f2cbe0
Instruction ID: 36d3102e2cb30bc4552268f57227952f3745dc8c02fd82b3b9104c669509b869
Opcode Fuzzy Hash: 57ffba166e203e5f771fa8df9200c34d4f09cabdb1cbb7fcc74f3b72e3f2cbe0
Instruction Fuzzy Hash: DC115E74100605AFD725EF64DCC5D2BBBB9FF453107A0C529F969D6522CB30AC24CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1002A948, Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 1002A956
GetSysColor.USER32(00000010), ref: 1002A95D
GetSysColor.USER32(00000014), ref: 1002A964
GetSysColor.USER32(00000012), ref: 1002A96B
GetSysColor.USER32(00000006), ref: 1002A972
GetSysColorBrush.USER32(0000000F), ref: 1002A97F
GetSysColorBrush.USER32(00000006), ref: 1002A986

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 2aeb855fe3a01d91a1c159618acf838dda1bc2281205f0400994082937ea778a
Instruction ID: 2de359d209fd3f7b37bcce9053ec3ec9da3e309d31870537ed148616a4e248d0
Opcode Fuzzy Hash: 2aeb855fe3a01d91a1c159618acf838dda1bc2281205f0400994082937ea778a
Instruction Fuzzy Hash: 0BF0FE719407445BD730BF724E49B47BAD1FFC4710F02092EE2458B990D6B6E441DF44

Uniqueness

Uniqueness Score: -1.00%

Function 10023266, Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 1002326D
GlobalLock.KERNEL32 ref: 10023345
CreateDialogIndirectParamA.USER32(?,?,?,10022CA4,00000000), ref: 10023374
DestroyWindow.USER32(00000000,?,1000150C,00000000,2B815A64), ref: 100233EE
GlobalUnlock.KERNEL32(?,?,1000150C,00000000,2B815A64), ref: 100233FE
GlobalFree.KERNEL32 ref: 10023407

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: 888fa3cfcf776247989f330621f25040a0e9d6be9df16a9d0be9406a16dfc2c2
Instruction ID: 542586d5134ef99c8f61472b69a72313b72e87743f096b2e8f632b75dff3f323
Opcode Fuzzy Hash: 888fa3cfcf776247989f330621f25040a0e9d6be9df16a9d0be9406a16dfc2c2
Instruction Fuzzy Hash: DD519B31A0024AEFCB04DFA4E9859AEBBB5EF04350F95442DF506E7292CB70AA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10037738, Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 10037760

Part of subcall function 10030430: __getptd.LIBCMT ref: 1003043E
Part of subcall function 10030430: __getptd.LIBCMT ref: 1003044C

__getptd.LIBCMT ref: 1003776A

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 10037778
__getptd.LIBCMT ref: 10037786
__getptd.LIBCMT ref: 10037791
_CallCatchBlock2.LIBCMT ref: 100377B7

Part of subcall function 100304D5: __CallSettingFrame@12.LIBCMT ref: 10030521

Part of subcall function 1003785E: __getptd.LIBCMT ref: 1003786D
Part of subcall function 1003785E: __getptd.LIBCMT ref: 1003787B

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 46636e942f87dcca0c30cf7feca0092d3b0ea187b49415045ba274b669f62aa0
Instruction ID: fb1f34f9027f5a0fd6fb665b034cbc12c1ee6665b85233a2d450c333db5c1a8f
Opcode Fuzzy Hash: 46636e942f87dcca0c30cf7feca0092d3b0ea187b49415045ba274b669f62aa0
Instruction Fuzzy Hash: 4F1104B9C04249EFDB01DFA4D945AEE7BB1FF08315F508469F814AB251DB38AA11DF90

Uniqueness

Uniqueness Score: -1.00%

Function 1002A8D2, Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 1002A8E3
GetDlgCtrlID.USER32 ref: 1002A8F7
GetWindowLongA.USER32 ref: 1002A907
GetWindowRect.USER32 ref: 1002A919
PtInRect.USER32(?,?,?), ref: 1002A929
GetWindow.USER32(?,00000005), ref: 1002A936

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: f0130467347104804c256745cbc3b6b13c5e57ae72556175195e5c4804d3d92f
Instruction ID: abcb09268cf445b2c35b0e2b56c0cfd5e9caec1888beec0722017402bcd9ce52
Opcode Fuzzy Hash: f0130467347104804c256745cbc3b6b13c5e57ae72556175195e5c4804d3d92f
Instruction Fuzzy Hash: FC018F32500126BBEB219F559D48EAF3BACFF463A1F414165FD15D6060DB30DA829A98

Uniqueness

Uniqueness Score: -1.00%

Function 10020982, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 1002099A
_memset.LIBCMT ref: 10020A12
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 10020A75
LoadBitmapA.USER32 ref: 10020A8D

Strings

, xrefs: 100209F3

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: 33d2bf27483d04382989d274a53bbefd1c41525da4d7f4bc6e43fef10d3baaa5
Instruction ID: 8ec26202c106691d72478eed222520a6e30d1cb825b7d1c94e22465ec1c68f9d
Opcode Fuzzy Hash: 33d2bf27483d04382989d274a53bbefd1c41525da4d7f4bc6e43fef10d3baaa5
Instruction Fuzzy Hash: BD312772A003669FFB10CF289CC5B9D7BB5FB44340F9540AAF549EB182DA709E848B50

Uniqueness

Uniqueness Score: -1.00%

Function 10025110, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 10025150
GetSystemMetrics.USER32 ref: 10025168
GetSystemMetrics.USER32 ref: 1002516F

Strings

DISPLAY, xrefs: 1002518C
B, xrefs: 1002512F

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: b6b25803d1236a503b5fcdcee7e41ccf2bd8b680c30ee70901717e7f43f6efc3
Instruction ID: b60a64a5d5410e3ad8fe5a59109b18ab5d44eebb328e5d1eff8611f1e2dd37b9
Opcode Fuzzy Hash: b6b25803d1236a503b5fcdcee7e41ccf2bd8b680c30ee70901717e7f43f6efc3
Instruction Fuzzy Hash: 4511E771901334AFEB52DF64DC85B9B7BA8EF45791F414061FD0AAE006D672D910CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 10037474, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1003748E

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 1003749F
__getptd.LIBCMT ref: 100374AD

Strings

csm, xrefs: 10037487
MOC, xrefs: 10037480

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: e3b2ebf427159775b670ccfe04d8264cb15add95c28ba503ee76d0db9538cd89
Instruction ID: 4aa484bfd58dbd3435781d5c114dead901570b21edfee72e4775129354a6ca63
Opcode Fuzzy Hash: e3b2ebf427159775b670ccfe04d8264cb15add95c28ba503ee76d0db9538cd89
Instruction Fuzzy Hash: 59E012395142448FC322DA64D046B283AE4FB4A216F5A04A1E54C8F223CB38F8809692

Uniqueness

Uniqueness Score: -1.00%

Function 1002A742, Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 1002A76E
_memset.LIBCMT ref: 1002A78B
GetWindowTextA.USER32 ref: 1002A7A5
lstrcmpA.KERNEL32(00000000,?), ref: 1002A7B7
SetWindowTextA.USER32(?,?), ref: 1002A7C3

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: TextWindow$Exception@8Throw_memsetlstrcmplstrlen
String ID:
API String ID: 289641511-0
Opcode ID: eba42bef06e1ea26d0eb59e6d93e6a074b965602a881250286a8b19bcf32aa76
Instruction ID: 26b6340e82542b1e4468bed3117474a07e50960d7f5f1af9f26f2e201bf88dc7
Opcode Fuzzy Hash: eba42bef06e1ea26d0eb59e6d93e6a074b965602a881250286a8b19bcf32aa76
Instruction Fuzzy Hash: 6201C4B6600224ABEB11DB64AEC4BDA77BCEB56750F410062FA05D3141DA709E8487A4

Uniqueness

Uniqueness Score: -1.00%

Function 1003303D, Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10033049

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__amsg_exit.LIBCMT ref: 10033069
__lock.LIBCMT ref: 10033079
InterlockedDecrement.KERNEL32(?), ref: 10033096
InterlockedIncrement.KERNEL32(04231600), ref: 100330C1

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: b7e179927d4189d82ebcc7d242cd09fbde42b95b3021a06d9a3f9b095d1226b3
Instruction ID: 0569f5a3ac8da4acb0d1a986d046cd977373cb471ce5986ef029c0716cf573c4
Opcode Fuzzy Hash: b7e179927d4189d82ebcc7d242cd09fbde42b95b3021a06d9a3f9b095d1226b3
Instruction Fuzzy Hash: 6701AD35E01B61AFE716DB68889675E77A0FF01BA2F018205F910AF3A1CB347850CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 10043707, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 1004370E
_Fputc.LIBCPMT ref: 10043762
_Fputc.LIBCPMT ref: 10043890

Strings

, xrefs: 1004381A

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Fputc$H_prolog3_
String ID:
API String ID: 2569218679-3916222277
Opcode ID: 958f7fde8cf3934525be4b4590de41da191db7979d055f19d5a6abdfe82d0e64
Instruction ID: 327ff4da5823006f03605dc28747a7ba7b3d1cf190d8e7353a19ee1d8cd02c88
Opcode Fuzzy Hash: 958f7fde8cf3934525be4b4590de41da191db7979d055f19d5a6abdfe82d0e64
Instruction Fuzzy Hash: 74515CB6A046489BCB29CBA4C8919DEB7B5EF48310F31D539F552E7291EF70B808CB54

Uniqueness

Uniqueness Score: -1.00%

Function 10028683, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6E5
Part of subcall function 1002A6AB: InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6F7
Part of subcall function 1002A6AB: LeaveCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A704
Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A714

Part of subcall function 1002ACFB: __EH_prolog3_catch.LIBCMT ref: 1002AD02

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

GetProcAddress.KERNEL32(00000000,HtmlHelpA,10027AEC,0000000C), ref: 100286CC
FreeLibrary.KERNEL32(?), ref: 100286DC

Strings

hhctrl.ocx, xrefs: 100286B0
HtmlHelpA, xrefs: 100286C6

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 3274081130-63838506
Opcode ID: 7eafd78b95f4e71f9a7c2a9e0d78888fac0c88a0cb5b3df1705197983d44129d
Instruction ID: 005129d9915a41a8e27983cdb1c3ef0c0b08f3353e048253c6f2f10206dc3ba7
Opcode Fuzzy Hash: 7eafd78b95f4e71f9a7c2a9e0d78888fac0c88a0cb5b3df1705197983d44129d
Instruction Fuzzy Hash: 7D01AD39001A07ABD722DB60FD09B4B3BD4EF04751F90882AFA5AA5462DB70E9509B59

Uniqueness

Uniqueness Score: -1.00%

Function 10037AE5, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 10037AF8

Part of subcall function 10037A53: ___BuildCatchObjectHelper.LIBCMT ref: 10037A89

_UnwindNestedFrames.LIBCMT ref: 10037B0F
___FrameUnwindToState.LIBCMT ref: 10037B1D

Strings

csm, xrefs: 10037AF4, 10037B09, 10037B1C, 10037B3A, 10037B4A

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: f195471c9651215b8799b1dff3133e99b074ac86d89a3ab6fa62fa96ed46b13b
Instruction ID: f623d6fd13c583f27d9dc74078cf60041b57e54907eb0ea25ac4e83ce510980d
Opcode Fuzzy Hash: f195471c9651215b8799b1dff3133e99b074ac86d89a3ab6fa62fa96ed46b13b
Instruction Fuzzy Hash: 1301E475001109BFDF239E51CC41EAB7FAAFF08392F108014BD1C19121D736E9A1EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1003B6EA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,1003198E), ref: 1003B6EF
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 1003B6FF

Strings

IsProcessorFeaturePresent, xrefs: 1003B6F9
KERNEL32, xrefs: 1003B6EA

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: b625c795e4b14fe0a5397004e64ae313e176778416d8ae412e329f0da2c945c9
Instruction ID: 1963b1661ff3506828beccd1ed570aedb4cc9858b4c3caadb466faf93440aec0
Opcode Fuzzy Hash: b625c795e4b14fe0a5397004e64ae313e176778416d8ae412e329f0da2c945c9
Instruction Fuzzy Hash: FAF09030D0090DE6EF006BA1AE4A2AF7BB8FB8134AF9204A0E295F0094CF30C074C345

Uniqueness

Uniqueness Score: -1.00%

Function 10003190, Relevance: 6.4, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 100031BF
SetLastError.KERNEL32(0000007F), ref: 100031EB

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: be243d1140ffaf3f5c0c670d3f2cc449d13f2587e7475c66dd1e7082ab2392ba
Instruction ID: 4eaf8ab176a3ef0a7f39cefad6a7452b8358f787e5b85b158199dac7f5a3fe15
Opcode Fuzzy Hash: be243d1140ffaf3f5c0c670d3f2cc449d13f2587e7475c66dd1e7082ab2392ba
Instruction Fuzzy Hash: D051E770E0415ADFEB05CF98C981AAEB7F5FF48344F2085A9E815AB349D734EA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10043370, Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10043377
_fgetc.LIBCMT ref: 100434AD

Part of subcall function 100432DD: std::_String_base::_Xlen.LIBCPMT ref: 100432F3

_memcpy_s.LIBCMT ref: 10043472
_ungetc.LIBCMT ref: 100434F8

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: H_prolog3_String_base::_Xlen_fgetc_memcpy_s_ungetcstd::_
String ID:
API String ID: 9762108-0
Opcode ID: 99201e9437667c55015348abdb3458414e8582c21c8e059d90a996027ebc780c
Instruction ID: 13a944e20a8a26727cade03676e391ccd69925211a3dd35b2a339be84363c332
Opcode Fuzzy Hash: 99201e9437667c55015348abdb3458414e8582c21c8e059d90a996027ebc780c
Instruction Fuzzy Hash: CF515C76A006089FCB15DBB4C8919DEB7B9FF48210F70953AE552E7191EE60F908CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1002B564, Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__msize.LIBCMT ref: 1002B5F7
__msize.LIBCMT ref: 1002B61A
_malloc.LIBCMT ref: 1002B632
_malloc.LIBCMT ref: 1002B647

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: e7775de412d4773406d2d7f9127a0febec078a8c984ec9c0c9f408937bca0ff2
Instruction ID: c06ad2b89a0fc854e88fd2117b33bcd0e6f9c9f7914c74f6532cfdf5cd9cd5d6
Opcode Fuzzy Hash: e7775de412d4773406d2d7f9127a0febec078a8c984ec9c0c9f408937bca0ff2
Instruction Fuzzy Hash: 9D218231600E249FCB55EF30F8C9A5A77E5EF04790BD18519E8598B256DF34ECA0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 100210FF, Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 10023B39
__CxxThrowException@8.LIBCMT ref: 10023B55
__CxxThrowException@8.LIBCMT ref: 10023B71
__cftof.LIBCMT ref: 10023B88

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Exception@8Throw$__cftof
String ID:
API String ID: 887240167-0
Opcode ID: 4211e913ba8b62f1cad3a260a4951dcfba4da381e4675b2fc4cd124fb216e819
Instruction ID: 16327421f0b36ea26aeda1f7d289ca1428dc81c908886c4e3e3252d19e74a35c
Opcode Fuzzy Hash: 4211e913ba8b62f1cad3a260a4951dcfba4da381e4675b2fc4cd124fb216e819
Instruction Fuzzy Hash: 6201C07980024CBB8B11DE899C46CDF7BEDEA88250BB00152FB19C3501DAB1EE20D2A2

Uniqueness

Uniqueness Score: -1.00%

Function 10023180, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 100231A8
LoadResource.KERNEL32(?,00000000), ref: 100231B0
LockResource.KERNEL32(00000000), ref: 100231C2
FreeResource.KERNEL32(00000000), ref: 10023210

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 8904d22b2e9766e214ab266f9aec4827302d519ac8e5ca81d82e01921d4caf04
Instruction ID: 7117f4333b49b93e9e103224ba76a384f5f6927333c7ffee97ba62033829b48c
Opcode Fuzzy Hash: 8904d22b2e9766e214ab266f9aec4827302d519ac8e5ca81d82e01921d4caf04
Instruction Fuzzy Hash: 3D110134500761EFD714CF99D988AAAB7F8FF00399F51C429E84283550D770ED58DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100217AE, Relevance: 6.1, APIs: 4, Instructions: 57threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100217B5

Part of subcall function 1002299D: __EH_prolog3.LIBCMT ref: 100229A4

__strdup.LIBCMT ref: 100217D7
GetCurrentThread.KERNEL32 ref: 10021804
GetCurrentThreadId.KERNEL32 ref: 1002180D

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 81573f6a70f85e6e6b71bd66fb05b0a7947cee5f3eccb4cfcc9ed85a086636bb
Instruction ID: 63c4b4d8ed515ebd67a2d3fac6e93b486822e3c8ffac095a61f99a1b17b282e6
Opcode Fuzzy Hash: 81573f6a70f85e6e6b71bd66fb05b0a7947cee5f3eccb4cfcc9ed85a086636bb
Instruction Fuzzy Hash: EC217DB8801B408EC321DF6A958124AFBF4FFA4600F50891FE5AAC7A22DBB4A441CF44

Uniqueness

Uniqueness Score: -1.00%

Function 10029178, Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 100291A4
SendMessageA.USER32 ref: 100291CF
GetCapture.USER32 ref: 100291E1
SendMessageA.USER32 ref: 100291F0

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 088ca0eca7ffd53ce47653328526b22f7a75d7299b8dffa12b2224c673d87500
Instruction ID: 9d500238946ec194ad8ffa17e766443115c43433aa0eeb43828134f684b4c91a
Opcode Fuzzy Hash: 088ca0eca7ffd53ce47653328526b22f7a75d7299b8dffa12b2224c673d87500
Instruction Fuzzy Hash: 8A0175713402557BDA205B629CCDF9B3E7AEBCAF50F510478F6089A0A7CAA14800D620

Uniqueness

Uniqueness Score: -1.00%

Function 1002ABD3, Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 1002AC0E
RegCloseKey.ADVAPI32(00000000), ref: 1002AC17
swprintf.LIBCMT ref: 1002AC34
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 1002AC45

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: c84d023a091e3481915df690cb6fa3c091d1dd2ebdb2df30426c6b2c34bdf920
Instruction ID: b3e5ac37a67a2c34724f7244494befea3428c85a23c18ad1ae006fcf60cdee60
Opcode Fuzzy Hash: c84d023a091e3481915df690cb6fa3c091d1dd2ebdb2df30426c6b2c34bdf920
Instruction Fuzzy Hash: C901ED76500218ABDB10DF688D85FAF77ACEB49714F51082AFA01E3141DB74ED0487A8

Uniqueness

Uniqueness Score: -1.00%

Function 10027839, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 10027846
GetTopWindow.USER32(00000000), ref: 10027859

Part of subcall function 10027839: GetWindow.USER32(00000000,00000002), ref: 100278A0

GetTopWindow.USER32(?), ref: 10027889

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 3cb82c9a8c8603e496fbf3d62de3cfdf58aa9b4925ce369bf6021e639fee71c7
Instruction ID: f10d52d962ac960512d7384eec108a680d17f64428226a36a785d2fcb99e30ea
Opcode Fuzzy Hash: 3cb82c9a8c8603e496fbf3d62de3cfdf58aa9b4925ce369bf6021e639fee71c7
Instruction Fuzzy Hash: F301A23618166ABBCB229F51AC08E8F3A99FF417E0F814021FD0C91111DF31D911D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 1003B5D6, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 1003B5FC

Part of subcall function 1003B421: __fltout2.LIBCMT ref: 1003B44D

__cftog_l.LIBCMT ref: 1003B622
__cftoe_l.LIBCMT ref: 1003B654

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 1693f95a625ffde70028128af171decd196e1ba2c6c978d497889c3db2691634
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 85117E3680054ABFCF139E80CC028EE3F62FB09299F548415FF1958032C736D9B1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 1002A257, Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 1002A27D
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,10023139,?,?,1001DF61), ref: 1002A289
LockResource.KERNEL32(00000000,?,?,?,?,?,10023139,?,?,1001DF61), ref: 1002A296
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,10023139,?,?,1001DF61), ref: 1002A2B2

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: feba8fe24ac97258290d34300adbce18e9849086dee679fc7f85b56fb59f0c30
Instruction ID: f3c4c51c49c486de2effa8659e681593a38c79611994fd5387b39b2d60b42ad5
Opcode Fuzzy Hash: feba8fe24ac97258290d34300adbce18e9849086dee679fc7f85b56fb59f0c30
Instruction Fuzzy Hash: B5F0C237200316BBD7019FAD9DC4A6B77ADEF866A17524038FE09D3210DE71DD448AB4

Uniqueness

Uniqueness Score: -1.00%

Function 10001310, Relevance: 6.0, APIs: 4, Instructions: 41networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000132B
inet_addr.WS2_32(?), ref: 10001340
htons.WS2_32(?), ref: 1000134E
sendto.WS2_32(?,?,?,00000000,?,00000010), ref: 1000136F

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: _memsethtonsinet_addrsendto
String ID:
API String ID: 1158618643-0
Opcode ID: c3eaa792e2cc8573930c6e3819606380beb20a92460ab2a72e807829517de2d8
Instruction ID: 60f6b611a07b9dfdfd37c1fffb937be7e3926c5419f3fbf29161148c0f489d21
Opcode Fuzzy Hash: c3eaa792e2cc8573930c6e3819606380beb20a92460ab2a72e807829517de2d8
Instruction Fuzzy Hash: 7A015E75900208ABDB00DFA4C986BBF77B8FF48700F504459F90597281E770AA10DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10023584, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 100235A4
GetActiveWindow.USER32 ref: 100235AF
SetActiveWindow.USER32(?,?,00000024,1000150C,00000000,2B815A64), ref: 100235BD
FreeResource.KERNEL32(?,?,00000024,1000150C,00000000,2B815A64), ref: 100235D9

Part of subcall function 1002A4AD: EnableWindow.USER32(?,00000000), ref: 1002A4BE

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 2c836dbf06692eee7363ec98f3d2861cbecdd6f5195fecbca41b8321f8fae3dc
Instruction ID: 11aa7c219ea7ea27b38022f450b92876966fee3fb2bcd7a89944b049f6e30275
Opcode Fuzzy Hash: 2c836dbf06692eee7363ec98f3d2861cbecdd6f5195fecbca41b8321f8fae3dc
Instruction Fuzzy Hash: 83F01934900B28CBDF12EF64D9855AD77B1FF88B02B900425E446B2161CB326E80CA65

Uniqueness

Uniqueness Score: -1.00%

Function 100337CF, Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 100337DB

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 100337F2
__amsg_exit.LIBCMT ref: 10033800
__lock.LIBCMT ref: 10033810

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 56a1e1e41ab0af4027642382f4b576c173bb85e7d626fa8461ae6f1c5f148875
Instruction ID: dae39449bd8c003bde3e62b30ea038717af1cc855304bc2085dea34c93cae8e5
Opcode Fuzzy Hash: 56a1e1e41ab0af4027642382f4b576c173bb85e7d626fa8461ae6f1c5f148875
Instruction Fuzzy Hash: 72F06D7E909700AFE362DB74844674A37E0EF00762F118619B4419F3A1CF34B900CA91

Uniqueness

Uniqueness Score: -1.00%

Function 1002173A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 10021762
PathFindExtensionA.SHLWAPI(?), ref: 10021778

Part of subcall function 100214CB: __EH_prolog3_GS.LIBCMT ref: 100214D5
Part of subcall function 100214CB: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,1002179C,?,?), ref: 10021505
Part of subcall function 100214CB: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 10021519
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(?), ref: 10021555
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(?), ref: 10021563
Part of subcall function 100214CB: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 10021580
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(?), ref: 100215AB
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(000003FF), ref: 100215B4
Part of subcall function 100214CB: GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 10021669

Strings

%s%s.dll, xrefs: 10021781

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: 06773c07019d6f4b52aa5f2187269cd07d01a6017d615c8e4409f9f105a9a11d
Instruction ID: cb1c0cb3582a3260588f521687d4e0582820240ed98e8e3d3c47ebba61cd8817
Opcode Fuzzy Hash: 06773c07019d6f4b52aa5f2187269cd07d01a6017d615c8e4409f9f105a9a11d
Instruction Fuzzy Hash: DA01D1759002289FDB10DB28DD45AEF77FCEB85700F4104A6E505E7150EA70AE04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1003785E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10030483: __getptd.LIBCMT ref: 10030489
Part of subcall function 10030483: __getptd.LIBCMT ref: 10030499

__getptd.LIBCMT ref: 1003786D

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 1003787B

Strings

csm, xrefs: 10037889

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 51da8c13634b056fff6b854f5948755b110b34fcd4bcc67fefb372d20441b29d
Instruction ID: 9bdde97464bd0678537997cb56ba83c365607814a506e3d314dec82bc4d239b5
Opcode Fuzzy Hash: 51da8c13634b056fff6b854f5948755b110b34fcd4bcc67fefb372d20441b29d
Instruction Fuzzy Hash: 5C014B38841245CECB36CFA0D8446AEB7F6FF08253F51442EE0495EAA1DF30EA81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 10002AB0, Relevance: 5.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(00000000,00000014,?,?,?,?,1000308E,00000000,00000000), ref: 10002B05
SetLastError.KERNEL32(0000007E), ref: 10002B47

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 97caa88e84ccd89aa93ae28ac998ff8c0d132747f048963a4391c92f1473f43e
Instruction ID: 796d6741741126c51599b2b906ad2ab7a2c15db3fbae67425d52538266fc70d6
Opcode Fuzzy Hash: 97caa88e84ccd89aa93ae28ac998ff8c0d132747f048963a4391c92f1473f43e
Instruction Fuzzy Hash: C38182B4A00209DFEB04CF94C981A9EB7B1FF88354F248559E819AB355D735EE82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1002A6AB, Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6E5
InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6F7
LeaveCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A704
EnterCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A714

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

Memory Dump Source

Source File: 00000002.00000002.670087441.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.670081674.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670121747.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.670130141.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670135461.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.670159582.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670165094.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.670171210.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8InitializeLeaveThrow
String ID:
API String ID: 3253506028-0
Opcode ID: feb1692b13d847297fc57938e43eb050cd6bddea5eb79fc1efedc9f05588c2f0
Instruction ID: 3062035623b9543bfb964b4a27d18fc4dd6f5ea10993a44c93a1de297aa0e807
Opcode Fuzzy Hash: feb1692b13d847297fc57938e43eb050cd6bddea5eb79fc1efedc9f05588c2f0
Instruction Fuzzy Hash: 48F09672900355AFEB009F68DCCCB09B7AAFBD6261FDB0017F14486122DF3499C5CAA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 3296 Parent PID: 7148 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	452
Total number of Limit Nodes:	17

Executed Functions

Function 10002D40, Relevance: 22.8, APIs: 15, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100024A0: SetLastError.KERNEL32(0000000D,?,?,10002D65,1001DF0A,00000040), ref: 100024B1

SetLastError.KERNEL32(000000C1,1001DF0A,00000040), ref: 10002D88

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6650c2dd50d65ac3f23d73d252b9ed4773b7d6bfb551cac519879840267a53eb
Instruction ID: 8eda3ac1f8f3e078098bdc719848e1594ce6d4798074e02e4610946cd2a58ef5
Opcode Fuzzy Hash: 6650c2dd50d65ac3f23d73d252b9ed4773b7d6bfb551cac519879840267a53eb
Instruction Fuzzy Hash: 7CE1E774A00209DFEB05CF94C994AAEB7B6FF8C344F208559E909AB399D770ED42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1002ADAC, Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(100863DC,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002ADBF
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004), ref: 1002AE15
GlobalHandle.KERNEL32(02D80630), ref: 1002AE1E
GlobalUnlock.KERNEL32(00000000,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002AE28
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 1002AE41
GlobalHandle.KERNEL32(02D80630), ref: 1002AE53
GlobalLock.KERNEL32 ref: 1002AE5A
LeaveCriticalSection.KERNEL32(?,?,?,?,100863C0,100863C0,?,1002B10F,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002AE63
GlobalLock.KERNEL32 ref: 1002AE6F
_memset.LIBCMT ref: 1002AE89
LeaveCriticalSection.KERNEL32(?), ref: 1002AEB7

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 0164f1c6eb9680f14c75084477ec16f681797b22eeba17cddfee44694ed90e92
Instruction ID: 1a22abfe9f33a297b41a0f192d06fc5d98366496c497f4e189800256e1e6bccf
Opcode Fuzzy Hash: 0164f1c6eb9680f14c75084477ec16f681797b22eeba17cddfee44694ed90e92
Instruction Fuzzy Hash: 1E31AD71600715AFEB21CF68DD89A1BBBF9FF46301B42892DE55AD3661DB30F8818B50

Uniqueness

Uniqueness Score: -1.00%

Function 1002E577, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 1002E595

Part of subcall function 10035865: __mtinitlocknum.LIBCMT ref: 1003587B
Part of subcall function 10035865: __amsg_exit.LIBCMT ref: 10035887
Part of subcall function 10035865: EnterCriticalSection.KERNEL32(00000000,00000000,?,1003481B,0000000D,1004E828,00000008,10034912,00000000,?,1002E9AC,00000000,?,?,?,1002EA0F), ref: 1003588F

___sbh_find_block.LIBCMT ref: 1002E5A0
___sbh_free_block.LIBCMT ref: 1002E5AF
RtlFreeHeap.NTDLL(00000000,00000000,1004E648,0000000C,10034761,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C), ref: 1002E5DF
GetLastError.KERNEL32(?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880,00000000,00000000,?,1003481B,0000000D), ref: 1002E5F0

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 4be1625d71f223fd5a529c098bfd6286ab20592f98f3d388c1b792f7bfa5bc77
Instruction ID: 15e9110145b1e9c1bde58837c3f2254f90dacbefcca8cfa7097211139088966e
Opcode Fuzzy Hash: 4be1625d71f223fd5a529c098bfd6286ab20592f98f3d388c1b792f7bfa5bc77
Instruction Fuzzy Hash: E001A7358567669EEB21DBB1AC0574D3BE4FF01796F900415F404AA4D1DF34AD40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 100036A0, Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 937
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 100036BB

Part of subcall function 1002E654: __FF_MSGBANNER.LIBCMT ref: 1002E677
Part of subcall function 1002E654: __NMSG_WRITE.LIBCMT ref: 1002E67E
Part of subcall function 1002E654: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880), ref: 1002E6CB

Strings

+';, xrefs: 100036A0

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID: +';
API String ID: 501242067-2694261586
Opcode ID: 0b326109276fce54ba6433786671c084a7be121183821a19a2d99cb653a252e6
Instruction ID: 8c5fde967666ed0afc5dc7c826d0591e9b318715144b3c37a2536eafdc0580d3
Opcode Fuzzy Hash: 0b326109276fce54ba6433786671c084a7be121183821a19a2d99cb653a252e6
Instruction Fuzzy Hash: 8FB21B369120218FE70ADFACDED5F257BA6F794608747B21FC4018737ADE306464CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 10003440, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100033F0: _malloc.LIBCMT ref: 100033F9

_malloc.LIBCMT ref: 100034B7

Strings

+';, xrefs: 10003440

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _malloc
String ID: +';
API String ID: 1579825452-2694261586
Opcode ID: 03de1ce98db81d32a198f84050ea0a9e1233ff5b21d79efe49771c2647b1339e
Instruction ID: 6db3f6523064f320fd84e53d4013fc8a18f56f5699846b59c9fd9a4c566afa3d
Opcode Fuzzy Hash: 03de1ce98db81d32a198f84050ea0a9e1233ff5b21d79efe49771c2647b1339e
Instruction Fuzzy Hash: B891E770E04649AFDB09CF98C490AAEBBB2FF85345F24C199D915AB359C335AA90CF44

Uniqueness

Uniqueness Score: -1.00%

Function 10002690, Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000,?,10002928,00000001,00000000,?,100030A8,?,?,?,?,100030A8,00000000,00000000), ref: 10002704

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3c4ab6a1de08e5656c1cdd8e190091452f899426c6fe537940d40abfc070cfe1
Instruction ID: e47a27f64338b3e84d430cb899d867ed3d67d72a97b2c0655aeaec8263a425f7
Opcode Fuzzy Hash: 3c4ab6a1de08e5656c1cdd8e190091452f899426c6fe537940d40abfc070cfe1
Instruction Fuzzy Hash: 8841B77461410AAFEB48CF58C490BA9B7B2FB88364F14C659EC1A9F355C731EE41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 100024D0, Relevance: 2.6, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,1000303F,00000000), ref: 10002551
VirtualAlloc.KERNELBASE(4D8B0000,8B118BBC,00001000,00000004,1001DF0A,8B118BBC,?,1000303F,00000000,1001DF0A,?), ref: 100025CC

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d05fb9c1b52efa1b656e8a9f1121a2f78f34b5e3947038098bbbc68630c54fe
Instruction ID: f227e8c1e280d8d0b8d11f9a2f1445d4c625449e48c39147985fdcb30a9e5b67
Opcode Fuzzy Hash: 1d05fb9c1b52efa1b656e8a9f1121a2f78f34b5e3947038098bbbc68630c54fe
Instruction Fuzzy Hash: FE51E9B4A0010AEFDB04CF94C990AAEB7F1FF48345F248598E905AB345D370EE91CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 10024BD0, Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 10024BD7

Part of subcall function 10020421: _malloc.LIBCMT ref: 1002043F

Part of subcall function 1002AC5C: LocalAlloc.KERNEL32(00000040,?,?,1002AFE7,00000010,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004), ref: 1002AC66

Part of subcall function 100248E2: __EH_prolog3.LIBCMT ref: 100248E9

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocH_prolog3H_prolog3_catchLocal_malloc
String ID:
API String ID: 1104862767-0
Opcode ID: fd7fb294918823335492a66fe64f990aaa4eeed4153628f3b589ca3afe8965ee
Instruction ID: a1f779584784c66b6c6d6693aa33ee417c0f7bf9ec3ebef889974536428868aa
Opcode Fuzzy Hash: fd7fb294918823335492a66fe64f990aaa4eeed4153628f3b589ca3afe8965ee
Instruction Fuzzy Hash: 87317AB4A05B40CFD761CF69904125EFBF0FF94700FA08A1EA19A87791CB71A640CB15

Uniqueness

Uniqueness Score: -1.00%

Function 1001FB60, Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memcpy_s.LIBCMT ref: 1001FBE6

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: d3dc88160a5e56be7f368e8a08c7792e6ef88e5c4e6cc4fd85bb2cebbcebf868
Instruction ID: f5ed4905dd4460340b5ac9a4a0a7973f6bbe06acb99917e18be8531ceafe8f55
Opcode Fuzzy Hash: d3dc88160a5e56be7f368e8a08c7792e6ef88e5c4e6cc4fd85bb2cebbcebf868
Instruction Fuzzy Hash: EA3197B4E0060ADFCB04DF98C891AAEB7B1FF88310F148699E915AB355D730AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1002B0BB, Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 1002B0C2

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: 4f981416dc5ef7bbdfecb2dfbb495584922b02ae1a1aa31fe3482948e2cc2218
Instruction ID: c80a5d1f5578f8721dbd374575b215f2d5835d67e27bcfac389e5dd05e3c6f9c
Opcode Fuzzy Hash: 4f981416dc5ef7bbdfecb2dfbb495584922b02ae1a1aa31fe3482948e2cc2218
Instruction Fuzzy Hash: FE017C386006438BDB26DF64DC6172E76E2EB843A1FA2442EE9518B291EF359D41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 10008000, Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000800B

Part of subcall function 1002E654: __FF_MSGBANNER.LIBCMT ref: 1002E677
Part of subcall function 1002E654: __NMSG_WRITE.LIBCMT ref: 1002E67E
Part of subcall function 1002E654: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880), ref: 1002E6CB

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 9844e1e0ea7d25e2d8370f8d0841ec7162df559c8b01d3b16c313ebecebe2b95
Instruction ID: 9a20b1d8cf5172607ffba420905976db52b7852b2de11c78eab645b8586f80a8
Opcode Fuzzy Hash: 9844e1e0ea7d25e2d8370f8d0841ec7162df559c8b01d3b16c313ebecebe2b95
Instruction Fuzzy Hash: BD012CB4D08158EBEB00CFA4D85569EBBB4FB00394F108895D9516B305D376AB18DB91

Uniqueness

Uniqueness Score: -1.00%

Function 100236CE, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 100236ED

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: f1b84940060e793f2024458e4c8e5a4687c3363722e5127f1986a87a664482b3
Instruction ID: 890261fd43258a4c098dfe067f91bb2ba3d5f49a8a728e9457d7994589d2c75f
Opcode Fuzzy Hash: f1b84940060e793f2024458e4c8e5a4687c3363722e5127f1986a87a664482b3
Instruction Fuzzy Hash: 4CE06D766006156BC700CB4AE408A46BBDCDFA13B0F56C466E808CB252CAB1E8048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1002ACFB, Relevance: 1.5, APIs: 1, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 1002AD02

Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6E5
Part of subcall function 1002A6AB: InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6F7
Part of subcall function 1002A6AB: LeaveCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A704
Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A714

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$H_prolog3_catchInitializeLeave
String ID:
API String ID: 1641187343-0
Opcode ID: 66fe0e46e7327439d87287bd7a4e421fc252772a67af4eb91e5b37aeeae1f300
Instruction ID: 3b67d6bb43f4ea54dfbebb57807521158ddd2742ca645746548a7aae3598e2fb
Opcode Fuzzy Hash: 66fe0e46e7327439d87287bd7a4e421fc252772a67af4eb91e5b37aeeae1f300
Instruction Fuzzy Hash: F3E04F386442069BE760DFA4D846B4DB6E0EF01762FA04628F9D1EB2C2DF70AD80DB15

Uniqueness

Uniqueness Score: -1.00%

Function 10035645, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,1002E896,00000001,?,?,?,1002EA0F,?,?,?,1004E6A8,0000000C,1002EACA), ref: 1003565A

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 11ed1c273bd328d3672869b0a3b6640a53f1cfb0cc5beffffd0de0ee24041fc5
Instruction ID: 0df5893edc33e170cd9319f6da52f4968d67da800731ff8b92bc7feba6a3d305
Opcode Fuzzy Hash: 11ed1c273bd328d3672869b0a3b6640a53f1cfb0cc5beffffd0de0ee24041fc5
Instruction Fuzzy Hash: 17D05E329507559EF7029F716C49B223BDCE384A96F048436F80CC61A0E670C6418A04

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1003C7D2, Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 1003C809
___getlocaleinfo.LIBCMT ref: 1003C81E
___getlocaleinfo.LIBCMT ref: 1003C833
___getlocaleinfo.LIBCMT ref: 1003C848
___getlocaleinfo.LIBCMT ref: 1003C860
___getlocaleinfo.LIBCMT ref: 1003C875
___getlocaleinfo.LIBCMT ref: 1003C887
___getlocaleinfo.LIBCMT ref: 1003C89C
___getlocaleinfo.LIBCMT ref: 1003C8B4
___getlocaleinfo.LIBCMT ref: 1003C8C9

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 140fc5ec8b9a87e1cb2285073580b9a6ca86accc3e2e9ca1bcb8d5ec2949de64
Instruction ID: b04c4d7f6a57d8df90e79b3f21b47685716bac7d418787b81275d3872e324d7c
Opcode Fuzzy Hash: 140fc5ec8b9a87e1cb2285073580b9a6ca86accc3e2e9ca1bcb8d5ec2949de64
Instruction Fuzzy Hash: 0DE1DDB294060DBEEF12CAE1CC85DFFB7BDFB04744F14096AB255E6041EA71AB059B60

Uniqueness

Uniqueness Score: -1.00%

Function 10001160, Relevance: 10.6, APIs: 7, Instructions: 71networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(?,?), ref: 10001194
_memset.LIBCMT ref: 100011A8
htonl.WS2_32(00000000), ref: 100011C1
htons.WS2_32(?), ref: 100011D5
socket.WS2_32(00000002,00000002,00000000), ref: 100011EB
bind.WS2_32(?,?,00000010), ref: 10001210
setsockopt.WS2_32(?,0000FFFF,00001006,00000001,00000008), ref: 10001252

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Startup_memsetbindhtonlhtonssetsockoptsocket
String ID:
API String ID: 1003240404-0
Opcode ID: 4267394abd7b2fe00b1ee463b318e0afc4881c9e2497cd05d0da4904e14a920c
Instruction ID: 8b71fe392eebb4791ef10e00b80357e65c28fbed0d3ec8f38f9f26760835bea4
Opcode Fuzzy Hash: 4267394abd7b2fe00b1ee463b318e0afc4881c9e2497cd05d0da4904e14a920c
Instruction Fuzzy Hash: D6317C74A01228AFE760CB54CC85BE9B7B4FF8A714F0041D8E949AB281CB71AD80DF55

Uniqueness

Uniqueness Score: -1.00%

Function 1001DFC0, Relevance: 9.1, APIs: 6, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 1001DFE3

Part of subcall function 10024266: __EH_prolog3.LIBCMT ref: 1002426D
Part of subcall function 10024266: BeginPaint.USER32(?,?,00000004,10022D30,?,00000058,1001E0C9), ref: 10024299

SendMessageA.USER32 ref: 1001E031
GetSystemMetrics.USER32 ref: 1001E039
GetSystemMetrics.USER32 ref: 1001E044
GetClientRect.USER32 ref: 1001E05B
DrawIcon.USER32 ref: 1001E0AE

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: MetricsSystem$BeginClientDrawH_prolog3IconIconicMessagePaintRectSend
String ID:
API String ID: 1007970657-0
Opcode ID: 3259dfba3eec98d8480867ab092ef1825236dcdbd4a97db3d006f8f0a7e1c205
Instruction ID: 44eb2ef316f0b933980e992ec3fa30d6a4f6e9fba2b57c8abd37e2d05c6bd9c1
Opcode Fuzzy Hash: 3259dfba3eec98d8480867ab092ef1825236dcdbd4a97db3d006f8f0a7e1c205
Instruction Fuzzy Hash: 4A31EA75A00119DFDB24CFA8C985FAEBBB5FB48300F108299E549E7241DA30AE84DF54

Uniqueness

Uniqueness Score: -1.00%

Function 1002129B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 100212CD

Part of subcall function 100210FF: __CxxThrowException@8.LIBCMT ref: 10023B71
Part of subcall function 100210FF: __cftof.LIBCMT ref: 10023B88

Part of subcall function 10030D24: __getptd_noexit.LIBCMT ref: 10030D24

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 100212E5
__snwprintf_s.LIBCMT ref: 1002131A
LoadLibraryA.KERNEL32(?), ref: 10021355

Strings

LOC, xrefs: 100212C5

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8InfoLibraryLoadLocaleThrow__cftof__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1016519223-519433814
Opcode ID: 8ad2e179110c5fc4a63ba0c3a506fe82720806b71859df2b9a9481073aac2a1f
Instruction ID: e5882df6752d869781cd97db702e75e799ef83d3d4dcb43d327d0f518dc3dfd8
Opcode Fuzzy Hash: 8ad2e179110c5fc4a63ba0c3a506fe82720806b71859df2b9a9481073aac2a1f
Instruction Fuzzy Hash: A021063990121CAFDB11EBA0EC46BDD33EEEB05751F9004A1FA04DB491DB70AE45C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 1002DB0D, Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 10031D3A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10031D4F
UnhandledExceptionFilter.KERNEL32(10049478), ref: 10031D5A
GetCurrentProcess.KERNEL32(C0000409), ref: 10031D76
TerminateProcess.KERNEL32(00000000), ref: 10031D7D

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 71874975056eb2054f9aced908419e2b906654dc85cf8b7fbf46a45a6eae212a
Instruction ID: eb2889493d924e234dee94db6a5018ee6042f58a5b7914c10149dcbc3be7d463
Opcode Fuzzy Hash: 71874975056eb2054f9aced908419e2b906654dc85cf8b7fbf46a45a6eae212a
Instruction Fuzzy Hash: C8219AB8C01A24DFF742DF68DDC96883BB4FB1C345F52102AE9088B665E7B06985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 10027958, Relevance: 6.0, APIs: 4, Instructions: 42keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 1002A3F0: GetWindowLongA.USER32 ref: 1002A3FB

GetKeyState.USER32 ref: 1002797E
GetKeyState.USER32 ref: 10027987
GetKeyState.USER32 ref: 10027990
SendMessageA.USER32 ref: 100279A6

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: a9509507a0c3cd732412f6ac1bfcc6ca4a4eab2c6e7fc2ddd7a5ec5eb68b4cea
Instruction ID: a80f2be592eaa4d0f51a0e10a6f75c43a55355dd3138243e3a8160c71d5bf3bd
Opcode Fuzzy Hash: a9509507a0c3cd732412f6ac1bfcc6ca4a4eab2c6e7fc2ddd7a5ec5eb68b4cea
Instruction Fuzzy Hash: 0AF0E93A7C035B66EA10E6707C81F950814FF45BD4FC11431BF49EA1D2DFA0C89119B0

Uniqueness

Uniqueness Score: -1.00%

Function 10024F01, Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10024F24
GetVersionExA.KERNEL32(?), ref: 10024F3D

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Version_memset
String ID:
API String ID: 963298953-0
Opcode ID: 261500b53b9fbffb2ab7006eb20860b792d5709bcfa83feeb3a436b21e339e9d
Instruction ID: 60a6db508766d0176de5257cd9c04f851b8e12d18597fbeb5363c1cc45f9d795
Opcode Fuzzy Hash: 261500b53b9fbffb2ab7006eb20860b792d5709bcfa83feeb3a436b21e339e9d
Instruction Fuzzy Hash: 54F065799002189FEB50DB74DD46B8E77F8AB04304F9144E5950DD3282EA70AA48CB41

Uniqueness

Uniqueness Score: -1.00%

Function 10028DEC, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10028DF6

Part of subcall function 1002B0BB: __EH_prolog3.LIBCMT ref: 1002B0C2

CallNextHookEx.USER32 ref: 10028E3A

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

GetClassLongA.USER32 ref: 10028E7E
GlobalGetAtomNameA.KERNEL32 ref: 10028EA8
SetWindowLongA.USER32 ref: 10028EFD
_memset.LIBCMT ref: 10028F47
GetClassLongA.USER32 ref: 10028F77
GetClassNameA.USER32(?,?,00000100), ref: 10028F98
GetWindowLongA.USER32 ref: 10028FBC
GetPropA.USER32 ref: 10028FD6
SetPropA.USER32(?,AfxOldWndProc423,?), ref: 10028FE1
GetPropA.USER32 ref: 10028FE9
GlobalAddAtomA.KERNEL32 ref: 10028FF1
SetWindowLongA.USER32 ref: 10028FFF
CallNextHookEx.USER32 ref: 10029017
UnhookWindowsHookEx.USER32(?), ref: 1002902B

Strings

#32768, xrefs: 10028F59, 10028F5E, 10028FA8
AfxOldWndProc423, xrefs: 10028FCF, 10028FD4, 10028FDF, 10028FE7, 10028FF0
ime, xrefs: 10028EB1

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalNameNext$Exception@8H_prolog3H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 867647115-4034971020
Opcode ID: 028737d45415cf4fc653e4401d117fb93ecf855678ad16e5d4e8c367e2bfe641
Instruction ID: c9f41a1409c6bb8d0fa3b18bb25e3997143979ac063bd30542687b89172f9a1c
Opcode Fuzzy Hash: 028737d45415cf4fc653e4401d117fb93ecf855678ad16e5d4e8c367e2bfe641
Instruction Fuzzy Hash: 2361027590122AAFDB11DF61DD88B9E7BB8FF093A1F920154F509E6191DB30DE80CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 100214CB, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 100214D5
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,1002179C,?,?), ref: 10021505
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 10021519
ConvertDefaultLocale.KERNEL32(?), ref: 10021555
ConvertDefaultLocale.KERNEL32(?), ref: 10021563
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 10021580
ConvertDefaultLocale.KERNEL32(?), ref: 100215AB
ConvertDefaultLocale.KERNEL32(000003FF), ref: 100215B4
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 100215CD
EnumResourceLanguagesA.KERNEL32 ref: 100215EA
ConvertDefaultLocale.KERNEL32(?), ref: 1002161D
ConvertDefaultLocale.KERNEL32(00000000), ref: 10021626
GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 10021669
_memset.LIBCMT ref: 10021689

Strings

kernel32.dll, xrefs: 100214EE
ntdll.dll, xrefs: 100215C8
GetSystemDefaultUILanguage, xrefs: 10021565
GetUserDefaultUILanguage, xrefs: 1002150D

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: 482ed3ff8adc9dfca9f4a6a5a3eecf6aee0f7f9e6cd518195f59097e54c4c985
Instruction ID: 3754a4cc769aa270db1ce7901eb040107ed5b3d0b04ae9dca27c5b132e5f9257
Opcode Fuzzy Hash: 482ed3ff8adc9dfca9f4a6a5a3eecf6aee0f7f9e6cd518195f59097e54c4c985
Instruction Fuzzy Hash: 77515974C002289BCB61DF659C44BEDBAF4EB59300F5002EAE988E3291DB749E81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 10024F5B, Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,745F5D80,100250B0,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10024F86
GetProcAddress.KERNEL32(00000000,GetSystemMetrics,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10024FA2
GetProcAddress.KERNEL32(00000000,MonitorFromWindow,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10024FB3
GetProcAddress.KERNEL32(00000000,MonitorFromRect,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10024FC4
GetProcAddress.KERNEL32(00000000,MonitorFromPoint,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10024FD5
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10024FE6
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10024FF7
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA,?,?,?,?,?,?,?,10026FEC,00000000,00000002,00000028), ref: 10025008

Strings

GetSystemMetrics, xrefs: 10024F9C
MonitorFromPoint, xrefs: 10024FCF
MonitorFromRect, xrefs: 10024FBE
GetMonitorInfoA, xrefs: 10024FF1
EnumDisplayMonitors, xrefs: 10024FE0
EnumDisplayDevicesA, xrefs: 10025002
USER32, xrefs: 10024F7C
MonitorFromWindow, xrefs: 10024FAD

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: 2c2d105ab76555674e553128ad85fc5a2fe8f9f5109b4f1e6913bbfff899dba8
Instruction ID: f18cf552d00ebf4573e19fd52f8b2344fe61d2491b1b7e62cf44cba2888c0d7d
Opcode Fuzzy Hash: 2c2d105ab76555674e553128ad85fc5a2fe8f9f5109b4f1e6913bbfff899dba8
Instruction Fuzzy Hash: 15213672D10170ABE752EF749DC886D7AF8F64C2827A1083FE302DA12AD7724540DF98

Uniqueness

Uniqueness Score: -1.00%

Function 10026EFC, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1002A3F0: GetWindowLongA.USER32 ref: 1002A3FB

GetParent.USER32(?), ref: 10026F2B
SendMessageA.USER32 ref: 10026F4E
GetWindowRect.USER32 ref: 10026F68
GetWindowLongA.USER32 ref: 10026F7E
CopyRect.USER32 ref: 10026FCB
CopyRect.USER32 ref: 10026FD5
GetWindowRect.USER32 ref: 10026FDE
CopyRect.USER32 ref: 10026FFA

Strings

(, xrefs: 10026F94

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: ffd55680436a5d28903850f20e835ec9a2371b9025f3b79a50c4d24cc647ab29
Instruction ID: 79398ab63d643b80669917eeb3518c0a7ae9ea55fdc53564aac6bb8538d6af80
Opcode Fuzzy Hash: ffd55680436a5d28903850f20e835ec9a2371b9025f3b79a50c4d24cc647ab29
Instruction Fuzzy Hash: 08513C72900219AFDB01CBA8EE85AEEBBB9FF48350F554125F909F3251DB30ED458B64

Uniqueness

Uniqueness Score: -1.00%

Function 10034610, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,1004E800,0000000C,1003474B,00000000,00000000,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C), ref: 10034622
__crt_waiting_on_module_handle.LIBCMT ref: 1003462D

Part of subcall function 1003065C: Sleep.KERNEL32(000003E8,00000000,?,10034573,KERNEL32.DLL,?,?,10034907,00000000,?,1002E9AC,00000000,?,?,?,1002EA0F), ref: 10030668
Part of subcall function 1003065C: GetModuleHandleW.KERNEL32(00000000,?,10034573,KERNEL32.DLL,?,?,10034907,00000000,?,1002E9AC,00000000,?,?,?,1002EA0F,?), ref: 10030671

GetProcAddress.KERNEL32(00000000,EncodePointer,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880,00000000,00000000), ref: 10034656
GetProcAddress.KERNEL32(00000000,DecodePointer,?,100351BF,00000000,00000001,00000000,?,100357EF,00000018,1004E870,0000000C,10035880,00000000,00000000), ref: 10034666
__lock.LIBCMT ref: 10034688
InterlockedIncrement.KERNEL32(?), ref: 10034695
__lock.LIBCMT ref: 100346A9
___addlocaleref.LIBCMT ref: 100346C7

Strings

EncodePointer, xrefs: 1003464A
DecodePointer, xrefs: 1003465E
KERNEL32.DLL, xrefs: 1003461C, 10034621, 1003462C

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 5b83938148a6bc88c1e014cfaa9ba3fc415054042f6b227dce2f604cd513625e
Instruction ID: 0d6301bb9ab871ffe84231295dfe76788f8a31cd98ef4b571f500b89faff28c9
Opcode Fuzzy Hash: 5b83938148a6bc88c1e014cfaa9ba3fc415054042f6b227dce2f604cd513625e
Instruction Fuzzy Hash: 1C11AF79801741AFE711CF79CD42B8ABBF0EF45311F214969E499EB2A0CB74AA40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 10020C3F, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 10020C68
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 10020C85
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 10020C92
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 10020C9F
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 10020CAC

Strings

ReleaseActCtx, xrefs: 10020C87
DeactivateActCtx, xrefs: 10020CA1
CreateActCtxA, xrefs: 10020C7F
ActivateActCtx, xrefs: 10020C94
KERNEL32, xrefs: 10020C63

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: dac128db901c47e6bb8252af25d8797b23f4122bed0c2a723d77acf103c536fb
Instruction ID: 164c5ab3b4a161f1fd64f3c59e5fc8043f34cbc47aed943c162e41eaa6e30758
Opcode Fuzzy Hash: dac128db901c47e6bb8252af25d8797b23f4122bed0c2a723d77acf103c536fb
Instruction Fuzzy Hash: 621130F1C002A19BDB11DF99ADC484ABFE9F656240363427FF218D3221EB708854CE17

Uniqueness

Uniqueness Score: -1.00%

Function 10043A65, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10043A6C
std::_Lockit::_Lockit.LIBCPMT ref: 10043A76
int.LIBCPMT ref: 10043A8D

Part of subcall function 100427A3: std::_Lockit::_Lockit.LIBCPMT ref: 100427B6

std::locale::_Getfacet.LIBCPMT ref: 10043A96
ctype.LIBCPMT ref: 10043AB0
std::bad_exception::bad_exception.LIBCMT ref: 10043AC4
__CxxThrowException@8.LIBCMT ref: 10043AD2
std::locale::facet::_Incref.LIBCPMT ref: 10043AE2
std::locale::facet::facet_Register.LIBCPMT ref: 10043AE8

Strings

bad cast, xrefs: 10043ABC

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 2535038987-3145022300
Opcode ID: 3269a5203a73611e901993287b551c215e6cb5b556df1f504442498d94acef6b
Instruction ID: 41e516e335ea381e6c6cf3992b6e31462ccd823a1db2d0b16548d00875c41f3f
Opcode Fuzzy Hash: 3269a5203a73611e901993287b551c215e6cb5b556df1f504442498d94acef6b
Instruction Fuzzy Hash: 7E01C039D401699BCB02DBA4DC42AEE7375FF84760F724129F110EB1D1DF74AA008799

Uniqueness

Uniqueness Score: -1.00%

Function 10043C84, Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10043C8B
std::_Lockit::_Lockit.LIBCPMT ref: 10043C95
int.LIBCPMT ref: 10043CAC

Part of subcall function 100427A3: std::_Lockit::_Lockit.LIBCPMT ref: 100427B6

std::locale::_Getfacet.LIBCPMT ref: 10043CB5
codecvt.LIBCPMT ref: 10043CCF
std::bad_exception::bad_exception.LIBCMT ref: 10043CE3
__CxxThrowException@8.LIBCMT ref: 10043CF1
std::locale::facet::_Incref.LIBCPMT ref: 10043D01
std::locale::facet::facet_Register.LIBCPMT ref: 10043D07

Strings

bad cast, xrefs: 10043CDB

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 577375395-3145022300
Opcode ID: 92449c159e0a17ff4070164fc4e6f4138defaf5b0dd7c915e336a137390c2ee1
Instruction ID: 1c641b6faa081a6f5f4558330d18bfb7172afe5efef557fc2d9691916cc6be6c
Opcode Fuzzy Hash: 92449c159e0a17ff4070164fc4e6f4138defaf5b0dd7c915e336a137390c2ee1
Instruction Fuzzy Hash: E701A979D002199BCB06DBA0DC42AAE7375FF84660FB14129F111FB1E1DF74AA008798

Uniqueness

Uniqueness Score: -1.00%

Function 1002341C, Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 10023423
FindResourceA.KERNEL32(?,?,00000005), ref: 10023456
LoadResource.KERNEL32(?,00000000), ref: 1002345E

Part of subcall function 100275EC: UnhookWindowsHookEx.USER32(?), ref: 1002761C

LockResource.KERNEL32(?,00000024,1000150C,00000000,00FD6546), ref: 1002346F
GetDesktopWindow.USER32 ref: 100234A2
IsWindowEnabled.USER32(?), ref: 100234B0
EnableWindow.USER32(?,00000000), ref: 100234BF

Part of subcall function 1002A492: IsWindowEnabled.USER32(?), ref: 1002A49B

Part of subcall function 1002A4AD: EnableWindow.USER32(?,00000000), ref: 1002A4BE

EnableWindow.USER32(?,00000001), ref: 100235A4
GetActiveWindow.USER32 ref: 100235AF
SetActiveWindow.USER32(?,?,00000024,1000150C,00000000,00FD6546), ref: 100235BD
FreeResource.KERNEL32(?,?,00000024,1000150C,00000000,00FD6546), ref: 100235D9

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 9f51e5419fd464f8870fff1869e5699930f25b995303faded1736d57e07594c8
Instruction ID: c961092801c59ee9409441e3dbe49a4a333b051d42b2e552560430daa244bbc0
Opcode Fuzzy Hash: 9f51e5419fd464f8870fff1869e5699930f25b995303faded1736d57e07594c8
Instruction Fuzzy Hash: AA51A034A00B15DFDF11DFA4E9856AEBBF0FF48711F904029E54AA21A1CB719E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 10028C9F, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 10028CA6
GetPropA.USER32 ref: 10028CB5
CallWindowProcA.USER32 ref: 10028D0F

Part of subcall function 10027B1C: GetWindowRect.USER32 ref: 10027B46

SetWindowLongA.USER32 ref: 10028D36
RemovePropA.USER32 ref: 10028D3E
GlobalFindAtomA.KERNEL32 ref: 10028D45
GlobalDeleteAtom.KERNEL32 ref: 10028D4F
CallWindowProcA.USER32 ref: 10028DA3

Strings

AfxOldWndProc423, xrefs: 10028CAE, 10028CB3, 10028D3C, 10028D44

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window$AtomCallGlobalProcProp$DeleteFindH_prolog3_catchLongRectRemove
String ID: AfxOldWndProc423
API String ID: 2109165785-1060338832
Opcode ID: dccbfa165b239661d1f4eaae413e83b7f4de832619f3524192097b6a1288ccad
Instruction ID: ff35111d89a6fae3ee79e979b08ab4de06e021ef9fe06013c3cb9f10e1bb71d8
Opcode Fuzzy Hash: dccbfa165b239661d1f4eaae413e83b7f4de832619f3524192097b6a1288ccad
Instruction Fuzzy Hash: FB31843A80111ABBDF02DFA0EE49DBF7BB8FF46341F800519FA05A50A1C7759A14DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1002B9A0, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 1002B9C8
GetStockObject.GDI32(0000000D), ref: 1002B9D0
GetObjectA.GDI32(00000000,0000003C,?), ref: 1002B9DD
GetDC.USER32(00000000), ref: 1002B9EC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1002BA00
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 1002BA0C
ReleaseDC.USER32 ref: 1002BA18

Strings

System, xrefs: 1002B9C3, 1002BA2D

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 95aa6347fd842ffca335552be3f3c7f3934e69caa990673b5ebc058802f1fbd6
Instruction ID: 22c60c461008f25a8b5f8ebf610b65477afa905285395b5dac6d7a6a43a1c48b
Opcode Fuzzy Hash: 95aa6347fd842ffca335552be3f3c7f3934e69caa990673b5ebc058802f1fbd6
Instruction Fuzzy Hash: F611C171A01228EBEB10DBA5DD89FAE7BB8FF05781F400015FA05E61C1DB709D01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1001E790, Relevance: 13.6, APIs: 9, Instructions: 105windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 1001E7D5
SendMessageA.USER32 ref: 1001E7FB
SendMessageA.USER32 ref: 1001E815
SendMessageA.USER32 ref: 1001E839
SendMessageA.USER32 ref: 1001E86E
SendMessageA.USER32 ref: 1001E888
SendMessageA.USER32 ref: 1001E8A4
SendMessageA.USER32 ref: 1001E8BD
SendMessageA.USER32 ref: 1001E8DB

Part of subcall function 1001E520: _strlen.LIBCMT ref: 1001E5FA
Part of subcall function 1001E520: _strlen.LIBCMT ref: 1001E614

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$_strlen
String ID:
API String ID: 3697954797-0
Opcode ID: 50909218d121ae73ae8b47ddfd2900abd0d565cb3fc4bb7cb040f620d48819e1
Instruction ID: 0edfc11e8551d9ebf0957f65f3a3322fb23760369c1f09792b2f79df2d73aaf8
Opcode Fuzzy Hash: 50909218d121ae73ae8b47ddfd2900abd0d565cb3fc4bb7cb040f620d48819e1
Instruction Fuzzy Hash: 22413A74F00306ABE704CF94CD85FAEB7B5FB88B41F208159FA19AB291C670A941DB54

Uniqueness

Uniqueness Score: -1.00%

Function 1002AF6B, Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 1002AF72
EnterCriticalSection.KERNEL32(?,00000010,1002B13B,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461), ref: 1002AF83
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461,00000000), ref: 1002AFA1
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002AFD5
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461,00000000), ref: 1002B041
_memset.LIBCMT ref: 1002B060
TlsSetValue.KERNEL32(?,00000000), ref: 1002B071
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461,00000000), ref: 1002B092

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: 26dcec1041afacb20883f8a88d8399bfa0257013ec7d92cf10d39ecfaabb8d94
Instruction ID: 31172aa3a9d6c7229b9057958b552749f74c39a7ca69aeefdb4b4ffe67e485c6
Opcode Fuzzy Hash: 26dcec1041afacb20883f8a88d8399bfa0257013ec7d92cf10d39ecfaabb8d94
Instruction Fuzzy Hash: 2431BCB4400A16EFDB25DF64ECC5C5ABBB4FF05310BA1C529E96A97661CB30AD90CF80

Uniqueness

Uniqueness Score: -1.00%

Function 10001920, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 10001982

Strings

ios_base::badbit set, xrefs: 100019A3
ios_base::failbit set, xrefs: 10001A1E
ios_base::eofbit set, xrefs: 10001A88

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 51a00e0988f626f2dae953a8ada664ba94390563386f7a615b68e84484e52bf4
Instruction ID: 1c38ab3b2c14ee1c247bdf225933c46791fcea5bd7c47801f16d03e79e27f587
Opcode Fuzzy Hash: 51a00e0988f626f2dae953a8ada664ba94390563386f7a615b68e84484e52bf4
Instruction Fuzzy Hash: 29518A34904688EEDB14DFA0CC85BDDB7B1EF45300F6081ADE5056B285CBB46E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10021F51, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 10021E9F: GetParent.USER32(00000000), ref: 10021EF3
Part of subcall function 10021E9F: GetLastActivePopup.USER32(00000000), ref: 10021F04
Part of subcall function 10021E9F: IsWindowEnabled.USER32(00000000), ref: 10021F18
Part of subcall function 10021E9F: EnableWindow.USER32(00000000,00000000), ref: 10021F2B

EnableWindow.USER32(?,00000001), ref: 10021F9E
GetWindowThreadProcessId.USER32(?,?), ref: 10021FB2
GetCurrentProcessId.KERNEL32 ref: 10021FBC
SendMessageA.USER32 ref: 10021FD4
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 1002204E
EnableWindow.USER32(00000000,00000001), ref: 10022093

Strings

0, xrefs: 10022029

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: fa47c2bca283c1efa9c57a90baf6965e2cf2faf5ec170df8e895b8240d28c0a6
Instruction ID: c7e4dcc29fd9e1fd486e00497d35318e62f13d9d594050e36cf698265b5585c7
Opcode Fuzzy Hash: fa47c2bca283c1efa9c57a90baf6965e2cf2faf5ec170df8e895b8240d28c0a6
Instruction Fuzzy Hash: 7B41EF75A00228ABEB21CF64DC86BDA77B8FF14750F900599FA58D7281D7B09E80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1002102D, Relevance: 12.1, APIs: 8, Instructions: 66memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 1002104C
lstrcmpA.KERNEL32(?,?), ref: 10021058
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 1002106A
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 1002108A
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 10021092
GlobalLock.KERNEL32 ref: 1002109C
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 100210A9
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 100210C1

Part of subcall function 1002A801: GlobalFlags.KERNEL32(?), ref: 1002A810
Part of subcall function 1002A801: GlobalUnlock.KERNEL32(?,?,?,?,10021A27,?,00000214,1000148F), ref: 1002A822
Part of subcall function 1002A801: GlobalFree.KERNEL32 ref: 1002A82D

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 85f582fc0fa2d760b393ed167a5d421003042f2adcf672044b7dbfb8b9eda5cc
Instruction ID: 1e26f6493bbdf61cc617228eadb58d3a13350607a0778397bdab265459f41c03
Opcode Fuzzy Hash: 85f582fc0fa2d760b393ed167a5d421003042f2adcf672044b7dbfb8b9eda5cc
Instruction Fuzzy Hash: 6E11E079600640BBDB228BA5CD89DAFBAFDFB867407500529F605D2020DA72ED81DB64

Uniqueness

Uniqueness Score: -1.00%

Function 1002A98E, Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 1002A99D
GetSystemMetrics.USER32 ref: 1002A9A4
GetSystemMetrics.USER32 ref: 1002A9AB
GetSystemMetrics.USER32 ref: 1002A9B5
GetDC.USER32(00000000), ref: 1002A9BF
GetDeviceCaps.GDI32(00000000,00000058), ref: 1002A9D0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 1002A9D8
ReleaseDC.USER32 ref: 1002A9E0

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: 97df97701bdba165d7bd0f3935d33a7940ab39bf43f5bcde9822dd001b09b376
Instruction ID: 4b18a5fc2a191a652713761d43d2b2da4b0cc28fbe92607e78cb1662e9ca01b2
Opcode Fuzzy Hash: 97df97701bdba165d7bd0f3935d33a7940ab39bf43f5bcde9822dd001b09b376
Instruction Fuzzy Hash: 0CF0F9B1E40724BAF7105F728C89B167EA8FB49761F004456E6199B281DAB599118FD0

Uniqueness

Uniqueness Score: -1.00%

Function 10001D60, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 136windowCOMMON

Download Yara Rule

APIs

Part of subcall function 10022D72: _memset.LIBCMT ref: 10022D8E

_strlen.LIBCMT ref: 10001E7F
_strlen.LIBCMT ref: 10001EF1
_strlen.LIBCMT ref: 10001F36
LoadIconA.USER32 ref: 10001F81

Strings

127.0.0.1, xrefs: 10001E68, 10001E7A, 10001E8E
^t, xrefs: 10001F81

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _strlen$IconLoad_memset
String ID: ^t$127.0.0.1
API String ID: 858515944-3506571716
Opcode ID: b8f0a33aed5857d50bc6d4f51472f84c63fc56d9dccdc7a641a98e34b1a5589f
Instruction ID: cb70d14c711791ee52ee588ee2f9325bb7e7fa3515ba92e26f588566a221a80e
Opcode Fuzzy Hash: b8f0a33aed5857d50bc6d4f51472f84c63fc56d9dccdc7a641a98e34b1a5589f
Instruction Fuzzy Hash: AE5118B4904298DBDB14CFA4CC41B9EBBB1EF45308F6481A8E50DAB392DB356E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 1002B84C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 1002B878
lstrlenA.KERNEL32(?), ref: 1002B8C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 1002B8DD
_wcslen.LIBCMT ref: 1002B901

Strings

System, xrefs: 1002B874

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWide_wcslenlstrlen
String ID: System
API String ID: 4253822919-3470857405
Opcode ID: d5816cacfd0a332e5282f5be394baf9a0c0f2a364455dc9baade1f500cebd3c2
Instruction ID: 7b5a175680f670ca79b6c2ec9272e95e82f354ff2106dbd97111df154043a3f4
Opcode Fuzzy Hash: d5816cacfd0a332e5282f5be394baf9a0c0f2a364455dc9baade1f500cebd3c2
Instruction Fuzzy Hash: C8412671D00619DFDB14CFA4DC85AAEBBB9FF04310F64812AE516EB285E770AD85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 100270BC, Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 100270EF
PeekMessageA.USER32 ref: 10027113
UpdateWindow.USER32(?), ref: 1002712E
SendMessageA.USER32 ref: 1002714F
SendMessageA.USER32 ref: 10027167
UpdateWindow.USER32(?), ref: 100271AA
PeekMessageA.USER32 ref: 100271DB

Part of subcall function 1002A3F0: GetWindowLongA.USER32 ref: 1002A3FB

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 5e6b9223f0a1804046a8fbfe378e80d9714a9eacbb44f0fef3914e7058a9bdf9
Instruction ID: e439185c47b7e5e34c348b8e0b3dbe5bb3c4b57b45cec7e657144295835a6737
Opcode Fuzzy Hash: 5e6b9223f0a1804046a8fbfe378e80d9714a9eacbb44f0fef3914e7058a9bdf9
Instruction Fuzzy Hash: 9041C370E00246EBDB11CF69DC84E9FBBF8FF82B81F90815DE949A2150D7719A50DB10

Uniqueness

Uniqueness Score: -1.00%

Function 10027676, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10027705
SendMessageA.USER32 ref: 1002772E
GetWindowLongA.USER32 ref: 10027740
GetWindowLongA.USER32 ref: 10027751
SetWindowLongA.USER32 ref: 1002776D

Strings

,, xrefs: 10027724

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: ,
API String ID: 2997958587-3772416878
Opcode ID: 1276ef7f4d5813a713450155f5ae2d4635a7a3024c65db1a6c5f2f6a990dd864
Instruction ID: f848ae84a4977e1a31b52bc52376e27e10e8709ed1b3efe9ee7841c93cdd6a05
Opcode Fuzzy Hash: 1276ef7f4d5813a713450155f5ae2d4635a7a3024c65db1a6c5f2f6a990dd864
Instruction Fuzzy Hash: 1431C134600B119FC715DF78E888A6AB7F5FF48350B92056DE58997691DB70E800CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1002245E, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10022468
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 1002254E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 1002256B
RegCloseKey.ADVAPI32(?), ref: 1002258B
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 100225A6

Strings

Software\, xrefs: 100224CC

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseEnumH_prolog3_OpenQueryValue
String ID: Software\
API String ID: 1666054129-964853688
Opcode ID: 3dcc581e61560c1b2a89a559af4b2aadf043690cbf44cd43855230fa8fe55520
Instruction ID: 3764a028f082780bf1b34d3e1a3aecc110f1b9c57831791e493d608046546682
Opcode Fuzzy Hash: 3dcc581e61560c1b2a89a559af4b2aadf043690cbf44cd43855230fa8fe55520
Instruction Fuzzy Hash: 3C41AC35800128EBCB22DBA0CC81AEEB3B8FF49310F5045D9F249E2191DB34AB958F94

Uniqueness

Uniqueness Score: -1.00%

Function 100222E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 100222EA
RegOpenKeyA.ADVAPI32(?,?,?), ref: 10022378
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 1002239B

Part of subcall function 1002228B: __EH_prolog3.LIBCMT ref: 10022292

Strings

Software\Classes\, xrefs: 1002232B

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: EnumH_prolog3H_prolog3_catch_Open
String ID: Software\Classes\
API String ID: 3518408925-1121929649
Opcode ID: 148a9a07ce493e8523daa3725bf67091589f603dbf0392a59fe7285a5da600ad
Instruction ID: 704202dc6e21b2fa8b48efa6eea704b7fc6a1643c8ca87a9ade3220d51c06aab
Opcode Fuzzy Hash: 148a9a07ce493e8523daa3725bf67091589f603dbf0392a59fe7285a5da600ad
Instruction Fuzzy Hash: A1317C36C00068EBDB22EBA4CD44BDDB6B8FB09350F5141D5F999A3252DA306FA49F91

Uniqueness

Uniqueness Score: -1.00%

Function 1002B26C, Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 1002B279
SendMessageA.USER32 ref: 1002B294
GetFocus.USER32 ref: 1002B2A9
SendMessageA.USER32 ref: 1002B2B7
GetLastActivePopup.USER32(?), ref: 1002B2E0
SendMessageA.USER32 ref: 1002B2ED

Part of subcall function 1002881E: GetWindowLongA.USER32 ref: 10028844
Part of subcall function 1002881E: GetParent.USER32(?), ref: 10028852

SendMessageA.USER32 ref: 1002B313

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
String ID:
API String ID: 3338174999-0
Opcode ID: 8b045ddbd33b9174f1829eda3b456e63d99d5e6e5f6e5226114c782d6a6a23be
Instruction ID: 3a08670cfc868389e080b955865bcb0f045f405a5b874c30a2897e43bb08e3ed
Opcode Fuzzy Hash: 8b045ddbd33b9174f1829eda3b456e63d99d5e6e5f6e5226114c782d6a6a23be
Instruction Fuzzy Hash: 7F1146B590065AFFEB11DFA1DD8AC9E7E7CEF41788B910075F504A2121EB719F04AB20

Uniqueness

Uniqueness Score: -1.00%

Function 1002AAF8, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 1002AB28
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 1002AB4B
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 1002AB67
RegCloseKey.ADVAPI32(?), ref: 1002AB77
RegCloseKey.ADVAPI32(?), ref: 1002AB81

Strings

software, xrefs: 1002AB10

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: ccb9b6360ff57769a68f726ed1728c19480870e0bb9bbd8d9feb64ffad4441d4
Instruction ID: fb36ca9c2f952ecb3db15ddf6cda8d32fba402c4719dfc4725c3bd37d29a496b
Opcode Fuzzy Hash: ccb9b6360ff57769a68f726ed1728c19480870e0bb9bbd8d9feb64ffad4441d4
Instruction Fuzzy Hash: 6B11E672900158FBDB11DB9ADD88CDFBFBDEB8A750B5000AAF504A2122D7319E44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1002B00C, Relevance: 10.6, APIs: 7, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?), ref: 1002B013
__CxxThrowException@8.LIBCMT ref: 1002B01D

Part of subcall function 100312CD: RaiseException.KERNEL32(?,?,1004B6B4,1004F1B8,?,?,?,100203CA,1004B6B4,1004F1B8,00000000,00000000), ref: 1003130F

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004), ref: 1002B034
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461,00000000), ref: 1002B041

Part of subcall function 10023B23: __CxxThrowException@8.LIBCMT ref: 10023B39

_memset.LIBCMT ref: 1002B060
TlsSetValue.KERNEL32(?,00000000), ref: 1002B071
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004,10001461,00000000), ref: 1002B092

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: 57ffba166e203e5f771fa8df9200c34d4f09cabdb1cbb7fcc74f3b72e3f2cbe0
Instruction ID: 36d3102e2cb30bc4552268f57227952f3745dc8c02fd82b3b9104c669509b869
Opcode Fuzzy Hash: 57ffba166e203e5f771fa8df9200c34d4f09cabdb1cbb7fcc74f3b72e3f2cbe0
Instruction Fuzzy Hash: DC115E74100605AFD725EF64DCC5D2BBBB9FF453107A0C529F969D6522CB30AC24CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1002A948, Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 1002A956
GetSysColor.USER32(00000010), ref: 1002A95D
GetSysColor.USER32(00000014), ref: 1002A964
GetSysColor.USER32(00000012), ref: 1002A96B
GetSysColor.USER32(00000006), ref: 1002A972
GetSysColorBrush.USER32(0000000F), ref: 1002A97F
GetSysColorBrush.USER32(00000006), ref: 1002A986

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 2aeb855fe3a01d91a1c159618acf838dda1bc2281205f0400994082937ea778a
Instruction ID: 2de359d209fd3f7b37bcce9053ec3ec9da3e309d31870537ed148616a4e248d0
Opcode Fuzzy Hash: 2aeb855fe3a01d91a1c159618acf838dda1bc2281205f0400994082937ea778a
Instruction Fuzzy Hash: 0BF0FE719407445BD730BF724E49B47BAD1FFC4710F02092EE2458B990D6B6E441DF44

Uniqueness

Uniqueness Score: -1.00%

Function 10023266, Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 1002326D
GlobalLock.KERNEL32 ref: 10023345
CreateDialogIndirectParamA.USER32(?,?,?,10022CA4,00000000), ref: 10023374
DestroyWindow.USER32(00000000,?,1000150C,00000000,00FD6546), ref: 100233EE
GlobalUnlock.KERNEL32(?,?,1000150C,00000000,00FD6546), ref: 100233FE
GlobalFree.KERNEL32 ref: 10023407

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: 888fa3cfcf776247989f330621f25040a0e9d6be9df16a9d0be9406a16dfc2c2
Instruction ID: 542586d5134ef99c8f61472b69a72313b72e87743f096b2e8f632b75dff3f323
Opcode Fuzzy Hash: 888fa3cfcf776247989f330621f25040a0e9d6be9df16a9d0be9406a16dfc2c2
Instruction Fuzzy Hash: DD519B31A0024AEFCB04DFA4E9859AEBBB5EF04350F95442DF506E7292CB70AA45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10021E9F, Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 10021ED2
GetParent.USER32(00000000), ref: 10021EE0
GetParent.USER32(00000000), ref: 10021EF3
GetLastActivePopup.USER32(00000000), ref: 10021F04
IsWindowEnabled.USER32(00000000), ref: 10021F18
EnableWindow.USER32(00000000,00000000), ref: 10021F2B

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 472b318fd5bad27ffdf09f8c34eab2449045ee6e889f529d1c6834af2a2317c9
Instruction ID: f929a2de190b898985c8684475384bdcb1a7d6cc0d17529594567964d95cf4f5
Opcode Fuzzy Hash: 472b318fd5bad27ffdf09f8c34eab2449045ee6e889f529d1c6834af2a2317c9
Instruction Fuzzy Hash: 7711E73B5012725BDBA2DA65AD80BDF32D8EFB5AE1F830165EC24E7204D730CD0142D5

Uniqueness

Uniqueness Score: -1.00%

Function 10037738, Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 10037760

Part of subcall function 10030430: __getptd.LIBCMT ref: 1003043E
Part of subcall function 10030430: __getptd.LIBCMT ref: 1003044C

__getptd.LIBCMT ref: 1003776A

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 10037778
__getptd.LIBCMT ref: 10037786
__getptd.LIBCMT ref: 10037791
_CallCatchBlock2.LIBCMT ref: 100377B7

Part of subcall function 100304D5: __CallSettingFrame@12.LIBCMT ref: 10030521

Part of subcall function 1003785E: __getptd.LIBCMT ref: 1003786D
Part of subcall function 1003785E: __getptd.LIBCMT ref: 1003787B

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 46636e942f87dcca0c30cf7feca0092d3b0ea187b49415045ba274b669f62aa0
Instruction ID: fb1f34f9027f5a0fd6fb665b034cbc12c1ee6665b85233a2d450c333db5c1a8f
Opcode Fuzzy Hash: 46636e942f87dcca0c30cf7feca0092d3b0ea187b49415045ba274b669f62aa0
Instruction Fuzzy Hash: 4F1104B9C04249EFDB01DFA4D945AEE7BB1FF08315F508469F814AB251DB38AA11DF90

Uniqueness

Uniqueness Score: -1.00%

Function 1002A8D2, Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 1002A8E3
GetDlgCtrlID.USER32 ref: 1002A8F7
GetWindowLongA.USER32 ref: 1002A907
GetWindowRect.USER32 ref: 1002A919
PtInRect.USER32(?,?,?), ref: 1002A929
GetWindow.USER32(?,00000005), ref: 1002A936

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: f0130467347104804c256745cbc3b6b13c5e57ae72556175195e5c4804d3d92f
Instruction ID: abcb09268cf445b2c35b0e2b56c0cfd5e9caec1888beec0722017402bcd9ce52
Opcode Fuzzy Hash: f0130467347104804c256745cbc3b6b13c5e57ae72556175195e5c4804d3d92f
Instruction Fuzzy Hash: FC018F32500126BBEB219F559D48EAF3BACFF463A1F414165FD15D6060DB30DA829A98

Uniqueness

Uniqueness Score: -1.00%

Function 10029F40, Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10029F70

Strings

@, xrefs: 1002A115
@, xrefs: 1002A07C
AfxFrameOrView90s, xrefs: 1002A036
AfxMDIFrame90s, xrefs: 1002A011

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView90s$AfxMDIFrame90s
API String ID: 2102423945-455206835
Opcode ID: 7bcac898d79bec3422349b7028506952ff69134773f17cb7bb074026e0cf6295
Instruction ID: fa70bd333b2ddaae6f39455d5bc8e436e1dc58d3be4ecb045c2565641b92f197
Opcode Fuzzy Hash: 7bcac898d79bec3422349b7028506952ff69134773f17cb7bb074026e0cf6295
Instruction Fuzzy Hash: BD914175C00219ABDB80CFA4D581BDEBBF9EF48384F518065F908E7181EB749B84DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10020982, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 1002099A
_memset.LIBCMT ref: 10020A12
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 10020A75
LoadBitmapA.USER32 ref: 10020A8D

Strings

, xrefs: 100209F3

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: 33d2bf27483d04382989d274a53bbefd1c41525da4d7f4bc6e43fef10d3baaa5
Instruction ID: 8ec26202c106691d72478eed222520a6e30d1cb825b7d1c94e22465ec1c68f9d
Opcode Fuzzy Hash: 33d2bf27483d04382989d274a53bbefd1c41525da4d7f4bc6e43fef10d3baaa5
Instruction Fuzzy Hash: BD312772A003669FFB10CF289CC5B9D7BB5FB44340F9540AAF549EB182DA709E848B50

Uniqueness

Uniqueness Score: -1.00%

Function 10025110, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 10025150
GetSystemMetrics.USER32 ref: 10025168
GetSystemMetrics.USER32 ref: 1002516F

Strings

DISPLAY, xrefs: 1002518C
B, xrefs: 1002512F

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: b6b25803d1236a503b5fcdcee7e41ccf2bd8b680c30ee70901717e7f43f6efc3
Instruction ID: b60a64a5d5410e3ad8fe5a59109b18ab5d44eebb328e5d1eff8611f1e2dd37b9
Opcode Fuzzy Hash: b6b25803d1236a503b5fcdcee7e41ccf2bd8b680c30ee70901717e7f43f6efc3
Instruction Fuzzy Hash: 4511E771901334AFEB52DF64DC85B9B7BA8EF45791F414061FD0AAE006D672D910CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 10022E4B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Edit, xrefs: 10022E9F

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: ae77f75da73c1987e0fa940b5ef14957e5d7f7bc95fc6b37df26c4b3c60db9f7
Instruction ID: d6f5fafa54f95e57ce7326ac47ec6df47115e019fe7e1f47642f1b857b3d0bbf
Opcode Fuzzy Hash: ae77f75da73c1987e0fa940b5ef14957e5d7f7bc95fc6b37df26c4b3c60db9f7
Instruction Fuzzy Hash: 4611A131200205BBEE20DAA1AC05F5EB6ECFF46791F930929F956D64B1CF61DC80E564

Uniqueness

Uniqueness Score: -1.00%

Function 10037474, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1003748E

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 1003749F
__getptd.LIBCMT ref: 100374AD

Strings

MOC, xrefs: 10037480
csm, xrefs: 10037487

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: e3b2ebf427159775b670ccfe04d8264cb15add95c28ba503ee76d0db9538cd89
Instruction ID: 4aa484bfd58dbd3435781d5c114dead901570b21edfee72e4775129354a6ca63
Opcode Fuzzy Hash: e3b2ebf427159775b670ccfe04d8264cb15add95c28ba503ee76d0db9538cd89
Instruction Fuzzy Hash: 59E012395142448FC322DA64D046B283AE4FB4A216F5A04A1E54C8F223CB38F8809692

Uniqueness

Uniqueness Score: -1.00%

Function 1002A742, Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 1002A76E
_memset.LIBCMT ref: 1002A78B
GetWindowTextA.USER32 ref: 1002A7A5
lstrcmpA.KERNEL32(00000000,?), ref: 1002A7B7
SetWindowTextA.USER32(?,?), ref: 1002A7C3

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: TextWindow$Exception@8Throw_memsetlstrcmplstrlen
String ID:
API String ID: 289641511-0
Opcode ID: eba42bef06e1ea26d0eb59e6d93e6a074b965602a881250286a8b19bcf32aa76
Instruction ID: 26b6340e82542b1e4468bed3117474a07e50960d7f5f1af9f26f2e201bf88dc7
Opcode Fuzzy Hash: eba42bef06e1ea26d0eb59e6d93e6a074b965602a881250286a8b19bcf32aa76
Instruction Fuzzy Hash: 6201C4B6600224ABEB11DB64AEC4BDA77BCEB56750F410062FA05D3141DA709E8487A4

Uniqueness

Uniqueness Score: -1.00%

Function 1003303D, Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10033049

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__amsg_exit.LIBCMT ref: 10033069
__lock.LIBCMT ref: 10033079
InterlockedDecrement.KERNEL32(?), ref: 10033096
InterlockedIncrement.KERNEL32(02C91628), ref: 100330C1

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: b7e179927d4189d82ebcc7d242cd09fbde42b95b3021a06d9a3f9b095d1226b3
Instruction ID: 0569f5a3ac8da4acb0d1a986d046cd977373cb471ce5986ef029c0716cf573c4
Opcode Fuzzy Hash: b7e179927d4189d82ebcc7d242cd09fbde42b95b3021a06d9a3f9b095d1226b3
Instruction Fuzzy Hash: 6701AD35E01B61AFE716DB68889675E77A0FF01BA2F018205F910AF3A1CB347850CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 10043707, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 1004370E
_Fputc.LIBCPMT ref: 10043762
_Fputc.LIBCPMT ref: 10043890

Strings

, xrefs: 1004381A

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Fputc$H_prolog3_
String ID:
API String ID: 2569218679-3916222277
Opcode ID: 958f7fde8cf3934525be4b4590de41da191db7979d055f19d5a6abdfe82d0e64
Instruction ID: 327ff4da5823006f03605dc28747a7ba7b3d1cf190d8e7353a19ee1d8cd02c88
Opcode Fuzzy Hash: 958f7fde8cf3934525be4b4590de41da191db7979d055f19d5a6abdfe82d0e64
Instruction Fuzzy Hash: 74515CB6A046489BCB29CBA4C8919DEB7B5EF48310F31D539F552E7291EF70B808CB54

Uniqueness

Uniqueness Score: -1.00%

Function 10028683, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6E5
Part of subcall function 1002A6AB: InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6F7
Part of subcall function 1002A6AB: LeaveCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A704
Part of subcall function 1002A6AB: EnterCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A714

Part of subcall function 1002ACFB: __EH_prolog3_catch.LIBCMT ref: 1002AD02

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

GetProcAddress.KERNEL32(00000000,HtmlHelpA,10027AEC,0000000C), ref: 100286CC
FreeLibrary.KERNEL32(?), ref: 100286DC

Strings

HtmlHelpA, xrefs: 100286C6
hhctrl.ocx, xrefs: 100286B0

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 3274081130-63838506
Opcode ID: 7eafd78b95f4e71f9a7c2a9e0d78888fac0c88a0cb5b3df1705197983d44129d
Instruction ID: 005129d9915a41a8e27983cdb1c3ef0c0b08f3353e048253c6f2f10206dc3ba7
Opcode Fuzzy Hash: 7eafd78b95f4e71f9a7c2a9e0d78888fac0c88a0cb5b3df1705197983d44129d
Instruction Fuzzy Hash: 7D01AD39001A07ABD722DB60FD09B4B3BD4EF04751F90882AFA5AA5462DB70E9509B59

Uniqueness

Uniqueness Score: -1.00%

Function 10037AE5, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 10037AF8

Part of subcall function 10037A53: ___BuildCatchObjectHelper.LIBCMT ref: 10037A89

_UnwindNestedFrames.LIBCMT ref: 10037B0F
___FrameUnwindToState.LIBCMT ref: 10037B1D

Strings

csm, xrefs: 10037AF4, 10037B09, 10037B1C, 10037B3A, 10037B4A

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: f195471c9651215b8799b1dff3133e99b074ac86d89a3ab6fa62fa96ed46b13b
Instruction ID: f623d6fd13c583f27d9dc74078cf60041b57e54907eb0ea25ac4e83ce510980d
Opcode Fuzzy Hash: f195471c9651215b8799b1dff3133e99b074ac86d89a3ab6fa62fa96ed46b13b
Instruction Fuzzy Hash: 1301E475001109BFDF239E51CC41EAB7FAAFF08392F108014BD1C19121D736E9A1EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1003B6EA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,1003198E), ref: 1003B6EF
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 1003B6FF

Strings

IsProcessorFeaturePresent, xrefs: 1003B6F9
KERNEL32, xrefs: 1003B6EA

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: b625c795e4b14fe0a5397004e64ae313e176778416d8ae412e329f0da2c945c9
Instruction ID: 1963b1661ff3506828beccd1ed570aedb4cc9858b4c3caadb466faf93440aec0
Opcode Fuzzy Hash: b625c795e4b14fe0a5397004e64ae313e176778416d8ae412e329f0da2c945c9
Instruction Fuzzy Hash: FAF09030D0090DE6EF006BA1AE4A2AF7BB8FB8134AF9204A0E295F0094CF30C074C345

Uniqueness

Uniqueness Score: -1.00%

Function 10043F42, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10043F49

Part of subcall function 1001E9D0: _strlen.LIBCMT ref: 1001E9EF

std::bad_exception::bad_exception.LIBCMT ref: 10043F66

Part of subcall function 10043EBB: std::runtime_error::runtime_error.LIBCPMT ref: 10043EC6

__CxxThrowException@8.LIBCMT ref: 10043F74

Part of subcall function 100312CD: RaiseException.KERNEL32(?,?,1004B6B4,1004F1B8,?,?,?,100203CA,1004B6B4,1004F1B8,00000000,00000000), ref: 1003130F

Strings

invalid string position, xrefs: 10043F4E

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow_strlenstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 843739861-1799206989
Opcode ID: 45ad777bced333e79dc8783b5ddc33aee8a57e63d6a6dab2f02a1dc112f26aec
Instruction ID: 29482f66c8a5f8716b1ced5184e44cdebd8c398cac92a99365ce02766c2dbf89
Opcode Fuzzy Hash: 45ad777bced333e79dc8783b5ddc33aee8a57e63d6a6dab2f02a1dc112f26aec
Instruction Fuzzy Hash: 6FD0127580004D9ADB05DBD0CC55EDE7378EB14311F541835B301EA041DF747A49C658

Uniqueness

Uniqueness Score: -1.00%

Function 10003190, Relevance: 6.4, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 100031BF
SetLastError.KERNEL32(0000007F), ref: 100031EB

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: be243d1140ffaf3f5c0c670d3f2cc449d13f2587e7475c66dd1e7082ab2392ba
Instruction ID: 4eaf8ab176a3ef0a7f39cefad6a7452b8358f787e5b85b158199dac7f5a3fe15
Opcode Fuzzy Hash: be243d1140ffaf3f5c0c670d3f2cc449d13f2587e7475c66dd1e7082ab2392ba
Instruction Fuzzy Hash: D051E770E0415ADFEB05CF98C981AAEB7F5FF48344F2085A9E815AB349D734EA41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 10043370, Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10043377
_fgetc.LIBCMT ref: 100434AD

Part of subcall function 100432DD: std::_String_base::_Xlen.LIBCPMT ref: 100432F3

_memcpy_s.LIBCMT ref: 10043472
_ungetc.LIBCMT ref: 100434F8

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: H_prolog3_String_base::_Xlen_fgetc_memcpy_s_ungetcstd::_
String ID:
API String ID: 9762108-0
Opcode ID: 99201e9437667c55015348abdb3458414e8582c21c8e059d90a996027ebc780c
Instruction ID: 13a944e20a8a26727cade03676e391ccd69925211a3dd35b2a339be84363c332
Opcode Fuzzy Hash: 99201e9437667c55015348abdb3458414e8582c21c8e059d90a996027ebc780c
Instruction Fuzzy Hash: CF515C76A006089FCB15DBB4C8919DEB7B9FF48210F70953AE552E7191EE60F908CB54

Uniqueness

Uniqueness Score: -1.00%

Function 10044EAE, Relevance: 6.1, APIs: 4, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

__flush.LIBCMT ref: 10044F72
__fileno.LIBCMT ref: 10044F92
__locking.LIBCMT ref: 10044F99
__flsbuf.LIBCMT ref: 10044FC4

Part of subcall function 10030D24: __getptd_noexit.LIBCMT ref: 10030D24

Part of subcall function 10032DE1: __decode_pointer.LIBCMT ref: 10032DEC

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 956221b4076386118c712c8f64a0eb647298e6b25e76d36a604d25e1bab44899
Instruction ID: f2cbb9fbd7bb741866626b2388375d2bcd999be80ff2815986012e88e7b340f8
Opcode Fuzzy Hash: 956221b4076386118c712c8f64a0eb647298e6b25e76d36a604d25e1bab44899
Instruction Fuzzy Hash: 48418F35A00605DFDB15CFAA888099EB7F6EF80360F328639E855D7580EB71EE45CB48

Uniqueness

Uniqueness Score: -1.00%

Function 1003EEC4, Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1003EEF8
__isleadbyte_l.LIBCMT ref: 1003EF2C
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,?,?,1004E688,00000000,00000000,00000020), ref: 1003EF5D
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,?,?,1004E688,00000000,00000000,00000020), ref: 1003EFCB

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 96643137e7721e308861157e0faa2d4bf1abe89a8bc138eb09a9c9d576fa028f
Instruction ID: 26013823be584ed4b010159d5efc2338de830fada2216c2f4930337caeab7791
Opcode Fuzzy Hash: 96643137e7721e308861157e0faa2d4bf1abe89a8bc138eb09a9c9d576fa028f
Instruction Fuzzy Hash: 52318931A002D6EFDB12DF64C880AAA7BE5EF41352F1286A9F4648F1E1D770AD40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1002B564, Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__msize.LIBCMT ref: 1002B5F7
__msize.LIBCMT ref: 1002B61A
_malloc.LIBCMT ref: 1002B632
_malloc.LIBCMT ref: 1002B647

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: e7775de412d4773406d2d7f9127a0febec078a8c984ec9c0c9f408937bca0ff2
Instruction ID: c06ad2b89a0fc854e88fd2117b33bcd0e6f9c9f7914c74f6532cfdf5cd9cd5d6
Opcode Fuzzy Hash: e7775de412d4773406d2d7f9127a0febec078a8c984ec9c0c9f408937bca0ff2
Instruction Fuzzy Hash: 9D218231600E249FCB55EF30F8C9A5A77E5EF04790BD18519E8598B256DF34ECA0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 100210FF, Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 10023B39
__CxxThrowException@8.LIBCMT ref: 10023B55
__CxxThrowException@8.LIBCMT ref: 10023B71
__cftof.LIBCMT ref: 10023B88

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8Throw$__cftof
String ID:
API String ID: 887240167-0
Opcode ID: 4211e913ba8b62f1cad3a260a4951dcfba4da381e4675b2fc4cd124fb216e819
Instruction ID: 16327421f0b36ea26aeda1f7d289ca1428dc81c908886c4e3e3252d19e74a35c
Opcode Fuzzy Hash: 4211e913ba8b62f1cad3a260a4951dcfba4da381e4675b2fc4cd124fb216e819
Instruction Fuzzy Hash: 6201C07980024CBB8B11DE899C46CDF7BEDEA88250BB00152FB19C3501DAB1EE20D2A2

Uniqueness

Uniqueness Score: -1.00%

Function 10023180, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 100231A8
LoadResource.KERNEL32(?,00000000), ref: 100231B0
LockResource.KERNEL32(00000000), ref: 100231C2
FreeResource.KERNEL32(00000000), ref: 10023210

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 8904d22b2e9766e214ab266f9aec4827302d519ac8e5ca81d82e01921d4caf04
Instruction ID: 7117f4333b49b93e9e103224ba76a384f5f6927333c7ffee97ba62033829b48c
Opcode Fuzzy Hash: 8904d22b2e9766e214ab266f9aec4827302d519ac8e5ca81d82e01921d4caf04
Instruction Fuzzy Hash: 3D110134500761EFD714CF99D988AAAB7F8FF00399F51C429E84283550D770ED58DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10024E13, Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10024E1A

Part of subcall function 10020421: _malloc.LIBCMT ref: 1002043F

__CxxThrowException@8.LIBCMT ref: 10024E50
FormatMessageA.KERNEL32(00001100,00000000,?,00000800,8007000E,00000000,00000000,00000000,?,8007000E,1004DCF4,00000004,1000166C,8007000E), ref: 10024E7B

Part of subcall function 10023B77: __cftof.LIBCMT ref: 10023B88

LocalFree.KERNEL32(8007000E,8007000E), ref: 10024EA4

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow__cftof_malloc
String ID:
API String ID: 1808948168-0
Opcode ID: a99d70be1c0dcc840c7ce1049e047e71ac8799dea147b88372324e332874e07f
Instruction ID: b82dd79aa3f9a22217a6a5774d94273f1735641f27abfa85c715a235195ff0cc
Opcode Fuzzy Hash: a99d70be1c0dcc840c7ce1049e047e71ac8799dea147b88372324e332874e07f
Instruction Fuzzy Hash: 2711C6B1604249BFEF01DFA4DC81DAE3BA9FF08350F628529F619CB1A1DB319950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 100217AE, Relevance: 6.1, APIs: 4, Instructions: 57threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100217B5

Part of subcall function 1002299D: __EH_prolog3.LIBCMT ref: 100229A4

__strdup.LIBCMT ref: 100217D7
GetCurrentThread.KERNEL32 ref: 10021804
GetCurrentThreadId.KERNEL32 ref: 1002180D

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 81573f6a70f85e6e6b71bd66fb05b0a7947cee5f3eccb4cfcc9ed85a086636bb
Instruction ID: 63c4b4d8ed515ebd67a2d3fac6e93b486822e3c8ffac095a61f99a1b17b282e6
Opcode Fuzzy Hash: 81573f6a70f85e6e6b71bd66fb05b0a7947cee5f3eccb4cfcc9ed85a086636bb
Instruction Fuzzy Hash: EC217DB8801B408EC321DF6A958124AFBF4FFA4600F50891FE5AAC7A22DBB4A441CF44

Uniqueness

Uniqueness Score: -1.00%

Function 10029178, Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 100291A4
SendMessageA.USER32 ref: 100291CF
GetCapture.USER32 ref: 100291E1
SendMessageA.USER32 ref: 100291F0

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 088ca0eca7ffd53ce47653328526b22f7a75d7299b8dffa12b2224c673d87500
Instruction ID: 9d500238946ec194ad8ffa17e766443115c43433aa0eeb43828134f684b4c91a
Opcode Fuzzy Hash: 088ca0eca7ffd53ce47653328526b22f7a75d7299b8dffa12b2224c673d87500
Instruction Fuzzy Hash: 8A0175713402557BDA205B629CCDF9B3E7AEBCAF50F510478F6089A0A7CAA14800D620

Uniqueness

Uniqueness Score: -1.00%

Function 1002ABD3, Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 1002AC0E
RegCloseKey.ADVAPI32(00000000), ref: 1002AC17
swprintf.LIBCMT ref: 1002AC34
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 1002AC45

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: c84d023a091e3481915df690cb6fa3c091d1dd2ebdb2df30426c6b2c34bdf920
Instruction ID: b3e5ac37a67a2c34724f7244494befea3428c85a23c18ad1ae006fcf60cdee60
Opcode Fuzzy Hash: c84d023a091e3481915df690cb6fa3c091d1dd2ebdb2df30426c6b2c34bdf920
Instruction Fuzzy Hash: C901ED76500218ABDB10DF688D85FAF77ACEB49714F51082AFA01E3141DB74ED0487A8

Uniqueness

Uniqueness Score: -1.00%

Function 10027E7D, Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(00000000), ref: 10027E8D
GetTopWindow.USER32(00000000), ref: 10027ECC
GetWindow.USER32(00000000,00000002), ref: 10027EEA

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: afb69f6388361ddcc73f1cca2ae2c50509cd01f1d16e133e3ebac848732dfc51
Instruction ID: 7c1aa0b4fd0438a3880c8a8454d512b9e221987d8156c76486bb18807498cd50
Opcode Fuzzy Hash: afb69f6388361ddcc73f1cca2ae2c50509cd01f1d16e133e3ebac848732dfc51
Instruction Fuzzy Hash: 8101D33640062ABBDF139FA1AD05E9F3B6AFF492A0F424054FE1851060D736C961EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1003B5D6, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 1003B5FC

Part of subcall function 1003B421: __fltout2.LIBCMT ref: 1003B44D

__cftog_l.LIBCMT ref: 1003B622
__cftoe_l.LIBCMT ref: 1003B654

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 1693f95a625ffde70028128af171decd196e1ba2c6c978d497889c3db2691634
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 85117E3680054ABFCF139E80CC028EE3F62FB09299F548415FF1958032C736D9B1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 10027839, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 10027846
GetTopWindow.USER32(00000000), ref: 10027859

Part of subcall function 10027839: GetWindow.USER32(00000000,00000002), ref: 100278A0

GetTopWindow.USER32(?), ref: 10027889

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 3cb82c9a8c8603e496fbf3d62de3cfdf58aa9b4925ce369bf6021e639fee71c7
Instruction ID: f10d52d962ac960512d7384eec108a680d17f64428226a36a785d2fcb99e30ea
Opcode Fuzzy Hash: 3cb82c9a8c8603e496fbf3d62de3cfdf58aa9b4925ce369bf6021e639fee71c7
Instruction Fuzzy Hash: F301A23618166ABBCB229F51AC08E8F3A99FF417E0F814021FD0C91111DF31D911D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 1002A257, Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 1002A27D
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,10023139,?,?,1001DF61), ref: 1002A289
LockResource.KERNEL32(00000000,?,?,?,?,?,10023139,?,?,1001DF61), ref: 1002A296
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,10023139,?,?,1001DF61), ref: 1002A2B2

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: feba8fe24ac97258290d34300adbce18e9849086dee679fc7f85b56fb59f0c30
Instruction ID: f3c4c51c49c486de2effa8659e681593a38c79611994fd5387b39b2d60b42ad5
Opcode Fuzzy Hash: feba8fe24ac97258290d34300adbce18e9849086dee679fc7f85b56fb59f0c30
Instruction Fuzzy Hash: B5F0C237200316BBD7019FAD9DC4A6B77ADEF866A17524038FE09D3210DE71DD448AB4

Uniqueness

Uniqueness Score: -1.00%

Function 10001310, Relevance: 6.0, APIs: 4, Instructions: 41networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000132B
inet_addr.WS2_32(?), ref: 10001340
htons.WS2_32(?), ref: 1000134E
sendto.WS2_32(?,?,?,00000000,?,00000010), ref: 1000136F

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _memsethtonsinet_addrsendto
String ID:
API String ID: 1158618643-0
Opcode ID: c3eaa792e2cc8573930c6e3819606380beb20a92460ab2a72e807829517de2d8
Instruction ID: 60f6b611a07b9dfdfd37c1fffb937be7e3926c5419f3fbf29161148c0f489d21
Opcode Fuzzy Hash: c3eaa792e2cc8573930c6e3819606380beb20a92460ab2a72e807829517de2d8
Instruction Fuzzy Hash: 7A015E75900208ABDB00DFA4C986BBF77B8FF48700F504459F90597281E770AA10DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10023584, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 100235A4
GetActiveWindow.USER32 ref: 100235AF
SetActiveWindow.USER32(?,?,00000024,1000150C,00000000,00FD6546), ref: 100235BD
FreeResource.KERNEL32(?,?,00000024,1000150C,00000000,00FD6546), ref: 100235D9

Part of subcall function 1002A4AD: EnableWindow.USER32(?,00000000), ref: 1002A4BE

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 2c836dbf06692eee7363ec98f3d2861cbecdd6f5195fecbca41b8321f8fae3dc
Instruction ID: 11aa7c219ea7ea27b38022f450b92876966fee3fb2bcd7a89944b049f6e30275
Opcode Fuzzy Hash: 2c836dbf06692eee7363ec98f3d2861cbecdd6f5195fecbca41b8321f8fae3dc
Instruction Fuzzy Hash: 83F01934900B28CBDF12EF64D9855AD77B1FF88B02B900425E446B2161CB326E80CA65

Uniqueness

Uniqueness Score: -1.00%

Function 100337CF, Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 100337DB

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 100337F2
__amsg_exit.LIBCMT ref: 10033800
__lock.LIBCMT ref: 10033810

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 56a1e1e41ab0af4027642382f4b576c173bb85e7d626fa8461ae6f1c5f148875
Instruction ID: dae39449bd8c003bde3e62b30ea038717af1cc855304bc2085dea34c93cae8e5
Opcode Fuzzy Hash: 56a1e1e41ab0af4027642382f4b576c173bb85e7d626fa8461ae6f1c5f148875
Instruction Fuzzy Hash: 72F06D7E909700AFE362DB74844674A37E0EF00762F118619B4419F3A1CF34B900CA91

Uniqueness

Uniqueness Score: -1.00%

Function 1002173A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 10021762
PathFindExtensionA.SHLWAPI(?), ref: 10021778

Part of subcall function 100214CB: __EH_prolog3_GS.LIBCMT ref: 100214D5
Part of subcall function 100214CB: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,1002179C,?,?), ref: 10021505
Part of subcall function 100214CB: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 10021519
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(?), ref: 10021555
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(?), ref: 10021563
Part of subcall function 100214CB: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 10021580
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(?), ref: 100215AB
Part of subcall function 100214CB: ConvertDefaultLocale.KERNEL32(000003FF), ref: 100215B4
Part of subcall function 100214CB: GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 10021669

Strings

%s%s.dll, xrefs: 10021781

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: 06773c07019d6f4b52aa5f2187269cd07d01a6017d615c8e4409f9f105a9a11d
Instruction ID: cb1c0cb3582a3260588f521687d4e0582820240ed98e8e3d3c47ebba61cd8817
Opcode Fuzzy Hash: 06773c07019d6f4b52aa5f2187269cd07d01a6017d615c8e4409f9f105a9a11d
Instruction Fuzzy Hash: DA01D1759002289FDB10DB28DD45AEF77FCEB85700F4104A6E505E7150EA70AE04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1003785E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10030483: __getptd.LIBCMT ref: 10030489
Part of subcall function 10030483: __getptd.LIBCMT ref: 10030499

__getptd.LIBCMT ref: 1003786D

Part of subcall function 10034770: __getptd_noexit.LIBCMT ref: 10034773
Part of subcall function 10034770: __amsg_exit.LIBCMT ref: 10034780

__getptd.LIBCMT ref: 1003787B

Strings

csm, xrefs: 10037889

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 51da8c13634b056fff6b854f5948755b110b34fcd4bcc67fefb372d20441b29d
Instruction ID: 9bdde97464bd0678537997cb56ba83c365607814a506e3d314dec82bc4d239b5
Opcode Fuzzy Hash: 51da8c13634b056fff6b854f5948755b110b34fcd4bcc67fefb372d20441b29d
Instruction Fuzzy Hash: 5C014B38841245CECB36CFA0D8446AEB7F6FF08253F51442EE0495EAA1DF30EA81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 10002AB0, Relevance: 5.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(00000000,00000014,?,?,?,?,1000308E,00000000,00000000), ref: 10002B05
SetLastError.KERNEL32(0000007E), ref: 10002B47

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 97caa88e84ccd89aa93ae28ac998ff8c0d132747f048963a4391c92f1473f43e
Instruction ID: 796d6741741126c51599b2b906ad2ab7a2c15db3fbae67425d52538266fc70d6
Opcode Fuzzy Hash: 97caa88e84ccd89aa93ae28ac998ff8c0d132747f048963a4391c92f1473f43e
Instruction Fuzzy Hash: C38182B4A00209DFEB04CF94C981A9EB7B1FF88354F248559E819AB355D735EE82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1002A6AB, Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6E5
InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A6F7
LeaveCriticalSection.KERNEL32(10086308,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A704
EnterCriticalSection.KERNEL32(?,?,?,?,?,1002AD16,00000010,00000008,10024D7E,10024D21,10022808,100207B2,?,100229B3,00000004,100217C4), ref: 1002A714

Part of subcall function 10023B5B: __CxxThrowException@8.LIBCMT ref: 10023B71

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8InitializeLeaveThrow
String ID:
API String ID: 3253506028-0
Opcode ID: feb1692b13d847297fc57938e43eb050cd6bddea5eb79fc1efedc9f05588c2f0
Instruction ID: 3062035623b9543bfb964b4a27d18fc4dd6f5ea10993a44c93a1de297aa0e807
Opcode Fuzzy Hash: feb1692b13d847297fc57938e43eb050cd6bddea5eb79fc1efedc9f05588c2f0
Instruction Fuzzy Hash: 48F09672900355AFEB009F68DCCCB09B7AAFBD6261FDB0017F14486122DF3499C5CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 1002AC8F, Relevance: 5.0, APIs: 4, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(100863DC,?,?,?,?,1002B122,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004), ref: 1002AC9D
TlsGetValue.KERNEL32(100863C0,?,?,?,?,1002B122,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004), ref: 1002ACB1
LeaveCriticalSection.KERNEL32(100863DC,?,?,?,?,1002B122,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004), ref: 1002ACC7
LeaveCriticalSection.KERNEL32(100863DC,?,?,?,?,1002B122,?,00000004,10024D5F,10022808,100207B2,?,100229B3,00000004,100217C4,00000004), ref: 1002ACD2

Memory Dump Source

Source File: 00000003.00000002.670076551.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.670069737.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670118266.0000000010047000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.670127496.0000000010051000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670132358.0000000010054000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.670156279.0000000010084000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670161765.0000000010086000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.670167725.0000000010089000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 635fa73827a5293bebe955a628cf46864b21247635245c70732137549ce58e55
Instruction ID: 611a8f73b53b00c56169e9f5a31810a1fff77d91dc8bf1d27f242dc0fd10bd82
Opcode Fuzzy Hash: 635fa73827a5293bebe955a628cf46864b21247635245c70732137549ce58e55
Instruction Fuzzy Hash: 42F054362005149FD3108F68DDC8C06B7ADFB8A2613664425E805D3221DA30F849EB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6244 Parent PID: 7128 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	18.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.1%
Total number of Nodes:	1076
Total number of Limit Nodes:	17

Executed Functions

Function 04CB52B9, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E04CB52B9(WCHAR* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t47;
				struct HINSTANCE__* _t59;
				signed int _t61;
				signed int _t62;
				WCHAR* _t68;

				_push(_a12);
				_t68 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E04CCFE29(_t47);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x68392e;
				_v16 = 0xf5950b;
				_v16 = _v16 ^ 0xb3325752;
				_v16 = _v16 ^ 0xe58473b2;
				_v16 = _v16 ^ 0x56462a2c;
				_v8 = 0x3988bb;
				_t61 = 0x3a;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0xf338;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x0035ea14;
				_v12 = 0xe53120;
				_v12 = _v12 ^ 0xa236e8c8;
				_t62 = 0x62;
				_v12 = _v12 / _t62;
				_v12 = _v12 ^ 0x01ab7b97;
				_v20 = 0x973198;
				_v20 = _v20 * 0x60;
				_v20 = _v20 ^ 0x38bce55b;
				E04CBEB52(_t62, _t62, 0xeec842c3, 0xab, 0xa2289af1);
				_t59 = LoadLibraryW(_t68); // executed
				return _t59;
			}

0x04cb52c0
0x04cb52c3
0x04cb52c5
0x04cb52c8
0x04cb52cc
0x04cb52cd
0x04cb52d2
0x04cb52d9
0x04cb52e2
0x04cb52e9
0x04cb52f0
0x04cb52f7
0x04cb52fe
0x04cb530a
0x04cb530f
0x04cb5314
0x04cb531b
0x04cb531f
0x04cb5326
0x04cb532d
0x04cb5337
0x04cb533f
0x04cb5342
0x04cb5349
0x04cb5360
0x04cb5363
0x04cb5376
0x04cb537f
0x04cb5385

APIs

LoadLibraryW.KERNEL32 ref: 04CB537F

Strings

,*FV, xrefs: 04CB52F7
1, xrefs: 04CB5326
.9h, xrefs: 04CB52D9

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: 1$,*FV$.9h
API String ID: 1029625771-1870595533
Opcode ID: 47e2a649f6d09089b8114036349e08445583c90553a88ce36019ef6e82d966d0
Instruction ID: 75293ef3efd6bcd3df26e5bc14070c15f9e03745a3a1b9fa185421535591285c
Opcode Fuzzy Hash: 47e2a649f6d09089b8114036349e08445583c90553a88ce36019ef6e82d966d0
Instruction Fuzzy Hash: 702156B5D00208FBEF08DFA8D94A9EEBBB5FB40304F108198E815A6250D3B46B14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04CD1538, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E04CD1538(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t59;
				int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t79;
				signed int _t80;

				_push(_a4);
				E04CCFE29(_t59);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x73095a;
				_v28 = 0xd34a52;
				_v16 = 0xb3a153;
				_t77 = 0x73;
				_v16 = _v16 / _t77;
				_v16 = _v16 + 0x4fd2;
				_v16 = _v16 ^ 0xee3af97f;
				_v16 = _v16 ^ 0xee3510f4;
				_v20 = 0xee2064;
				_v20 = _v20 << 0xe;
				_v20 = _v20 ^ 0x88190a0a;
				_v12 = 0x72c7a5;
				_v12 = _v12 + 0x7839;
				_t78 = 0x77;
				_v12 = _v12 / _t78;
				_t79 = 0x76;
				_v12 = _v12 / _t79;
				_v12 = _v12 ^ 0x00040652;
				_v8 = 0x10c7fb;
				_t80 = 0x6c;
				_v8 = _v8 * 0x70;
				_v8 = _v8 << 8;
				_v8 = _v8 / _t80;
				_v8 = _v8 ^ 0x00c83f8f;
				E04CBEB52(_t80, _t80, 0x2aa4bac1, 0x108, 0xa2289af1);
				_t75 = FindCloseChangeNotification(_a4); // executed
				return _t75;
			}

0x04cd153e
0x04cd1543
0x04cd1548
0x04cd154f
0x04cd1558
0x04cd155f
0x04cd156b
0x04cd1570
0x04cd1575
0x04cd157c
0x04cd1583
0x04cd158a
0x04cd1591
0x04cd1595
0x04cd159c
0x04cd15a3
0x04cd15ad
0x04cd15b2
0x04cd15ba
0x04cd15bf
0x04cd15c4
0x04cd15cb
0x04cd15d6
0x04cd15e6
0x04cd15e9
0x04cd15f3
0x04cd15f6
0x04cd160a
0x04cd1615
0x04cd161a

APIs

FindCloseChangeNotification.KERNEL32(00040652), ref: 04CD1615

Strings

d , xrefs: 04CD158A
Zs, xrefs: 04CD154F

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: Zs$d
API String ID: 2591292051-3879001491
Opcode ID: 38bb643fa24bb4614003e7abf6af2ef3a1b5f649b6f440d52b37eb84a0984821
Instruction ID: 8e8a7e770db75c430c01956450e5dcad02ee0665d6493a97b1fbcf7a7b3ded4c
Opcode Fuzzy Hash: 38bb643fa24bb4614003e7abf6af2ef3a1b5f649b6f440d52b37eb84a0984821
Instruction Fuzzy Hash: 24214CB5D00209EBEB04DFA5C8499DDBBB2EB40304F10C09DE614B7290D7B96B548F80

Uniqueness

Uniqueness Score: -1.00%

Function 04CBD061, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E04CBD061(WCHAR* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t69;

				_push(_a12);
				_t69 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E04CCFE29(_t54);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xa62646;
				_v32 = 0x27199b;
				_v20 = 0x942c55;
				_v20 = _v20 | 0xf0368afe;
				_v20 = _v20 << 0xa;
				_v20 = _v20 ^ 0xfbcaf84d;
				_v20 = _v20 ^ 0x217d6c33;
				_v16 = 0xf28622;
				_v16 = _v16 >> 0xe;
				_v16 = _v16 | 0xeb4a9877;
				_v16 = _v16 ^ 0x2aded5e4;
				_v16 = _v16 ^ 0xc19eb21f;
				_v12 = 0x4a5837;
				_v12 = _v12 ^ 0xa3e571b7;
				_v12 = _v12 + 0xffff6305;
				_t65 = 0x6e;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x01794185;
				_v8 = 0xa209ee;
				_v8 = _v8 + 0x62d2;
				_v8 = _v8 ^ 0x3d892cf6;
				_v8 = _v8 | 0x5ca7d1ce;
				_v8 = _v8 ^ 0x7da8dabc;
				E04CBEB52(_t65, _t65, 0x74c3d0b1, 0x1a1, 0xa2289af1);
				_t63 = DeleteFileW(_t69); // executed
				return _t63;
			}

0x04cbd068
0x04cbd06b
0x04cbd06d
0x04cbd070
0x04cbd074
0x04cbd075
0x04cbd07a
0x04cbd081
0x04cbd087
0x04cbd08e
0x04cbd095
0x04cbd09c
0x04cbd0a3
0x04cbd0a7
0x04cbd0ae
0x04cbd0b5
0x04cbd0bc
0x04cbd0c0
0x04cbd0c7
0x04cbd0ce
0x04cbd0d5
0x04cbd0dc
0x04cbd0e3
0x04cbd0ef
0x04cbd0f7
0x04cbd0fa
0x04cbd101
0x04cbd108
0x04cbd10f
0x04cbd116
0x04cbd11d
0x04cbd13c
0x04cbd145
0x04cbd14b

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 04CBD145

Strings

3l}!, xrefs: 04CBD0AE
7XJ, xrefs: 04CBD0D5

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: 3l}!$7XJ
API String ID: 4033686569-2205417827
Opcode ID: 10709235247fc134180b3dbd0d2fc7697fcbb658dcad94b6e8f128d82acf9f3f
Instruction ID: 3a748d3cba2c01ba521581f14764c51642f78f377b395d2e0c149fb43283d247
Opcode Fuzzy Hash: 10709235247fc134180b3dbd0d2fc7697fcbb658dcad94b6e8f128d82acf9f3f
Instruction Fuzzy Hash: A72134B5D00318AFDF08DFA4C98A9DEFBB0FF14304F108188E966A6210D7B89B558F91

Uniqueness

Uniqueness Score: -1.00%

Function 04CD2C24, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
processCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E04CD2C24(WCHAR* __ecx, void* __edx, intOrPtr _a12, intOrPtr _a20, int _a24, intOrPtr _a28, struct _STARTUPINFOW* _a32, intOrPtr _a40, intOrPtr _a44, WCHAR* _a52, struct _PROCESS_INFORMATION* _a56) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				intOrPtr _v32;
				void* _t49;
				int _t56;
				WCHAR* _t60;

				_push(_a56);
				_t60 = __ecx;
				_push(_a52);
				_push(0);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(0);
				_push(_a12);
				_push(0);
				_push(0);
				_push(__ecx);
				E04CCFE29(_t49);
				_v32 = 0x534833;
				_v28 = 0;
				_v24 = 0;
				_v8 = 0x70adbe;
				_v8 = _v8 >> 5;
				_v8 = _v8 << 0xa;
				_v8 = _v8 | 0x1d11c356;
				_v8 = _v8 ^ 0x1f145645;
				_v20 = 0xecea8a;
				_v20 = _v20 | 0x5baa72b8;
				_v20 = _v20 ^ 0x5be1d11d;
				_v16 = 0x76217f;
				_v16 = _v16 >> 0x10;
				_v16 = _v16 | 0xe98780dc;
				_v16 = _v16 ^ 0xe98c1e91;
				_v12 = 0xeb975;
				_v12 = _v12 ^ 0xd8138edb;
				_v12 = _v12 | 0x0b4171d5;
				_v12 = _v12 ^ 0xdb5d9300;
				E04CBEB52(__ecx, __ecx, 0xb7160725, 0x75, 0xa2289af1);
				_t56 = CreateProcessW(_a52, _t60, 0, 0, _a24, 0, 0, 0, _a32, _a56); // executed
				return _t56;
			}

0x04cd2c2c
0x04cd2c31
0x04cd2c33
0x04cd2c36
0x04cd2c37
0x04cd2c3a
0x04cd2c3d
0x04cd2c3e
0x04cd2c41
0x04cd2c44
0x04cd2c47
0x04cd2c4a
0x04cd2c4b
0x04cd2c4e
0x04cd2c4f
0x04cd2c51
0x04cd2c52
0x04cd2c57
0x04cd2c61
0x04cd2c64
0x04cd2c67
0x04cd2c6e
0x04cd2c72
0x04cd2c76
0x04cd2c7d
0x04cd2c84
0x04cd2c8b
0x04cd2c92
0x04cd2c99
0x04cd2ca0
0x04cd2ca4
0x04cd2cab
0x04cd2cb2
0x04cd2cb9
0x04cd2cc0
0x04cd2cc7
0x04cd2ce8
0x04cd2d02
0x04cd2d09

APIs

CreateProcessW.KERNEL32(?,2E751909,00000000,00000000,00534833,00000000,00000000,00000000,?,?), ref: 04CD2D02

Strings

3HS, xrefs: 04CD2C57

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 3HS
API String ID: 963392458-330188696
Opcode ID: b0049691a906c617faab48a03f019d00495406e067b30e8a3afe4c22a13f3ee0
Instruction ID: dc6ee3bcdb85a5cc515478d28939c094ab6578e8bb842d7358478af3f4b96a62
Opcode Fuzzy Hash: b0049691a906c617faab48a03f019d00495406e067b30e8a3afe4c22a13f3ee0
Instruction Fuzzy Hash: 8421F272800248BBCF159F96DC0ACDFBFB9EB85704F108188F915A2220C3B59A24DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04CD45CA, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E04CD45CA(WCHAR* __ecx, void* __edx, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, long _a24, intOrPtr _a28, intOrPtr _a32, long _a36, intOrPtr _a40, long _a44, long _a48) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t51;
				void* _t60;
				WCHAR* _t64;

				_push(_a48);
				_t64 = __ecx;
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(0);
				_push(__ecx);
				E04CCFE29(_t51);
				_v28 = 0x204d4f;
				_v24 = 0;
				_v20 = 0xd27984;
				_v20 = _v20 | 0x43788b11;
				_v20 = _v20 ^ 0x43f3df42;
				_v16 = 0xf976f1;
				_v16 = _v16 + 0xffff3d74;
				_v16 = _v16 | 0xfc5c4419;
				_v16 = _v16 ^ 0xfcfdb6fc;
				_v12 = 0xb7df7c;
				_v12 = _v12 + 0xffff3658;
				_v12 = _v12 * 0x13;
				_v12 = _v12 ^ 0x1f30f970;
				_v12 = _v12 ^ 0x12ab006a;
				_v8 = 0x8ba8ca;
				_v8 = _v8 | 0x62aa166a;
				_v8 = _v8 + 0xa2f6;
				_v8 = _v8 * 0x55;
				_v8 = _v8 ^ 0xc33acf6c;
				E04CBEB52(__ecx, __ecx, 0xbc17bbde, 0x19f, 0xa2289af1);
				_t60 = CreateFileW(_t64, _a24, _a48, 0, _a44, _a36, 0); // executed
				return _t60;
			}

0x04cd45d2
0x04cd45d7
0x04cd45d9
0x04cd45dc
0x04cd45df
0x04cd45e2
0x04cd45e5
0x04cd45e8
0x04cd45eb
0x04cd45ee
0x04cd45f1
0x04cd45f4
0x04cd45f5
0x04cd45f7
0x04cd45f8
0x04cd45fd
0x04cd4607
0x04cd460a
0x04cd4611
0x04cd4618
0x04cd461f
0x04cd4626
0x04cd462d
0x04cd4634
0x04cd463b
0x04cd4642
0x04cd465d
0x04cd4660
0x04cd4667
0x04cd466e
0x04cd4675
0x04cd467c
0x04cd4688
0x04cd468b
0x04cd469e
0x04cd46b5
0x04cd46bc

APIs

CreateFileW.KERNEL32(?,00000057,?,00000000,?,?,00000000), ref: 04CD46B5

Strings

OM , xrefs: 04CD45FD

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: OM
API String ID: 823142352-4198367855
Opcode ID: c9e2e688d9aa6a43dcdad6de9a4dd150b1ce22289e56966cf6fc1244f0671eef
Instruction ID: 859a27c977318e896f97e96771190292d1b1ed621331dba2c258828e71951f7b
Opcode Fuzzy Hash: c9e2e688d9aa6a43dcdad6de9a4dd150b1ce22289e56966cf6fc1244f0671eef
Instruction Fuzzy Hash: D721EE72801249BB8F05DFA9CD458DEBFB6EF88304F508199F914A6220D3768A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 04CD44FF, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04CD44FF(void* __ecx, void* __edx, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t47;
				intOrPtr* _t57;
				void* _t58;
				signed int _t60;
				signed int _t61;

				E04CCFE29(_t47);
				_v20 = 0xa68a31;
				_t60 = 0x6d;
				_v20 = _v20 / _t60;
				_v20 = _v20 ^ 0x00000260;
				_v16 = 0xfa9629;
				_v16 = _v16 + 0x734b;
				_v16 = _v16 ^ 0x638d356d;
				_v16 = _v16 ^ 0x637ea9c8;
				_v8 = 0x3f26ab;
				_v8 = _v8 ^ 0xcdd207a4;
				_v8 = _v8 ^ 0xb6eb62c4;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x0005a548;
				_v12 = 0xe291fe;
				_t61 = 0x24;
				_v12 = _v12 / _t61;
				_v12 = _v12 + 0x3d74;
				_v12 = _v12 ^ 0x00095158;
				_t57 = E04CBEB52(_t61, _t61, 0x418e972c, 0x54, 0xa2289af1);
				_t58 =  *_t57(_a24, 0, _a20, 0x28, __ecx, __edx, 0, _a8, 0x28, _a16, _a20, _a24); // executed
				return _t58;
			}

0x04cd4517
0x04cd451c
0x04cd452d
0x04cd4532
0x04cd4537
0x04cd453e
0x04cd4545
0x04cd454c
0x04cd4553
0x04cd455a
0x04cd4561
0x04cd4568
0x04cd456f
0x04cd4573
0x04cd457a
0x04cd4584
0x04cd458c
0x04cd458f
0x04cd4596
0x04cd45b2
0x04cd45c4
0x04cd45c9

APIs

SetFileInformationByHandle.KERNEL32(?,00000000,?,00000028), ref: 04CD45C4

Strings

XQ, xrefs: 04CD4596

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: FileHandleInformation
String ID: XQ
API String ID: 3935143524-1200779947
Opcode ID: 81dfb277e86e3c1fe3069d107eacbb6aa7e5857e87f0bf20d0672193a35411da
Instruction ID: 6a4ad7dfb87f8cc6d7733d6588be6945d42beb5af18c71717c8db21e787c6179
Opcode Fuzzy Hash: 81dfb277e86e3c1fe3069d107eacbb6aa7e5857e87f0bf20d0672193a35411da
Instruction Fuzzy Hash: 0E213871E40208FBEF04CFA5DC4AADEBBB1EB54704F108189B910A6290D3B59A649F40

Uniqueness

Uniqueness Score: -1.00%

Function 04CBEE62, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
serviceCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E04CBEE62(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, int _a16, short* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t34;
				void* _t41;
				void* _t44;

				_push(_a20);
				_t44 = __edx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E04CCFE29(_t34);
				_v20 = 0xea751a;
				_v20 = _v20 | 0xe9b69993;
				_v20 = _v20 ^ 0xe9f29d6b;
				_v16 = 0x605393;
				_v16 = _v16 | 0xcc974431;
				_v16 = _v16 ^ 0xccf8b40a;
				_v12 = 0x102a1a;
				_v12 = _v12 + 0xcb09;
				_v12 = _v12 ^ 0x001131dd;
				_v8 = 0x570378;
				_v8 = _v8 >> 5;
				_v8 = _v8 ^ 0xef617e60;
				_v8 = _v8 ^ 0xef696bf9;
				E04CBEB52(__ecx, __ecx, 0x5c98ffad, 5, 0x1f76e49f);
				_t41 = OpenServiceW(_t44, _a20, _a16); // executed
				return _t41;
			}

0x04cbee69
0x04cbee6c
0x04cbee6e
0x04cbee71
0x04cbee74
0x04cbee77
0x04cbee7a
0x04cbee7b
0x04cbee7c
0x04cbee81
0x04cbee8b
0x04cbee92
0x04cbee99
0x04cbeea0
0x04cbeea7
0x04cbeeae
0x04cbeeb5
0x04cbeebc
0x04cbeec3
0x04cbeeca
0x04cbeece
0x04cbeed5
0x04cbeef6
0x04cbef05
0x04cbef0b

APIs

OpenServiceW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 04CBEF05

Strings

`~a, xrefs: 04CBEECE

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: `~a
API String ID: 3098006287-142445290
Opcode ID: 6383736253cef5703bc9a023e52ac128717e5205db758edbe98fcd92a09a10c3
Instruction ID: 9bb6d539efae591f793f72b41b48b2f752057aea1ec1fa532fb950aad61e327c
Opcode Fuzzy Hash: 6383736253cef5703bc9a023e52ac128717e5205db758edbe98fcd92a09a10c3
Instruction Fuzzy Hash: 2E11F275C01218FBDF48EFA5DD0A8DEBFB5EB04314F108588F92562261D3B59A20EF91

Uniqueness

Uniqueness Score: -1.00%

Function 04CC0C2A, Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04CC0C2A(void* __ecx, void* __edx, intOrPtr _a8, void* _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t46;
				char _t58;
				signed int _t60;
				void* _t64;

				_push(_a12);
				_t64 = __ecx;
				_push(_a8);
				_push(0);
				_push(__ecx);
				E04CCFE29(_t46);
				_v16 = 0x79e79;
				_v16 = _v16 ^ 0xb862d7cb;
				_v16 = _v16 >> 4;
				_v16 = _v16 | 0x4697e44e;
				_v16 = _v16 ^ 0x4f9f071e;
				_v12 = 0xdc68bd;
				_t60 = 0xe;
				_v12 = _v12 / _t60;
				_v12 = _v12 * 0x34;
				_v12 = _v12 * 0x65;
				_v12 = _v12 ^ 0x42f8253a;
				_v8 = 0xfd7031;
				_v8 = _v8 << 0xc;
				_v8 = _v8 << 0x10;
				_v8 = _v8 * 0x63;
				_v8 = _v8 ^ 0x300ea1ef;
				_v20 = 0x966242;
				_v20 = _v20 ^ 0xca1ad729;
				_v20 = _v20 + 0x5c3c;
				_v20 = _v20 ^ 0xca8d5c90;
				E04CBEB52(_t60, _t60, 0x5a6a6a19, 0x146, 0xa2289af1);
				_t58 = RtlFreeHeap(_t64, 0, _a12); // executed
				return _t58;
			}

0x04cc0c31
0x04cc0c34
0x04cc0c36
0x04cc0c39
0x04cc0c3c
0x04cc0c3d
0x04cc0c42
0x04cc0c4c
0x04cc0c55
0x04cc0c59
0x04cc0c60
0x04cc0c67
0x04cc0c73
0x04cc0c7b
0x04cc0c8e
0x04cc0c95
0x04cc0c98
0x04cc0c9f
0x04cc0ca6
0x04cc0caa
0x04cc0cb2
0x04cc0cb5
0x04cc0cbc
0x04cc0cc3
0x04cc0cca
0x04cc0cd1
0x04cc0ce4
0x04cc0cf2
0x04cc0cf8

APIs

RtlFreeHeap.NTDLL(00000000,00000000,CA8D5C90), ref: 04CC0CF2

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0c6a47905900e195d1ca513eee3b4fb9fb84d9477b38fddb19f92484bcd3f647
Instruction ID: d2554fd1267cc232a0807689b8300975696169fa8df1e8bb3807dfaea58b1854
Opcode Fuzzy Hash: 0c6a47905900e195d1ca513eee3b4fb9fb84d9477b38fddb19f92484bcd3f647
Instruction Fuzzy Hash: 7921E275D01209FFDB04DFA5C946A9EBBB5EF05704F108099E921BB290D3B4AB50DF91

Uniqueness

Uniqueness Score: -1.00%

Function 04CC648A, Relevance: 1.6, APIs: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E04CC648A(long __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, void* _a12, long _a16) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t41;
				void* _t49;
				long _t52;

				_push(_a16);
				_t52 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E04CCFE29(_t41);
				_v12 = 0x3cd3f;
				_v12 = _v12 << 3;
				_v12 = _v12 | 0xc677f757;
				_v12 = _v12 >> 7;
				_v12 = _v12 ^ 0x0188bcff;
				_v20 = 0x40fc9e;
				_v20 = _v20 << 4;
				_v20 = _v20 ^ 0x040306b1;
				_v16 = 0x159e9f;
				_v16 = _v16 + 0xffffd0d5;
				_v16 = _v16 * 0x33;
				_v16 = _v16 ^ 0x04433238;
				_v8 = 0x8a430d;
				_v8 = _v8 + 0xffffdfbc;
				_v8 = _v8 | 0x5356d001;
				_v8 = _v8 + 0x638e;
				_v8 = _v8 ^ 0x53d0144a;
				E04CBEB52(__ecx, __ecx, 0x958aafc8, 0x1c3, 0xa2289af1);
				_t49 = RtlAllocateHeap(_a12, _a16, _t52); // executed
				return _t49;
			}

0x04cc6491
0x04cc6494
0x04cc6496
0x04cc6499
0x04cc649c
0x04cc64a0
0x04cc64a1
0x04cc64a6
0x04cc64b0
0x04cc64b4
0x04cc64bb
0x04cc64bf
0x04cc64c6
0x04cc64cd
0x04cc64d1
0x04cc64d8
0x04cc64df
0x04cc64fa
0x04cc64fd
0x04cc6504
0x04cc650b
0x04cc6512
0x04cc6519
0x04cc6520
0x04cc6534
0x04cc6543
0x04cc6549

APIs

RtlAllocateHeap.NTDLL(040306B1,?,ED94606E,?,?,?,?,?,?,?,?,?,?,?), ref: 04CC6543

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f41072fe55694ed81fb5a2d434f63a6d1651ccbd0ba08c91d6bc4f92d8fba8a5
Instruction ID: a7d586b9514b9c81d9dd1d5c9b5c50f8ed51119a0b1ad0b7079ee09493ad4df8
Opcode Fuzzy Hash: f41072fe55694ed81fb5a2d434f63a6d1651ccbd0ba08c91d6bc4f92d8fba8a5
Instruction Fuzzy Hash: 8E1100B2C0121DFBDF06DFA5D9098CEBBB5FB00314F108598E821A6250E3B59B249F91

Uniqueness

Uniqueness Score: -1.00%

Function 04CCE8B6, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E04CCE8B6(void* __ecx, void* __edx, intOrPtr _a4, int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				void* _t29;
				void* _t37;

				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				E04CCFE29(_t29);
				_v20 = 0xc8e76b;
				_v20 = _v20 | 0x270203a1;
				_v20 = _v20 ^ 0x27c97096;
				_v16 = 0x55aebc;
				_v16 = _v16 >> 2;
				_v16 = _v16 ^ 0x00171a80;
				_v12 = 0xfad6fe;
				_v12 = _v12 ^ 0xd14a4d1d;
				_v12 = _v12 ^ 0xd1b10da7;
				_v8 = 0x428060;
				_v8 = _v8 * 0x54;
				_v8 = _v8 ^ 0x15de1a76;
				E04CBEB52(__ecx, __ecx, 0x3c0b385, 0x1bc, 0x1f76e49f);
				_t37 = OpenSCManagerW(0, 0, _a12); // executed
				return _t37;
			}

0x04cce8bd
0x04cce8c2
0x04cce8c5
0x04cce8c6
0x04cce8ca
0x04cce8cb
0x04cce8d0
0x04cce8da
0x04cce8e1
0x04cce8e8
0x04cce8ef
0x04cce8f3
0x04cce8fa
0x04cce901
0x04cce908
0x04cce90f
0x04cce92a
0x04cce92d
0x04cce941
0x04cce94e
0x04cce954

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,27C97096,?,?,?,?,?,?,?,?,?,?,?), ref: 04CCE94E

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 938ae55f57f10c9ec9f30609793a9938b44550d2e06b30d2dbdd077d207e708c
Instruction ID: a87dc6068cc2284c8dcf038be92c8d523fda116cec3f90f56502de6b1a1a4a51
Opcode Fuzzy Hash: 938ae55f57f10c9ec9f30609793a9938b44550d2e06b30d2dbdd077d207e708c
Instruction Fuzzy Hash: 8D11F77190221DFB9B04EFE99D468DFBFB4FF04308F118598E925B2211D3B19B149B95

Uniqueness

Uniqueness Score: -1.00%

Function 04CCD11A, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04CCD11A() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t39;

				_v24 = _v24 & 0x00000000;
				_v36 = 0x78f5c7;
				_v32 = 0xa12bb9;
				_v28 = 0x4eca09;
				_v8 = 0x8b256f;
				_v8 = _v8 << 0xb;
				_v8 = _v8 ^ 0x4a7d0011;
				_v8 = _v8 >> 9;
				_v8 = _v8 ^ 0x00073d60;
				_v20 = 0x1e549a;
				_v20 = _v20 + 0xffffad33;
				_v20 = _v20 ^ 0x00134b4f;
				_v16 = 0x8dd9dd;
				_v16 = _v16 << 3;
				_v16 = _v16 ^ 0x0460bc3c;
				_v12 = 0x358059;
				_v12 = _v12 + 0xb97b;
				_v12 = _v12 ^ 0x003502df;
				E04CBEB52(_t39, _t39, 0x83891850, 0x1c, 0xa2289af1);
				ExitProcess(0);
			}

0x04ccd120
0x04ccd124
0x04ccd12b
0x04ccd132
0x04ccd139
0x04ccd140
0x04ccd144
0x04ccd14b
0x04ccd14f
0x04ccd156
0x04ccd15d
0x04ccd164
0x04ccd16b
0x04ccd172
0x04ccd176
0x04ccd17d
0x04ccd184
0x04ccd18b
0x04ccd1ac
0x04ccd1b6

APIs

ExitProcess.KERNEL32(00000000), ref: 04CCD1B6

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction ID: b4062a3a4f8bfb37765e8edd8a0e1385e9662a273d174eeda0718207d3cb65fa
Opcode Fuzzy Hash: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction Fuzzy Hash: 5D11E2B1C4430DEBDB54DFE5D94A6DEFBB0EB00749F108588D521B6250D3B89B489F91

Uniqueness

Uniqueness Score: -1.00%

Function 04CD061D, Relevance: 1.3, APIs: 1, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E04CD061D(void* __ecx, WCHAR* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t44;
				int _t53;
				WCHAR* _t56;

				_push(_a12);
				_t56 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E04CCFE29(_t44);
				_v24 = _v24 & 0x00000000;
				_v28 = 0xcd60b7;
				_v12 = 0x7257ab;
				_v12 = _v12 << 0xd;
				_v12 = _v12 + 0x8f69;
				_v12 = _v12 * 0x4c;
				_v12 = _v12 ^ 0x410f7a13;
				_v8 = 0x7b4696;
				_v8 = _v8 + 0xffff4950;
				_v8 = _v8 | 0x2a0f624b;
				_v8 = _v8 * 0x3a;
				_v8 = _v8 ^ 0xa0f3ec54;
				_v20 = 0x8a2161;
				_v20 = _v20 + 0xffff45ea;
				_v20 = _v20 ^ 0x1b6c7fa6;
				_v20 = _v20 ^ 0x1be8dede;
				_v16 = 0xdcc12a;
				_v16 = _v16 + 0xb9f4;
				_v16 = _v16 + 0xffffcfef;
				_v16 = _v16 ^ 0x00d9de04;
				E04CBEB52(__ecx, __ecx, 0xb7861dce, 0x3e, 0xa2289af1);
				_t53 = lstrcmpiW(_a4, _t56); // executed
				return _t53;
			}

0x04cd0624
0x04cd0627
0x04cd0629
0x04cd062c
0x04cd062f
0x04cd0630
0x04cd0631
0x04cd0636
0x04cd063d
0x04cd0644
0x04cd064b
0x04cd064f
0x04cd0667
0x04cd066a
0x04cd0671
0x04cd0678
0x04cd067f
0x04cd068b
0x04cd068e
0x04cd0695
0x04cd069c
0x04cd06a3
0x04cd06aa
0x04cd06b1
0x04cd06b8
0x04cd06bf
0x04cd06c6
0x04cd06d9
0x04cd06e5
0x04cd06eb

APIs

lstrcmpiW.KERNEL32(410F7A13,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 04CD06E5

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction ID: 19f7c05df9dbb4f3abaa7dd4b410478c8375cffd7ee5904942d6e50a195c81a7
Opcode Fuzzy Hash: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction Fuzzy Hash: 062110B1C01309EBCF14DFA9D9899DEBFB5FB20354F108298E529A6251D3B49B04DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04CBF7F7, Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04CBF7F7() {

				return  *[fs:0x30];
			}

0x04cbf7fd

Memory Dump Source

Source File: 00000004.00000002.719527275.0000000004CB1000.00000020.00000001.sdmp, Offset: 04CB0000, based on PE: true

Associated: 00000004.00000002.719523049.0000000004CB0000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.719542129.0000000004CD6000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4cb0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6344 Parent PID: 3296 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	97.6%
Signature Coverage:	0%
Total number of Nodes:	1103
Total number of Limit Nodes:	11

Executed Functions

Function 035052B9, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0350537F

Strings

,*FV, xrefs: 035052F7
.9h, xrefs: 035052D9
1, xrefs: 03505326

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: 1$,*FV$.9h
API String ID: 1029625771-1870595533
Opcode ID: 47e2a649f6d09089b8114036349e08445583c90553a88ce36019ef6e82d966d0
Instruction ID: 9135b65517dc24eb2482472a68f68eda2aadad017bc35ac024fc852f868c3e8e
Opcode Fuzzy Hash: 47e2a649f6d09089b8114036349e08445583c90553a88ce36019ef6e82d966d0
Instruction Fuzzy Hash: A92156B6D01209FBEF08DFA8D94A9EEBBB5FB40304F108198E815A6250D3B45B14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 10002D40, Relevance: 6.3, APIs: 4, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.719414263.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.719409694.0000000010000000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122cb37b0b289274c351768ce399d3c8904b2a50bbd0f0c9b0cc6582413b1c49
Instruction ID: 8eda3ac1f8f3e078098bdc719848e1594ce6d4798074e02e4610946cd2a58ef5
Opcode Fuzzy Hash: 122cb37b0b289274c351768ce399d3c8904b2a50bbd0f0c9b0cc6582413b1c49
Instruction Fuzzy Hash: 7CE1E774A00209DFEB05CF94C994AAEB7B6FF8C344F208559E909AB399D770ED42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 03521538, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00040652), ref: 03521615

Strings

d , xrefs: 0352158A
Zs, xrefs: 0352154F

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: Zs$d
API String ID: 2591292051-3879001491
Opcode ID: 38bb643fa24bb4614003e7abf6af2ef3a1b5f649b6f440d52b37eb84a0984821
Instruction ID: 4af9da6036415e2886b64bcd662db1855ed0c874a459e7f055fd3b9b65240092
Opcode Fuzzy Hash: 38bb643fa24bb4614003e7abf6af2ef3a1b5f649b6f440d52b37eb84a0984821
Instruction Fuzzy Hash: 13212CB5D40309EBEB04DFA5D94999DBBB1EB40314F10C099E614BB290D7B95B548F80

Uniqueness

Uniqueness Score: -1.00%

Function 0350D061, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0350D145

Strings

3l}!, xrefs: 0350D0AE
7XJ, xrefs: 0350D0D5

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: 3l}!$7XJ
API String ID: 4033686569-2205417827
Opcode ID: 10709235247fc134180b3dbd0d2fc7697fcbb658dcad94b6e8f128d82acf9f3f
Instruction ID: 301f276ed0e560c328c08579f1b4e5890a80ae8bc58d20339d383ddd252da3f2
Opcode Fuzzy Hash: 10709235247fc134180b3dbd0d2fc7697fcbb658dcad94b6e8f128d82acf9f3f
Instruction Fuzzy Hash: 0D2145B5D01318AFDF18DFA4C98A9DEFBB0FF14304F108188E966A6220D7B85B558F91

Uniqueness

Uniqueness Score: -1.00%

Function 035245CA, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000057,?,00000000,?,?,00000000), ref: 035246B5

Strings

OM , xrefs: 035245FD

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: OM
API String ID: 823142352-4198367855
Opcode ID: c9e2e688d9aa6a43dcdad6de9a4dd150b1ce22289e56966cf6fc1244f0671eef
Instruction ID: 0a98ecf56076a4217f6a194523fa8ed90d3bed7922a4d3140ed84ae38ccd4462
Opcode Fuzzy Hash: c9e2e688d9aa6a43dcdad6de9a4dd150b1ce22289e56966cf6fc1244f0671eef
Instruction Fuzzy Hash: C421EE72801249BBCF05DFA9CD46CDEBFB5FF88304F508199F915A6220D3768A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 10002690, Relevance: 3.1, APIs: 2, Instructions: 98COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00004000), ref: 10002704

Memory Dump Source

Source File: 00000006.00000002.719414263.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.719409694.0000000010000000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3c4ab6a1de08e5656c1cdd8e190091452f899426c6fe537940d40abfc070cfe1
Instruction ID: e47a27f64338b3e84d430cb899d867ed3d67d72a97b2c0655aeaec8263a425f7
Opcode Fuzzy Hash: 3c4ab6a1de08e5656c1cdd8e190091452f899426c6fe537940d40abfc070cfe1
Instruction Fuzzy Hash: 8841B77461410AAFEB48CF58C490BA9B7B2FB88364F14C659EC1A9F355C731EE41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0351648A, Relevance: 1.6, APIs: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(040306B1,?,ED94606E,?,?,?,?,?,?,?,?,?,?,?), ref: 03516543

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f41072fe55694ed81fb5a2d434f63a6d1651ccbd0ba08c91d6bc4f92d8fba8a5
Instruction ID: 54be128f5cf1d8f9bb3870fe49be4acb200fe47ce9153b66dec23d149431b498
Opcode Fuzzy Hash: f41072fe55694ed81fb5a2d434f63a6d1651ccbd0ba08c91d6bc4f92d8fba8a5
Instruction Fuzzy Hash: 3D1103B6C0121DFBDF05DFA5D9098CEBBB4FB40314F108598E811A6260E3B59B249F91

Uniqueness

Uniqueness Score: -1.00%

Function 0351E8B6, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,27C97096,?,?,?,?,?,?,?,?,?,?,?), ref: 0351E94E

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 938ae55f57f10c9ec9f30609793a9938b44550d2e06b30d2dbdd077d207e708c
Instruction ID: 53221378b6a34d7b69e75f894a2383f202e54e3ff525455241ca3c560be7a7fb
Opcode Fuzzy Hash: 938ae55f57f10c9ec9f30609793a9938b44550d2e06b30d2dbdd077d207e708c
Instruction Fuzzy Hash: 9811277190221DFB9B04EFE89D468DFBFB4FF44304F108588E825B6221D3B18B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 0351D11A, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 0351D1B6

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction ID: 4a5d683ba1ee788291f77961a25104c37492817b1b66401c676e44c48e6270d2
Opcode Fuzzy Hash: 67c658d72cc930f45ab36e019061580956781c758de54a32820380ba4476f13f
Instruction Fuzzy Hash: BA1100B1C4030DEBDB44DFE5D94A69EBBB0EB00708F108588D521B6250D3B89A489F90

Uniqueness

Uniqueness Score: -1.00%

Function 100024D0, Relevance: 1.4, APIs: 1, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00001000,00000004), ref: 100025CC

Memory Dump Source

Source File: 00000006.00000002.719414263.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.719409694.0000000010000000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d2bbee85c6cabd151e34b26d14f83d277689191624d3873c1df0f1bcce928bde
Instruction ID: f227e8c1e280d8d0b8d11f9a2f1445d4c625449e48c39147985fdcb30a9e5b67
Opcode Fuzzy Hash: d2bbee85c6cabd151e34b26d14f83d277689191624d3873c1df0f1bcce928bde
Instruction Fuzzy Hash: FE51E9B4A0010AEFDB04CF94C990AAEB7F1FF48345F248598E905AB345D370EE91CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0352061D, Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(410F7A13,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 035206E5

Memory Dump Source

Source File: 00000006.00000002.718929777.0000000003501000.00000020.00000001.sdmp, Offset: 03500000, based on PE: true

Associated: 00000006.00000002.718924842.0000000003500000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.718948522.0000000003526000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3500000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction ID: e85e2444c05a719de3baa56d85dcb9b0ed7d7f1e202ac1b8cae9b10da526f2a2
Opcode Fuzzy Hash: ef59b29d425997034e4fed527bf505b0074c5b4e8b9fa1c114afddacbc91d9b0
Instruction Fuzzy Hash: DC2113B5C0130AABCF14DFA9D9499DEBFB5FB10354F108298E529A6261D3B58B04CF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report nV5Wu77N8J

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Function 10002D40, Relevance: 22.8, APIs: 15, Instructions: 331
COMMON

Function 1002ADAC, Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Function 1002E577, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Function 100036A0, Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 937
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre