Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
crash.bat

Overview

General Information

Sample Name:crash.bat
Analysis ID:1347525
MD5:bc9ae5fde063670508888399f65b2fee
SHA1:8f86773a0da30ccb9e8ba9090a6a405d9a73c510
SHA256:ac47215a8231818e4c424012c1527a3e70087739865b035be9b47fb75d34c030
Tags:bat
Infos:

Detection

Strela Stealer
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Strela Stealer
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
C2 URLs / IPs found in malware configuration
Yara detected EXE embedded in BAT file
Queries the volume information (name, serial number etc) of a device
Drops PE files
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
PE file contains more sections than normal
Creates a process in suspended mode (likely to inject code)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • cmd.exe (PID: 6408 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\crash.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 4124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • findstr.exe (PID: 4128 cmdline: findstr /V ambitious ""C:\Users\user\Desktop\crash.bat"" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
    • certutil.exe (PID: 5272 cmdline: certutil -f -decode hellish therapeutic.dll MD5: F17616EC0522FC5633151F7CAA278CAA)
    • rundll32.exe (PID: 6332 cmdline: rundll32 therapeutic.dll,x MD5: EF3179D498793BF4234F708D3BE28633)
  • cleanup

Malware Configuration

Threatname: Strela Stealer

{
  "C2 url": "91.215.85.209/server.php"
}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
crash.batJoeSecurity_EXEembeddedinBATfileYara detected EXE embedded in BAT fileJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpJoeSecurity_StrelaStealerYara detected Strela StealerJoe Security
      00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_StrelaStealerYara detected Strela StealerJoe Security
        Process Memory Space: rundll32.exe PID: 6332JoeSecurity_StrelaStealerYara detected Strela StealerJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          5.2.rundll32.exe.6d820404.1.unpackJoeSecurity_StrelaStealerYara detected Strela StealerJoe Security
            5.2.rundll32.exe.6d820404.1.raw.unpackJoeSecurity_StrelaStealerYara detected Strela StealerJoe Security
              5.2.rundll32.exe.6d7c0000.0.unpackJoeSecurity_StrelaStealerYara detected Strela StealerJoe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Snort Signatures

                ⊘No Snort rule has matched

                Joe Sandbox Signatures

                • • AV Detection
                • • Networking
                • • System Summary
                • • Data Obfuscation
                • • Persistence and Installation Behavior
                • • Hooking and other Techniques for Hiding and Protection
                • • Malware Analysis System Evasion
                • • HIPS / PFW / Operating System Protection Evasion
                • • Language, Device and Operating System Detection
                • • Stealing of Sensitive Information
                • • Remote Access Functionality

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Source: 5.2.rundll32.exe.6d7c0000.0.unpackMalware Configuration Extractor: Strela Stealer {"C2 url": "91.215.85.209/server.php"}
                Source: crash.batReversingLabs: Detection: 13%
                Source: 91.215.85.209/server.phpAvira URL Cloud: Label: malware
                Source: C:\Users\user\AppData\Local\Temp\therapeutic.dllReversingLabs: Detection: 40%

                Networking

                barindex
                Source: Malware configuration extractorURLs: 91.215.85.209/server.php
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C2C775_2_6D7C2C77
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C144B5_2_6D7C144B
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C270C5_2_6D7C270C
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_000001A500BA1B105_2_000001A500BA1B10
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_000001A500BAE9E85_2_000001A500BAE9E8
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_000001A500BA12405_2_000001A500BA1240
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_000001A500BA67BC5_2_000001A500BA67BC
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_000001A500BA17405_2_000001A500BA1740
                Source: therapeutic.dll.4.drStatic PE information: Number of sections : 17 > 10
                Source: crash.batReversingLabs: Detection: 13%
                Source: C:\Windows\System32\certutil.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 therapeutic.dll,x
                Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\crash.bat" "
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /V ambitious ""C:\Users\user\Desktop\crash.bat""
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\certutil.exe certutil -f -decode hellish therapeutic.dll
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 therapeutic.dll,x
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /V ambitious ""C:\Users\user\Desktop\crash.bat"" Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\certutil.exe certutil -f -decode hellish therapeutic.dll Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 therapeutic.dll,x Jump to behavior
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4124:120:WilError_03
                Source: C:\Windows\System32\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\hellishJump to behavior
                Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\crash.bat" "
                Source: classification engineClassification label: mal88.troj.evad.winBAT@8/2@0/0

                Data Obfuscation

                barindex
                Source: Yara matchFile source: crash.bat, type: SAMPLE
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C1F78 pushfq ; ret 5_2_6D7C1F7D
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C3D74 pushfq ; ret 5_2_6D7C3D79
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C3E6D pushfq ; ret 5_2_6D7C3E72
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C366F pushfq ; ret 5_2_6D7C3674
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C2D6A pushfq ; ret 5_2_6D7C2D6E
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C3352 pushfq ; ret 5_2_6D7C3357
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C4737 pushfq ; ret 5_2_6D7C473C
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C1A2D pushfq ; ret 5_2_6D7C1A31
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C232A pushfq ; ret 5_2_6D7C232F
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C3F27 pushfq ; ret 5_2_6D7C3F2C
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C3017 pushfq ; ret 5_2_6D7C301C
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C390D pushfq ; ret 5_2_6D7C3912
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C1B03 pushfq ; ret 5_2_6D7C1B08
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C39F5 pushfq ; ret 5_2_6D7C39FA
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C40E2 pushfq ; ret 5_2_6D7C40E7
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C2BD7 pushfq ; ret 5_2_6D7C2BDC
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D7C4997 pushfq ; ret 5_2_6D7C499C
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_000001A500BB654E push ecx; retf 003Fh5_2_000001A500BB65AE
                Source: therapeutic.dll.4.drStatic PE information: section name: .xdata
                Source: therapeutic.dll.4.drStatic PE information: section name: /4
                Source: therapeutic.dll.4.drStatic PE information: section name: /19
                Source: therapeutic.dll.4.drStatic PE information: section name: /31
                Source: therapeutic.dll.4.drStatic PE information: section name: /45
                Source: therapeutic.dll.4.drStatic PE information: section name: /57
                Source: therapeutic.dll.4.drStatic PE information: section name: /70
                Source: C:\Windows\System32\certutil.exeFile created: C:\Users\user\AppData\Local\Temp\therapeutic.dllJump to dropped file
                Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: hellish.0.drBinary or memory string: 2F7GBgR0X+pDh86G55YUG2XlqGfQ+ZOwKH6XZucGP1Yf9NfVunx56/pX+LCMxI/UByb4Rl9o+gFlBA6ElBWgpw5ntMUGHxQ+NRQWcm9IiOApeftlGaK85A9GRxQrFKyLOtDXpwDGh4eztHwKe9kwsT55kn11KYqX5cIPB1woxeYCr3KUoAbIXK621teLbajJ+TB8BlJ2FbbTfvdyKSS10x96UsuLpZAuRHfTjJoee8VjvMcIYl6ViuBOY1uGEE0ZhZENGcfAVdv0e9lq+ME6KJFsyKNjD4sUA2/4MCFeypRh3GdpsS7w9CUhfMAnRfC/s6ayEY1SJFMRD/rFADPoGNGRE63bd+p4iFtIWTJm9OR0+2
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /V ambitious ""C:\Users\user\Desktop\crash.bat"" Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\certutil.exe certutil -f -decode hellish therapeutic.dll Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 therapeutic.dll,x Jump to behavior
                Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\rundll32.exeCode function: 5_2_6D81DC10 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,5_2_6D81DC10

                Stealing of Sensitive Information

                barindex
                Source: Yara matchFile source: 5.2.rundll32.exe.6d820404.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.rundll32.exe.6d820404.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6332, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Source: Yara matchFile source: 5.2.rundll32.exe.6d820404.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.rundll32.exe.6d820404.1.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 5.2.rundll32.exe.6d7c0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 6332, type: MEMORYSTR

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
                Valid Accounts1
                Scripting                		Path Interception11
                Process Injection                		1
                Rundll32                		OS Credential Dumping1
                System Time Discovery                		Remote Services1
                Archive Collected Data                		Exfiltration Over Other Network Medium1
                Encrypted Channel                		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
                Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
                Process Injection                		LSASS Memory11
                Security Software Discovery                		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
                Application Layer Protocol                		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
                Domain AccountsAtLogon Script (Windows)Logon Script (Windows)1
                Scripting                		Security Account Manager12
                System Information Discovery                		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyData Encrypted for ImpactDNS ServerEmail Addresses
                Local AccountsCronLogin HookLogin Hook1
                Obfuscated Files or Information                		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureTraffic DuplicationProtocol ImpersonationData DestructionVirtual Private ServerEmployee Names

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 1347525 Sample: crash.bat Startdate: 24/11/2023 Architecture: WINDOWS Score: 88 19 Found malware configuration 2->19 21 Antivirus detection for URL or domain 2->21 23 Multi AV Scanner detection for dropped file 2->23 25 4 other signatures 2->25 6 cmd.exe 2 2->6         started        process3 process4 8 certutil.exe 3 2 6->8         started        11 conhost.exe 6->11         started        13 rundll32.exe 6->13         started        15 findstr.exe 1 6->15         started        file5 17 C:\Users\user\AppData\...\therapeutic.dll, PE32+ 8->17 dropped

                Screenshots

                Download Video

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                crash.bat14%ReversingLabsScript-JS.Packed.Generic

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Local\Temp\therapeutic.dll40%ReversingLabsWin64.Trojan.StrelaStealer

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                91.215.85.209/server.php100%Avira URL Cloudmalware

                Domains and IPs

                Contacted Domains

                ⊘No contacted domains info

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                91.215.85.209/server.phptrue
                • Avira URL Cloud: malware
                		low

                World Map of Contacted IPs

                ⊘No contacted IP infos

                General Information

                Joe Sandbox Version:38.0.0 Ammolite
                Analysis ID:1347525
                Start date and time:2023-11-24 18:06:36 +01:00
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 2m 8s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Run name:Without Instrumentation
                Number of analysed new started processes analysed:6
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample file name:crash.bat
                Detection:MAL
                Classification:mal88.troj.evad.winBAT@8/2@0/0
                EGA Information:
                • Successful, ratio: 100%
                HCA Information:
                • Successful, ratio: 71%
                • Number of executed functions: 5
                • Number of non-executed functions: 16
                Cookbook Comments:
                • Found application associated with file extension: .bat
                • Stop behavior analysis, all processes terminated
                • Exclude process from analysis (whitelisted): dllhost.exe
                • Not all processes where analyzed, report is missing behavior information
                • Report size getting too big, too many NtSetInformationFile calls found.
                • VT rate limit hit for: crash.bat

                Simulations

                Behavior and APIs

                ⊘No simulations

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Users\user\AppData\Local\Temp\hellish

                Download File
                Process:C:\Windows\System32\cmd.exe
                File Type:ASCII text, with very long lines (366), with CRLF line terminators
                Category:modified
                Size (bytes):723778
                Entropy (8bit):5.596221550727205
                Encrypted:false
                SSDEEP:12288:Y7oh5QoNGWGZyTPnjAmM9aZKTz1RpxFg+cO6lKc9NTu7i8AO7QXM3us4PXK:Y7oh5QKGWG0rboasThRpxr56si854PK
                MD5:C9C89A47C7D937EC0F26092DD8427B70
                SHA1:69B578F01B7386BE72D7CAFCB45BDA823FE29A97
                SHA-256:338DCBD0F75ABD063E351BF27C13255EC0F776964CCB7C148EC46806C158EC2E
                SHA-512:3300A7822EA99D5CE8D2B28108EAEA4AF1D2ECACAA5FCEAE9FB691531A1F8AD803010C10D2DC2BEE36EA922D284A18B3C169D350241A5106E2E814FB9A58B4E5
                Malicious:false
                Reputation:low
                Preview:TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYRALppuGQA6gcAkAMAAPAAJiALAgIeAOIFAAC4BwAACgAAMBMAAAAQAAAAAHxtAAAAAAAQAAAAAgAABAAAAAAAAAAFAAIAAAAAAADACAAABgAAoqMIAAMAAAAAACAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAIADwAAAAAEA..gAsAUAAAAAAAAAAAAAANAHADQCAAAAAAAAAAAAAABACABkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMAHACgAAAAAAAAAAAAAAAAAAAAAAAAAbBEIADABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAPjhBQAAEAAAAOIFAAAGAAAAAAAAAAAAAAAAAABgAFBgLmRhdGEAAADAvAEAAAAGAAC+AQAA6AUAAAAAAAAAAAAAAAAAQABQwC5yZGF0YQAAgAIAAADABwAABAAAAKYHAAAAAAAAAAAAAAAAAEAAYEAucGRhdGEAADQCAAAA0AcAAAQAAACqBwAAAAAAAAAAAAAAAABA..ADBALnhkYXRhAADMAQAAAOAHAAACAAAArgcAAAAAAAAAAAAAAAAAQAAwQC5ic3MAAAAAMAkAAADwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAYMAuZWRhdGEAADwAAAAAAAgAAAIAAACwBwAAAAAAAAAAAAAAAABAADBALmlkYXRhAACwBQAAABAIAAAGAAAAsgcAAAAAAAAAAAAAAAAAQAAwwC5DUlQAAAAAWAAAAAAgCAAAAgAAALgHAAAAAAAAAAAAAAAA

                C:\Users\user\AppData\Local\Temp\therapeutic.dll

                Download File
                Process:C:\Windows\System32\certutil.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):539883
                Entropy (8bit):6.701081088318034
                Encrypted:false
                SSDEEP:6144:ERSCSg+gfUYRjOuVZFGNRwND7Pypwwf/43wWPpoApvmJraTKzv:ExN21wwCwTA8rSKD
                MD5:19808287DD44452A6DA3596468487675
                SHA1:D485F9EAAFE0BF0CF7EB77173E6050B54BA05611
                SHA-256:EFD7A52121867B0D7A60B0FD609FC47726002033662736D309A1B94AA857FB98
                SHA-512:2863BB7687A08AD36E8642FC6FDD4A4A9822D24A1D91DA4A0AC19389C1E6ACBEDAD23A803A497DC1C91BAEF6E19A4DBB4B4108007A5E2A88FFDC81047DFE2751
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 40%
                Reputation:low
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....i.d..........& ................0.........|m.............................................. .........................................<.......................4............@..d...........................@...(...................l...0............................text...............................`.P`.data...............................@.P..rdata..............................@.`@.pdata..4...........................@.0@.xdata..............................@.0@.bss....0.............................`..edata..<...........................@.0@.idata..............................@.0..CRT....X.... ......................@.@..tls.........0......................@.@..reloc..d....@......................@.0B/4......P....P......................@.PB/19..........`... ..................@..B/31.....I...........................@..B/45....."...........................@..B/57.....

                Static File Info

                General

                File type:ASCII text, with very long lines (366), with CRLF line terminators
                Entropy (8bit):5.618323533842012
                TrID:
                  File name:crash.bat
                  File size:730'262 bytes
                  MD5:bc9ae5fde063670508888399f65b2fee
                  SHA1:8f86773a0da30ccb9e8ba9090a6a405d9a73c510
                  SHA256:ac47215a8231818e4c424012c1527a3e70087739865b035be9b47fb75d34c030
                  SHA512:922732a178c5c61e00d50702c9d2df52a946f113878947220ae26db2954475acdd475791b58b0f0b79a50c14ed539d0f3e0d447f9c041b6802a6a1f821fcba47
                  SSDEEP:12288:O7oh5QoNGWGZyTPnjAmM9aZKTz1RpxFg+cO6lKc9NTu7i8AO7QXM3us4PXc:O7oh5QKGWG0rboasThRpxr56si854Pc
                  TLSH:7BF44BF472D077D70F75694DB3CE40B23D54B457F0EEEE86228D0D1E928429899ABEA0
                  File Content Preview:/* ambitious..set ambitiouskillprovide=y..set ambitiousraspylanguage=e..set ambitiousfranticsense=h..set ambitioustangibledamaged=z..set ambitioushuntoatmeal=r..set ambitiouspointlessopposite=a..set ambitiouspreparearithmetic=b..set ambitioussplendidirrit

                  File Icon

                  Icon Hash:9686878b929a9886

                  Network Behavior

                  ⊘No network behavior found

                  Statistics

                  CPU Usage

                  Click to jump to process

                  Memory Usage

                  Click to jump to process

                  High Level Behavior Distribution

                  • • File
                  • • Registry

                  Click to dive into process behavior distribution

                  Behavior

                  Click to jump to process

                  System Behavior

                  General

                  Target ID:0
                  Start time:18:07:22
                  Start date:24/11/2023
                  Path:C:\Windows\System32\cmd.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\crash.bat" "
                  Imagebase:0x7ff667f60000
                  File size:289'792 bytes
                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true
                  Show Windows behavior

                  File Activities

                  Show Windows behavior

                  Section Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Process Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Memory Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                  General

                  Target ID:1
                  Start time:18:07:22
                  Start date:24/11/2023
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6d64d0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true
                  Show Windows behavior

                  File Activities

                  Show Windows behavior

                  Section Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Mutex Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Thread Activities

                  Show Windows behavior

                  Memory Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Windows UI Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                  General

                  Target ID:3
                  Start time:18:07:22
                  Start date:24/11/2023
                  Path:C:\Windows\System32\findstr.exe
                  Wow64 process (32bit):false
                  Commandline:findstr /V ambitious ""C:\Users\user\Desktop\crash.bat""
                  Imagebase:0x7ff77a030000
                  File size:36'352 bytes
                  MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:moderate
                  Has exited:true
                  Show Windows behavior

                  File Activities

                  Show Windows behavior

                  Section Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                  Thread Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                  General

                  Target ID:4
                  Start time:18:07:30
                  Start date:24/11/2023
                  Path:C:\Windows\System32\certutil.exe
                  Wow64 process (32bit):false
                  Commandline:certutil -f -decode hellish therapeutic.dll
                  Imagebase:0x7ff7290a0000
                  File size:1'651'712 bytes
                  MD5 hash:F17616EC0522FC5633151F7CAA278CAA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:moderate
                  Has exited:true
                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Section Activities

                  Show Windows behavior

                  Registry Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                  Thread Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Windows UI Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                  General

                  Target ID:5
                  Start time:18:07:30
                  Start date:24/11/2023
                  Path:C:\Windows\System32\rundll32.exe
                  Wow64 process (32bit):false
                  Commandline:rundll32 therapeutic.dll,x
                  Imagebase:0x7ff761c90000
                  File size:71'680 bytes
                  MD5 hash:EF3179D498793BF4234F708D3BE28633
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                  Reputation:high
                  Has exited:true
                  Show Windows behavior

                  File Activities

                  Show Windows behavior

                  Section Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                  Show Windows behavior

                  Process Activities

                  Thread Activities

                  Show Windows behavior

                  Memory Activities

                  Show Windows behavior

                  System Activities

                  Show Windows behavior

                  Windows UI Activities

                  There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                  Disassembly

                  Execution Graph

                  Execution Coverage

                  Dynamic/Packed Code Coverage

                  Signature Coverage

                  Execution Coverage:1.5%
                  Dynamic/Decrypted Code Coverage:58.1%
                  Signature Coverage:3.5%
                  Total number of Nodes:258
                  Total number of Limit Nodes:13
                  Show Legend
                  Hide Nodes/Edges
                  execution_graph 6008 1a500bac640 6009 1a500ba91c4 RtlAllocateHeap 6008->6009 6010 1a500bac649 6009->6010 6018 1a500ba9e84 6019 1a500ba9e94 Concurrency::details::SchedulerProxy::DeleteThis 6018->6019 6024 1a500ba9a44 6019->6024 6021 1a500ba9e9d 6023 1a500ba9ea6 Concurrency::details::SchedulerProxy::DeleteThis 6021->6023 6028 1a500ba9c8c 6021->6028 6025 1a500ba9a63 _invalid_parameter_noinfo Concurrency::details::SchedulerProxy::DeleteThis __free_lconv_num 6024->6025 6027 1a500ba9a8c Concurrency::details::SchedulerProxy::DeleteThis 6024->6027 6025->6021 6027->6025 6032 1a500ba994c 6027->6032 6029 1a500ba9cb2 6028->6029 6030 1a500ba9a44 LoadLibraryW 6029->6030 6031 1a500ba9cea 6029->6031 6030->6031 6031->6023 6033 1a500ba996d __free_lconv_num 6032->6033 6034 1a500ba99cf __free_lconv_num 6033->6034 6035 1a500baa9c8 LoadLibraryW 6033->6035 6034->6027 6035->6033 6036 1a500bab462 6037 1a500bab48e __free_lconv_num 6036->6037 6038 1a500baa9c8 LoadLibraryW 6037->6038 6039 1a500bab4ee 6037->6039 6038->6037 5804 1a500ba8398 5805 1a500ba83fa 5804->5805 5814 1a500baa964 5805->5814 5809 1a500ba84ea 5810 1a500baa964 LoadLibraryW 5809->5810 5811 1a500ba859a 5810->5811 5824 1a500ba7e44 5811->5824 5813 1a500ba85dd 5831 1a500baa750 5814->5831 5817 1a500ba7cc8 5818 1a500ba7d16 5817->5818 5823 1a500ba7cf2 __free_lconv_num 5817->5823 5819 1a500ba7d1b __free_lconv_num 5818->5819 5821 1a500ba7d70 __free_lconv_num 5818->5821 5820 1a500ba7024 RtlAllocateHeap 5819->5820 5819->5823 5820->5823 5822 1a500ba7024 RtlAllocateHeap 5821->5822 5821->5823 5822->5823 5823->5809 5825 1a500ba7e92 5824->5825 5830 1a500ba7e6e __free_lconv_num 5824->5830 5826 1a500ba7e98 __free_lconv_num 5825->5826 5828 1a500ba7eec __free_lconv_num 5825->5828 5827 1a500ba7024 RtlAllocateHeap 5826->5827 5826->5830 5827->5830 5829 1a500ba7024 RtlAllocateHeap 5828->5829 5828->5830 5829->5830 5830->5813 5833 1a500ba84a5 5831->5833 5834 1a500baa7a8 __vcrt_InitializeCriticalSectionEx 5831->5834 5832 1a500baa7dd LoadLibraryW 5832->5833 5832->5834 5833->5817 5834->5832 5834->5833 5835 6d7c1330 5836 6d7c1346 5835->5836 5841 6d81dc10 5836->5841 5838 6d7c1363 5845 6d81e500 5838->5845 5842 6d81dc50 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 5841->5842 5843 6d81dc39 5841->5843 5844 6d81dcab 5842->5844 5843->5838 5844->5838 5847 6d81e50f 5845->5847 5846 6d7c1368 5847->5846 5851 6d81eae0 5847->5851 5849 6d81e537 5849->5846 5850 6d81e5d0 RtlAddFunctionTable 5849->5850 5850->5846 5853 6d81eaef 5851->5853 5852 6d81eb60 5852->5849 5853->5852 5854 6d81eb3e strncmp 5853->5854 5854->5853 5855 6d81eb53 5854->5855 5855->5849 5796 1a500ba6399 5800 1a500ba639e 5796->5800 5797 1a500ba6452 5800->5797 5801 1a500ba6468 5800->5801 5802 1a500ba6475 5801->5802 5803 1a500ba6491 ExitProcess 5802->5803 5737 1a500baa750 5739 1a500baa7ad 5737->5739 5740 1a500baa7a8 __vcrt_InitializeCriticalSectionEx 5737->5740 5738 1a500baa7dd LoadLibraryW 5738->5739 5738->5740 5740->5738 5740->5739 6011 1a500ba9830 6013 1a500ba9838 6011->6013 6014 1a500ba9865 __vcrt_uninitialize_locks 6013->6014 6015 1a500baa9c8 6013->6015 6016 1a500baa750 LoadLibraryW 6015->6016 6017 1a500baa9fe 6016->6017 6017->6013 5741 1a500ba5f54 5742 1a500ba5f6d 5741->5742 5746 1a500ba5f69 __free_lconv_num 5741->5746 5747 1a500ba91c4 5742->5747 5748 1a500ba91d1 5747->5748 5750 1a500ba5f72 5747->5750 5755 1a500ba8e9c 5748->5755 5751 1a500ba9720 GetEnvironmentStringsW 5750->5751 5752 1a500ba9750 5751->5752 5754 1a500ba9749 __free_lconv_num 5751->5754 5753 1a500ba7024 RtlAllocateHeap 5752->5753 5752->5754 5753->5754 5754->5746 5762 1a500ba910c 5755->5762 5757 1a500ba8ed1 5761 1a500ba8eee __free_lconv_num 5757->5761 5766 1a500ba7024 5757->5766 5759 1a500ba8eff 5759->5761 5770 1a500ba9240 5759->5770 5761->5750 5763 1a500ba912f __GetCurrentState Concurrency::details::SchedulerProxy::DeleteThis __free_lconv_num 5762->5763 5764 1a500ba91ab 5763->5764 5765 1a500ba8e9c RtlAllocateHeap 5763->5765 5764->5757 5765->5764 5768 1a500ba706d __free_lconv_num 5766->5768 5769 1a500ba7033 __free_lconv_num 5766->5769 5767 1a500ba7056 RtlAllocateHeap 5767->5768 5767->5769 5768->5759 5769->5767 5769->5768 5773 1a500ba926d __scrt_get_show_window_mode 5770->5773 5771 1a500ba93c3 _log10_special 5771->5761 5773->5771 5774 1a500ba8cb4 5773->5774 5775 1a500ba8cf1 5774->5775 5776 1a500ba8d7b _log10_special 5774->5776 5775->5776 5778 1a500baa1b4 5775->5778 5776->5771 5779 1a500baa1f6 5778->5779 5780 1a500ba7024 RtlAllocateHeap 5779->5780 5781 1a500baa233 _log10_special __scrt_get_show_window_mode __free_lconv_num 5779->5781 5780->5781 5781->5776 5856 1a500bac3f4 5857 1a500bac400 5856->5857 5859 1a500bac435 _log10_special __free_lconv_num 5856->5859 5857->5859 5860 1a500baaa38 5857->5860 5861 1a500baa750 LoadLibraryW 5860->5861 5862 1a500baaa76 5861->5862 5864 1a500baaa7e 5862->5864 5865 1a500baab24 5862->5865 5864->5859 5866 1a500baa750 LoadLibraryW 5865->5866 5867 1a500baab52 5866->5867 5867->5864 5868 1a500ba1d08 5869 1a500ba1d18 _RTC_Initialize 5868->5869 5873 1a500ba1d5d 5869->5873 5874 1a500ba21ac 5869->5874 5871 1a500ba1d51 5877 1a500ba5dcc 5871->5877 5883 1a500ba2170 5874->5883 5876 1a500ba21b5 5876->5871 5878 1a500ba5dec 5877->5878 5879 1a500ba5df4 _invalid_parameter_noinfo __free_lconv_num 5877->5879 5878->5879 5880 1a500ba91c4 RtlAllocateHeap 5878->5880 5879->5873 5881 1a500ba5e0f 5880->5881 5908 1a500ba88a8 5881->5908 5884 1a500ba218a 5883->5884 5886 1a500ba2183 5883->5886 5887 1a500ba6b08 5884->5887 5886->5876 5890 1a500ba6744 5887->5890 5889 1a500ba6b4a 5889->5886 5891 1a500ba6760 Concurrency::details::SchedulerProxy::DeleteThis 5890->5891 5894 1a500ba67bc 5891->5894 5893 1a500ba6769 Concurrency::details::SchedulerProxy::DeleteThis 5893->5889 5895 1a500ba67e8 5894->5895 5899 1a500ba6873 __free_lconv_num 5894->5899 5898 1a500ba684f __free_lconv_num 5895->5898 5895->5899 5900 1a500baabec 5895->5900 5897 1a500baabec RtlAllocateHeap 5897->5899 5898->5897 5898->5899 5899->5893 5901 1a500baac0e 5900->5901 5903 1a500baac1c __scrt_get_show_window_mode __free_lconv_num 5901->5903 5904 1a500ba6f6c 5901->5904 5903->5898 5905 1a500ba6f81 5904->5905 5906 1a500ba6f89 __free_lconv_num 5904->5906 5907 1a500ba7024 RtlAllocateHeap 5905->5907 5906->5903 5907->5906 5909 1a500ba88e9 5908->5909 5910 1a500ba88ed _log10_special 5909->5910 5911 1a500baa964 LoadLibraryW 5909->5911 5910->5879 5911->5910 5912 6d7c1380 5913 6d81ef20 5912->5913 5914 6d81ef37 _lock 5913->5914 5915 6d81ef6b 5913->5915 5918 6d81ef47 5914->5918 5916 6d81ef54 _unlock 5916->5915 5917 6d81efd7 _unlock 5917->5915 5918->5916 5918->5917 5919 6d81ef95 5918->5919 5919->5916 5920 6d7c1200 5921 6d7c121f 5920->5921 5922 6d7c1273 5920->5922 5931 6d7c1258 5921->5931 5933 6d81e0a0 5921->5933 5923 6d81e0a0 19 API calls 5922->5923 5924 6d7c1278 5923->5924 5926 6d7c1010 5 API calls 5924->5926 5927 6d7c122e 5924->5927 5929 6d7c12ad 5926->5929 5927->5931 5960 6d7c1010 5927->5960 5929->5927 5929->5931 5932 6d7c12ca 5929->5932 5930 6d7c1010 5 API calls 5930->5931 5932->5930 5932->5931 5934 6d81e0d3 5933->5934 5937 6d81e0c2 5933->5937 5935 6d81e140 5934->5935 5934->5937 5947 6d81e213 5934->5947 5935->5937 5939 6d81e197 5935->5939 5975 6d81ded0 5935->5975 5936 6d81e33a 5940 6d81e3d0 5936->5940 5941 6d81e36d 5936->5941 5937->5927 5939->5937 5951 6d81e1c2 VirtualProtect 5939->5951 5943 6d81e490 5940->5943 5944 6d81e3db 5940->5944 5945 6d81e374 5941->5945 5946 6d81e3ef signal 5941->5946 5942 6d81ded0 11 API calls 5942->5947 5950 6d81e401 5943->5950 5955 6d81e4a6 signal 5943->5955 5948 6d81e3dd 5944->5948 5952 6d81e414 5944->5952 5945->5950 5945->5952 5953 6d81e385 5945->5953 5949 6d81e470 signal 5946->5949 5946->5950 5947->5936 5947->5937 5947->5939 5947->5942 5948->5946 5948->5950 5949->5950 5950->5927 5951->5939 5952->5950 5954 6d81e422 signal 5952->5954 5953->5950 5957 6d81e39b signal 5953->5957 5956 6d81e4c0 signal 5954->5956 5959 6d81e3b1 5954->5959 5955->5959 5956->5959 5958 6d81e4e0 signal 5957->5958 5957->5959 5958->5959 5959->5927 5961 6d7c1026 5960->5961 5967 6d7c10a0 5960->5967 5962 6d7c108b 5961->5962 5964 6d7c106a 5961->5964 5965 6d7c1052 Sleep 5961->5965 5962->5931 5963 6d7c1153 5963->5931 5968 6d7c107c _amsg_exit 5964->5968 5969 6d7c1165 5964->5969 5965->5961 5966 6d7c10ed 5973 6d7c11b0 _initterm 5966->5973 5974 6d7c110b 5966->5974 5967->5963 5967->5966 5970 6d7c10d9 Sleep 5967->5970 5968->5962 6004 6d81eff0 5969->6004 5970->5967 5973->5974 5974->5931 5976 6d81df9e 5975->5976 5977 6d81def2 5975->5977 5976->5935 5976->5976 5977->5976 5978 6d81df5c VirtualQuery 5977->5978 5982 6d81e070 5977->5982 5979 6d81df8a 5978->5979 5978->5982 5979->5976 5980 6d81e000 VirtualProtect 5979->5980 5980->5976 5981 6d81e030 GetLastError 5980->5981 5981->5976 5983 6d81e33a 5982->5983 5984 6d81e140 5982->5984 5998 6d81e0c2 5982->5998 5985 6d81e3d0 5983->5985 5986 6d81e36d 5983->5986 5994 6d81e1c2 VirtualProtect 5984->5994 5984->5998 5987 6d81e3db 5985->5987 5992 6d81e490 5985->5992 5988 6d81e374 5986->5988 5989 6d81e3ef signal 5986->5989 5990 6d81e3dd 5987->5990 5995 6d81e414 5987->5995 5993 6d81e401 5988->5993 5988->5995 5996 6d81e385 5988->5996 5991 6d81e470 signal 5989->5991 5989->5993 5990->5989 5990->5993 5991->5993 5992->5993 5999 6d81e4a6 signal 5992->5999 5993->5935 5994->5984 5995->5993 5997 6d81e422 signal 5995->5997 5996->5993 6001 6d81e39b signal 5996->6001 6000 6d81e4c0 signal 5997->6000 6003 6d81e3b1 5997->6003 5998->5935 5999->6003 6000->6003 6002 6d81e4e0 signal 6001->6002 6001->6003 6002->6003 6003->5935 6005 6d81f004 6004->6005 6006 6d7c1171 6005->6006 6007 6d81f04d free 6005->6007 6006->5931 6007->6006 5782 1a500ba1dec 5787 1a500ba1fb0 5782->5787 5784 1a500ba1e00 __scrt_get_show_window_mode __scrt_acquire_startup_lock __scrt_release_startup_lock 5784->5782 5786 1a500ba1e4b 5784->5786 5791 1a500ba61a0 5784->5791 5794 1a500ba25b4 5787->5794 5790 1a500ba1fdb __scrt_initialize_crt 5790->5784 5792 1a500ba91c4 RtlAllocateHeap 5791->5792 5793 1a500ba61af 5792->5793 5793->5784 5795 1a500ba1fd2 __scrt_dllmain_crt_thread_attach 5794->5795 5795->5790

                  Executed Functions

                  Control-flow Graph

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4ab90fbaa547de31237a47299d8dcf17c26792cfeb83a94c4f8be24b4767d41f
                  • Instruction ID: 61054f9382f32c4ac9ea1178ae9625a47fc27e24cbbb7d4c912a12a52aa11be6
                  • Opcode Fuzzy Hash: 4ab90fbaa547de31237a47299d8dcf17c26792cfeb83a94c4f8be24b4767d41f
                  • Instruction Fuzzy Hash: EA510A3160CA548BF76CDF28DC4D2EE77E6FB86321F40492EE08BDA095EA39D5058742
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: e394acae8d0c5c1d098580eb93f18f15118eb964f95ba87f72cb3a85f677172b
                  • Instruction ID: 3375e26fd570dfd76608c66295022ab4b508625d8c77ab56bb4f964671769b4b
                  • Opcode Fuzzy Hash: e394acae8d0c5c1d098580eb93f18f15118eb964f95ba87f72cb3a85f677172b
                  • Instruction Fuzzy Hash: 3B51283131DE194FF759AB199D882BA33C2E79A321F14412DF446C32A9EF24EC028697
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  APIs
                  • GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000001A500BA5F77), ref: 000001A500BA9739
                    • Part of subcall function 000001A500BA7024: RtlAllocateHeap.NTDLL ref: 000001A500BA7062
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: AllocateEnvironmentHeapStrings
                  • String ID:
                  • API String ID: 4128402249-0
                  • Opcode ID: 2c7e0ff2c99f30fc8464828f7296def7d9bda60d9e6e20c17c4b7a38986661b7
                  • Instruction ID: 5f42d48406437a9bafe784ea15ec93e6fac36cafb721abca148ade9b4c6f48e6
                  • Opcode Fuzzy Hash: 2c7e0ff2c99f30fc8464828f7296def7d9bda60d9e6e20c17c4b7a38986661b7
                  • Instruction Fuzzy Hash: E731B03072DF2C4FEBA4AF6859452AE76D2FB4A360F40052EB48AC3295DB30CC409783
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  APIs
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: b20df32957e6063642f50c38a775f15869f834a38cfda6d0d60968ee64a1a189
                  • Instruction ID: da4c17991da7649d662b2b406cda3189ef9cbb0bd31efea1c240edb619424187
                  • Opcode Fuzzy Hash: b20df32957e6063642f50c38a775f15869f834a38cfda6d0d60968ee64a1a189
                  • Instruction Fuzzy Hash: 43F0893036EE154AFB74A7790E957BD21C2EB5B331F4414247882C21DAEE68C840C113
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  APIs
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: ExitProcess
                  • String ID:
                  • API String ID: 621844428-0
                  • Opcode ID: d31ba4df86540271e51aa99aa21df2c9756cccc32a690f4676fb70f3e9fc18fc
                  • Instruction ID: ec73f00b541cdb9896a9ff6d7150ad045e9bf0429e99672c1802fe73b275d7fd
                  • Opcode Fuzzy Hash: d31ba4df86540271e51aa99aa21df2c9756cccc32a690f4676fb70f3e9fc18fc
                  • Instruction Fuzzy Hash: 21D05E747496044BFF587BB05A982ED2752CB4A315F0418297543CB7DBCE3988088742
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Control-flow Graph

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 6D81DC55
                  • GetCurrentProcessId.KERNEL32 ref: 6D81DC60
                  • GetCurrentThreadId.KERNEL32 ref: 6D81DC69
                  • GetTickCount.KERNEL32 ref: 6D81DC71
                  • QueryPerformanceCounter.KERNEL32 ref: 6D81DC7E
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081689356.000000006D7C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D7C0000, based on PE: true
                  • Associated: 00000005.00000002.2081676559.000000006D7C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081735965.000000006D83C000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081747544.000000006D841000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D846000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D84B000.00000002.00000001.01000000.00000004.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_6d7c0000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: 7b63a19cbcc4ce6c2eef7467b078b1d9941821b456779c70f1005518f10611cf
                  • Instruction ID: dc4c99784f0eceae880f772b6ee7880057ed01f0d7846c8e2fb2d0e79bb9d06c
                  • Opcode Fuzzy Hash: 7b63a19cbcc4ce6c2eef7467b078b1d9941821b456779c70f1005518f10611cf
                  • Instruction Fuzzy Hash: 0311E366B15A5559FB204B25FC08359B3A1B789BF0F085B329E9C43BA4EF3CD5A6C300
                  Uniqueness

                  Uniqueness Score: -1.00%

                  APIs
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: _clrfp
                  • String ID:
                  • API String ID: 3618594692-0
                  • Opcode ID: d56964a5f49c9b40b8adc3917d1bac2300405c3cd4435244373557d2ff83d0fa
                  • Instruction ID: 2a3ef0b6834bf05503d218d5c3093e3255783d19e38027ed4569b3ed3c07872b
                  • Opcode Fuzzy Hash: d56964a5f49c9b40b8adc3917d1bac2300405c3cd4435244373557d2ff83d0fa
                  • Instruction Fuzzy Hash: 86C19130214B5D8FEB98CF1CC58AB9937E1FF46324F558599E8A9CB2A5C335D851CB02
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 899b2e6578edd9a1b095aa592ee760f9b6ad1a4752dc88a3c39aa905f43cb305
                  • Instruction ID: a85a192abc7f1ff53552e08edf989bfa38993b67d13dae534bd9874faa265f21
                  • Opcode Fuzzy Hash: 899b2e6578edd9a1b095aa592ee760f9b6ad1a4752dc88a3c39aa905f43cb305
                  • Instruction Fuzzy Hash: 95E15F70618B888BEB65DF18D8957EE77E2FB95314F004A1EE48AD3164DF349641CB82
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081689356.000000006D7C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D7C0000, based on PE: true
                  • Associated: 00000005.00000002.2081676559.000000006D7C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081735965.000000006D83C000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081747544.000000006D841000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D846000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D84B000.00000002.00000001.01000000.00000004.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_6d7c0000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4f54bf6f7cd7cba3dbdddf3265dfadd7ee59e53b54eee2a6ff8b64330d62a57d
                  • Instruction ID: 29b6ddb054953b6d4a777895ccff16241a250442a8f8053ecf451a46508fa725
                  • Opcode Fuzzy Hash: 4f54bf6f7cd7cba3dbdddf3265dfadd7ee59e53b54eee2a6ff8b64330d62a57d
                  • Instruction Fuzzy Hash: 8CB1CFAB7E19021CFA26593A8B217DF1E71A362778F277F019E305B3F6C67A414A5200
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081689356.000000006D7C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D7C0000, based on PE: true
                  • Associated: 00000005.00000002.2081676559.000000006D7C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081735965.000000006D83C000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081747544.000000006D841000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D846000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D84B000.00000002.00000001.01000000.00000004.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_6d7c0000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f8aa46beac6f61392775fce6f5ab917fb2a0dd34b8b9cfb237716bfd4e88f00a
                  • Instruction ID: 29f217926de9602ca570867c581fe4ec0a1a87a3d1c758fcd6d10006fa8c929c
                  • Opcode Fuzzy Hash: f8aa46beac6f61392775fce6f5ab917fb2a0dd34b8b9cfb237716bfd4e88f00a
                  • Instruction Fuzzy Hash: DEB1CFAB7F19021CFA26593A8B217DF1E71A362778F277F019E305B3F6C67A414A5200
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 93d4d12f09b85e87e1a7be2692fdd10d2d9dc54227c38850a4f6943f9870d6fb
                  • Instruction ID: ba658fe966d3e57b3957416f339266c0852be430448c116943fcffc5f4475e76
                  • Opcode Fuzzy Hash: 93d4d12f09b85e87e1a7be2692fdd10d2d9dc54227c38850a4f6943f9870d6fb
                  • Instruction Fuzzy Hash: 41B18331208E588FEB69EF28DC557EE73E1FB95311F00462AE49BD3195DF349A058B82
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081689356.000000006D7C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D7C0000, based on PE: true
                  • Associated: 00000005.00000002.2081676559.000000006D7C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081735965.000000006D83C000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081747544.000000006D841000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D846000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D84B000.00000002.00000001.01000000.00000004.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_6d7c0000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6da2e321d4bf3fd84724f255799914a25ae5704a16a1417d17132af3f424d289
                  • Instruction ID: d4f2f25ec7426b8464927d4aca7167910f7f69772aff0995487297ba58a4fa99
                  • Opcode Fuzzy Hash: 6da2e321d4bf3fd84724f255799914a25ae5704a16a1417d17132af3f424d289
                  • Instruction Fuzzy Hash: D8B1D8BB7A1A8108FB258B399B147EF2A70B351BB8F127B15DE384B7F4DE7941419210
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: f10fd97f69d521058c5aaafffa8a1be1807758c8cba4beff399fa7c1d450c5e9
                  • Instruction ID: 9e18d947b1c9bf90ce37c65089e273495e7575b0c17c67a780e45c31c4a56f65
                  • Opcode Fuzzy Hash: f10fd97f69d521058c5aaafffa8a1be1807758c8cba4beff399fa7c1d450c5e9
                  • Instruction Fuzzy Hash: 46512732318E1C4FDB1CDF2CD4996B973D2E7AE320B15822EF44AC72A5DA34D8468781
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 119 6d81e0a0-6d81e0c0 120 6d81e0d3-6d81e12a call 6d81ebf0 call 6d81ee40 119->120 121 6d81e0c2-6d81e0d2 119->121 120->121 126 6d81e12c-6d81e132 120->126 127 6d81e200-6d81e202 126->127 128 6d81e138-6d81e13a 126->128 129 6d81e140-6d81e143 127->129 130 6d81e208-6d81e20d 127->130 128->129 131 6d81e1e4-6d81e1e9 128->131 129->121 133 6d81e149-6d81e168 129->133 130->129 134 6d81e213-6d81e219 130->134 131->129 132 6d81e1ef-6d81e1f4 131->132 132->134 135 6d81e1f6-6d81e1fd 132->135 136 6d81e174-6d81e195 call 6d81ded0 133->136 137 6d81e21f-6d81e23b 134->137 138 6d81e34e-6d81e36b call 6d81f150 134->138 135->127 149 6d81e170 136->149 150 6d81e197-6d81e1a8 136->150 140 6d81e285-6d81e29a 137->140 141 6d81e23d 137->141 151 6d81e3d0-6d81e3d5 138->151 152 6d81e36d-6d81e372 138->152 145 6d81e242 140->145 146 6d81e29c-6d81e2cd call 6d81ded0 140->146 141->121 147 6d81e300-6d81e303 145->147 148 6d81e248-6d81e24b 145->148 174 6d81e278-6d81e27f 146->174 162 6d81e305-6d81e335 call 6d81ded0 147->162 163 6d81e33a-6d81e349 call 6d81f150 147->163 154 6d81e251-6d81e254 148->154 155 6d81e2d0-6d81e2fa call 6d81ded0 148->155 149->136 150->121 158 6d81e1ae 150->158 156 6d81e490-6d81e4a0 call 6d81eeb8 151->156 157 6d81e3db 151->157 159 6d81e374-6d81e379 152->159 160 6d81e3ef-6d81e3ff signal 152->160 154->163 165 6d81e25a-6d81e273 call 6d81ded0 154->165 155->174 169 6d81e401-6d81e404 156->169 193 6d81e4a6-6d81e4b7 signal 156->193 166 6d81e414-6d81e419 157->166 167 6d81e3dd-6d81e3e2 157->167 168 6d81e1b0-6d81e1c0 158->168 172 6d81e484-6d81e48a 159->172 173 6d81e37f 159->173 160->169 170 6d81e470-6d81e47f signal call 6d81ee30 160->170 162->174 163->138 165->174 166->172 181 6d81e41b-6d81e420 166->181 167->172 178 6d81e3e8-6d81e3ed 167->178 184 6d81e1d0-6d81e1dd 168->184 185 6d81e1c2-6d81e1cd VirtualProtect 168->185 179 6d81e406-6d81e413 169->179 180 6d81e45e-6d81e467 169->180 170->172 188 6d81e450-6d81e455 173->188 189 6d81e385-6d81e38a 173->189 174->140 174->150 178->160 178->180 181->180 190 6d81e422-6d81e432 signal 181->190 184->168 192 6d81e1df 184->192 185->184 188->190 191 6d81e457-6d81e45c 188->191 189->172 194 6d81e390-6d81e395 189->194 196 6d81e4c0-6d81e4d1 signal 190->196 197 6d81e438-6d81e43b 190->197 191->172 191->180 192->121 198 6d81e3c3-6d81e3c7 193->198 194->180 199 6d81e39b-6d81e3ab signal 194->199 196->198 200 6d81e441-6d81e44e 197->200 201 6d81e4f6-6d81e4fb 197->201 202 6d81e3b1-6d81e3b4 199->202 203 6d81e4e0-6d81e4f1 signal 199->203 201->198 202->201 204 6d81e3ba-6d81e3c1 202->204 203->198 204->198
                  APIs
                  • VirtualProtect.KERNEL32(?,?,?,?,?,?,6D7C1278), ref: 6D81E1CD
                  Strings
                  • Unknown pseudo relocation protocol version %d., xrefs: 6D81E34E
                  • Unknown pseudo relocation bit size %d., xrefs: 6D81E33A
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081689356.000000006D7C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D7C0000, based on PE: true
                  • Associated: 00000005.00000002.2081676559.000000006D7C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081735965.000000006D83C000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081747544.000000006D841000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D846000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D84B000.00000002.00000001.01000000.00000004.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_6d7c0000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                  • API String ID: 544645111-395989641
                  • Opcode ID: 6a91665792fec78edc54ec87d1a1cae77512886ada2b9dbbd0315f0d1a4e7ab3
                  • Instruction ID: ff1745f3972e441fec5f5b57a2a42a21c1ce8358a078399f35ff96db60abdbfd
                  • Opcode Fuzzy Hash: 6a91665792fec78edc54ec87d1a1cae77512886ada2b9dbbd0315f0d1a4e7ab3
                  • Instruction Fuzzy Hash: DB910231B1C6638AEB1687A9DC48B5E7362B745BA8F518D16DE1CC3F94DA3DC0898701
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 207 1a500ba4558-1a500ba45c0 call 1a500ba54b4 210 1a500ba4a27-1a500ba4a2f call 1a500ba6d54 207->210 211 1a500ba45c6-1a500ba45c9 207->211 211->210 212 1a500ba45cf-1a500ba45d5 211->212 214 1a500ba46a4-1a500ba46b6 212->214 215 1a500ba45db-1a500ba45df 212->215 217 1a500ba4977-1a500ba497b 214->217 218 1a500ba46bc-1a500ba46c0 214->218 215->214 219 1a500ba45e5-1a500ba45f0 215->219 220 1a500ba497d-1a500ba4984 217->220 221 1a500ba49b4-1a500ba49be call 1a500ba2f9c 217->221 218->217 222 1a500ba46c6-1a500ba46d1 218->222 219->214 223 1a500ba45f6-1a500ba45fb 219->223 220->210 224 1a500ba498a-1a500ba49af call 1a500ba4a30 220->224 221->210 233 1a500ba49c0-1a500ba49df call 1a500baef80 221->233 222->217 226 1a500ba46d7-1a500ba46de 222->226 223->214 227 1a500ba4601-1a500ba460b call 1a500ba2f9c 223->227 224->221 230 1a500ba46e4-1a500ba471b call 1a500ba3658 226->230 231 1a500ba48a8-1a500ba48b4 226->231 227->233 237 1a500ba4611-1a500ba463c call 1a500ba2f9c * 2 call 1a500ba396c 227->237 230->231 242 1a500ba4721-1a500ba472a 230->242 231->221 234 1a500ba48ba-1a500ba48be 231->234 239 1a500ba48c0-1a500ba48cc call 1a500ba392c 234->239 240 1a500ba48ce-1a500ba48d6 234->240 275 1a500ba463e-1a500ba4642 237->275 276 1a500ba465c-1a500ba4666 call 1a500ba2f9c 237->276 239->240 255 1a500ba48ef-1a500ba48f7 239->255 240->221 246 1a500ba48dc-1a500ba48e9 call 1a500ba34fc 240->246 248 1a500ba472d-1a500ba475f 242->248 246->221 246->255 252 1a500ba4765-1a500ba4770 248->252 253 1a500ba489b-1a500ba48a2 248->253 252->253 256 1a500ba4776-1a500ba478f 252->256 253->231 253->248 257 1a500ba48fd-1a500ba4901 255->257 258 1a500ba4a0a-1a500ba4a26 call 1a500ba2f9c * 2 call 1a500ba6cc8 255->258 260 1a500ba4888-1a500ba488d 256->260 261 1a500ba4795-1a500ba47da call 1a500ba3940 * 2 256->261 262 1a500ba4903-1a500ba4912 call 1a500ba392c 257->262 263 1a500ba4914-1a500ba4915 257->263 258->210 266 1a500ba4898-1a500ba4899 260->266 288 1a500ba4818-1a500ba481e 261->288 289 1a500ba47dc-1a500ba4802 call 1a500ba3940 call 1a500ba4c4c 261->289 271 1a500ba4917-1a500ba4921 call 1a500ba554c 262->271 263->271 266->253 271->221 286 1a500ba4927-1a500ba4975 call 1a500ba358c call 1a500ba3798 271->286 275->276 280 1a500ba4644-1a500ba464f 275->280 276->214 292 1a500ba4668-1a500ba4688 call 1a500ba2f9c * 2 call 1a500ba554c 276->292 280->276 285 1a500ba4651-1a500ba4656 280->285 285->210 285->276 286->221 293 1a500ba488f-1a500ba4890 288->293 294 1a500ba4820-1a500ba4824 288->294 308 1a500ba4804-1a500ba4816 289->308 309 1a500ba4829-1a500ba4886 call 1a500ba4484 289->309 313 1a500ba469f-1a500ba46a0 292->313 314 1a500ba468a-1a500ba4694 call 1a500ba563c 292->314 298 1a500ba4894-1a500ba4895 293->298 294->261 298->266 308->288 308->289 309->298 313->214 317 1a500ba4a04-1a500ba4a09 call 1a500ba6cc8 314->317 318 1a500ba469a-1a500ba4a03 call 1a500ba29d4 call 1a500ba5008 call 1a500ba58c0 314->318 317->258 318->317
                  APIs
                  • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001A500BA45B5
                    • Part of subcall function 000001A500BA54B4: __GetUnwindTryBlock.LIBCMT ref: 000001A500BA54F7
                    • Part of subcall function 000001A500BA54B4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001A500BA551C
                  • Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001A500BA468D
                  • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001A500BA48E2
                  • std::bad_alloc::bad_alloc.LIBCMT ref: 000001A500BA49EE
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                  • String ID: csm$csm$csm
                  • API String ID: 849930591-393685449
                  • Opcode ID: 39137d1223ea651748fe43d48d6e13ffbffa615f9d97bbdaf1a448efdaf38685
                  • Instruction ID: eb22345454b1660919b98ed3c7e4d59cba6c46cc336cc348476a69b9ea738d33
                  • Opcode Fuzzy Hash: 39137d1223ea651748fe43d48d6e13ffbffa615f9d97bbdaf1a448efdaf38685
                  • Instruction Fuzzy Hash: 41F17E30619E588FEB54EF5885417ED77E2FB9B320F500659F489C329ADB70A981CB83
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 328 6d81ded0-6d81deec 329 6d81def2-6d81deff 328->329 330 6d81e058 328->330 331 6d81df00-6d81df06 329->331 334 6d81e05f-6d81e06b 330->334 332 6d81df08-6d81df16 331->332 333 6d81df1c-6d81df25 331->333 332->333 336 6d81dfa5-6d81dfa8 332->336 333->331 337 6d81df27-6d81df35 call 6d81eb70 333->337 335 6d81dfc8-6d81dfd2 334->335 338 6d81dfd3-6d81dfe5 336->338 339 6d81dfaa-6d81dfae 336->339 347 6d81df3b-6d81df84 call 6d81eca0 VirtualQuery 337->347 348 6d81e08d-6d81e0c0 call 6d81f150 337->348 338->335 343 6d81dfe7-6d81dfea 338->343 341 6d81e044-6d81e053 339->341 342 6d81dfb4-6d81dfb6 339->342 341->335 342->335 345 6d81dfb8-6d81dfc2 342->345 346 6d81dfec-6d81dffc 343->346 345->334 345->335 346->346 350 6d81dffe 346->350 355 6d81e070-6d81e088 call 6d81f150 347->355 356 6d81df8a-6d81df94 347->356 358 6d81e0d3-6d81e12a call 6d81ebf0 call 6d81ee40 348->358 359 6d81e0c2-6d81e0d2 348->359 350->335 355->348 360 6d81df96-6d81df9c 356->360 361 6d81df9e 356->361 358->359 369 6d81e12c-6d81e132 358->369 360->361 363 6d81e000-6d81e02a VirtualProtect 360->363 361->336 363->361 365 6d81e030-6d81e03f GetLastError call 6d81f150 363->365 365->341 370 6d81e200-6d81e202 369->370 371 6d81e138-6d81e13a 369->371 372 6d81e140-6d81e143 370->372 373 6d81e208-6d81e20d 370->373 371->372 374 6d81e1e4-6d81e1e9 371->374 372->359 376 6d81e149-6d81e168 372->376 373->372 377 6d81e213-6d81e219 373->377 374->372 375 6d81e1ef-6d81e1f4 374->375 375->377 378 6d81e1f6-6d81e1fd 375->378 379 6d81e174-6d81e195 call 6d81ded0 376->379 380 6d81e21f-6d81e23b 377->380 381 6d81e34e-6d81e36b call 6d81f150 377->381 378->370 392 6d81e170 379->392 393 6d81e197-6d81e1a8 379->393 383 6d81e285-6d81e29a 380->383 384 6d81e23d 380->384 394 6d81e3d0-6d81e3d5 381->394 395 6d81e36d-6d81e372 381->395 388 6d81e242 383->388 389 6d81e29c-6d81e2cd call 6d81ded0 383->389 384->359 390 6d81e300-6d81e303 388->390 391 6d81e248-6d81e24b 388->391 417 6d81e278-6d81e27f 389->417 405 6d81e305-6d81e335 call 6d81ded0 390->405 406 6d81e33a-6d81e349 call 6d81f150 390->406 397 6d81e251-6d81e254 391->397 398 6d81e2d0-6d81e2fa call 6d81ded0 391->398 392->379 393->359 401 6d81e1ae 393->401 399 6d81e490-6d81e4a0 call 6d81eeb8 394->399 400 6d81e3db 394->400 402 6d81e374-6d81e379 395->402 403 6d81e3ef-6d81e3ff signal 395->403 397->406 408 6d81e25a-6d81e273 call 6d81ded0 397->408 398->417 412 6d81e401-6d81e404 399->412 436 6d81e4a6-6d81e4b7 signal 399->436 409 6d81e414-6d81e419 400->409 410 6d81e3dd-6d81e3e2 400->410 411 6d81e1b0-6d81e1c0 401->411 415 6d81e484-6d81e48a 402->415 416 6d81e37f 402->416 403->412 413 6d81e470-6d81e47f signal call 6d81ee30 403->413 405->417 406->381 408->417 409->415 424 6d81e41b-6d81e420 409->424 410->415 421 6d81e3e8-6d81e3ed 410->421 427 6d81e1d0-6d81e1dd 411->427 428 6d81e1c2-6d81e1cd VirtualProtect 411->428 422 6d81e406-6d81e413 412->422 423 6d81e45e-6d81e467 412->423 413->415 431 6d81e450-6d81e455 416->431 432 6d81e385-6d81e38a 416->432 417->383 417->393 421->403 421->423 424->423 433 6d81e422-6d81e432 signal 424->433 427->411 435 6d81e1df 427->435 428->427 431->433 434 6d81e457-6d81e45c 431->434 432->415 437 6d81e390-6d81e395 432->437 439 6d81e4c0-6d81e4d1 signal 433->439 440 6d81e438-6d81e43b 433->440 434->415 434->423 435->359 441 6d81e3c3-6d81e3c7 436->441 437->423 442 6d81e39b-6d81e3ab signal 437->442 439->441 443 6d81e441-6d81e44e 440->443 444 6d81e4f6-6d81e4fb 440->444 445 6d81e3b1-6d81e3b4 442->445 446 6d81e4e0-6d81e4f1 signal 442->446 444->441 445->444 447 6d81e3ba-6d81e3c1 445->447 446->441 447->441
                  APIs
                  Strings
                  • Address %p has no image-section, xrefs: 6D81E08D
                  • VirtualProtect failed with code 0x%x, xrefs: 6D81E036
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 6D81E077
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081689356.000000006D7C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D7C0000, based on PE: true
                  • Associated: 00000005.00000002.2081676559.000000006D7C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081735965.000000006D83C000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081747544.000000006D841000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D846000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D84B000.00000002.00000001.01000000.00000004.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_6d7c0000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery
                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 637304234-2123141913
                  • Opcode ID: ed214b71aab825f5803fae0610a2ccb6b171a412dd13c7b99c2e70dc9578d3e0
                  • Instruction ID: 7fc2b58eacafb6c883691fae477f2a0488e92ea9f9e2691163276c902dac7f84
                  • Opcode Fuzzy Hash: ed214b71aab825f5803fae0610a2ccb6b171a412dd13c7b99c2e70dc9578d3e0
                  • Instruction Fuzzy Hash: 75510F73B09A528AE7118F66EC0879D73A5F795BA4F018912EE1D83754EF38C249C300
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 456 1a500ba2770-1a500ba27b6 call 1a500ba2f44 459 1a500ba2898-1a500ba289f 456->459 460 1a500ba27bc-1a500ba27c2 456->460 462 1a500ba293a-1a500ba293e 459->462 461 1a500ba27c6-1a500ba27c8 460->461 463 1a500ba27ce-1a500ba27da 461->463 464 1a500ba2944 461->464 462->464 465 1a500ba28a4-1a500ba28b0 462->465 466 1a500ba27e0-1a500ba27e7 463->466 467 1a500ba288a-1a500ba288c 463->467 470 1a500ba2949-1a500ba2966 464->470 468 1a500ba2938 465->468 469 1a500ba28b6-1a500ba28bd 465->469 466->467 471 1a500ba27ed-1a500ba27f2 466->471 467->461 468->462 469->468 472 1a500ba28bf-1a500ba28c7 469->472 471->467 473 1a500ba27f8-1a500ba27fd 471->473 474 1a500ba290d-1a500ba2913 472->474 475 1a500ba28c9-1a500ba28ce 472->475 478 1a500ba27ff-1a500ba2812 473->478 479 1a500ba2816-1a500ba281d 473->479 476 1a500ba2921-1a500ba2935 474->476 477 1a500ba2915-1a500ba2918 474->477 480 1a500ba28d0-1a500ba28de 475->480 481 1a500ba2908-1a500ba290b 475->481 476->468 477->468 484 1a500ba291a-1a500ba291d 477->484 494 1a500ba2814 478->494 495 1a500ba2891-1a500ba2893 478->495 485 1a500ba281f-1a500ba2827 479->485 486 1a500ba2847-1a500ba2885 call 1a500ba2f10 call 1a500ba2f40 479->486 482 1a500ba2900-1a500ba2906 480->482 483 1a500ba28e0-1a500ba28e8 480->483 481->464 481->474 482->480 482->481 483->482 487 1a500ba28ea-1a500ba28f3 483->487 484->464 489 1a500ba291f 484->489 485->486 491 1a500ba2829-1a500ba2837 call 1a500baee40 485->491 486->467 487->482 492 1a500ba28f5-1a500ba28fe 487->492 489->468 491->486 498 1a500ba2839-1a500ba283f 491->498 492->481 492->482 494->467 494->479 495->470 498->486
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: CurrentImageNonwritable__except_validate_context_record
                  • String ID: csm$f
                  • API String ID: 3242871069-629598281
                  • Opcode ID: 83378c33feeee9c4e103d0aeda362cd02856fccc2569b0da28eb2b5b44c07327
                  • Instruction ID: c60027bac8376a07c7590ed3cd94d06ed8bac94341e067680561074cdf7f09f6
                  • Opcode Fuzzy Hash: 83378c33feeee9c4e103d0aeda362cd02856fccc2569b0da28eb2b5b44c07327
                  • Instruction Fuzzy Hash: 3761B23071DD258BEF5CAF1CD9857A973D2FB56360F50416DF8C6C329ADA20EC418A86
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 501 1a500ba4d8c-1a500ba4dd4 call 1a500ba2f44 call 1a500ba2f9c 506 1a500ba4e0e-1a500ba4e12 501->506 507 1a500ba4dd6-1a500ba4ddc 501->507 509 1a500ba4e18-1a500ba4e1c 506->509 510 1a500ba4ea6-1a500ba4eaa 506->510 507->506 508 1a500ba4dde-1a500ba4de0 507->508 513 1a500ba4df2-1a500ba4df4 508->513 514 1a500ba4de2-1a500ba4de6 508->514 515 1a500ba4f9d 509->515 516 1a500ba4e22-1a500ba4e2a 509->516 511 1a500ba4eee-1a500ba4ef4 510->511 512 1a500ba4eac-1a500ba4eb8 510->512 522 1a500ba4f64-1a500ba4f98 call 1a500ba4558 511->522 523 1a500ba4ef6-1a500ba4efa 511->523 517 1a500ba4ece-1a500ba4eda 512->517 518 1a500ba4eba-1a500ba4ebe 512->518 513->506 521 1a500ba4df6-1a500ba4e02 513->521 520 1a500ba4de8-1a500ba4df0 514->520 514->521 519 1a500ba4fa2-1a500ba4fbc 515->519 516->515 524 1a500ba4e30-1a500ba4e34 516->524 517->515 527 1a500ba4ee0-1a500ba4ee8 517->527 518->517 525 1a500ba4ec0-1a500ba4ecc call 1a500ba392c 518->525 520->506 520->513 521->506 529 1a500ba4e04-1a500ba4e08 521->529 522->515 523->522 528 1a500ba4efc-1a500ba4f03 523->528 530 1a500ba4e93-1a500ba4ea1 call 1a500ba3528 524->530 531 1a500ba4e36-1a500ba4e38 524->531 525->511 525->517 527->511 527->515 528->522 535 1a500ba4f05-1a500ba4f0d 528->535 529->506 529->515 530->515 532 1a500ba4e71-1a500ba4e73 531->532 533 1a500ba4e3a-1a500ba4e4c call 1a500ba415c 531->533 532->530 539 1a500ba4e75-1a500ba4e7d 532->539 543 1a500ba4fbd-1a500ba4fc3 call 1a500ba6d54 533->543 546 1a500ba4e52-1a500ba4e55 533->546 535->522 540 1a500ba4f0f-1a500ba4f22 call 1a500ba3940 535->540 539->543 544 1a500ba4e83-1a500ba4e87 539->544 540->522 553 1a500ba4f24-1a500ba4f62 540->553 544->543 548 1a500ba4e8d-1a500ba4e91 544->548 546->543 550 1a500ba4e5b-1a500ba4e5f 546->550 552 1a500ba4e61-1a500ba4e6c call 1a500ba5328 548->552 550->552 552->515 553->519
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                  • String ID: csm$csm
                  • API String ID: 3896166516-3733052814
                  • Opcode ID: d5ea70ca177011969eb85e430d49eb803d467ac3b2a0863a2be913de104a1ddc
                  • Instruction ID: a0d53d2f63918ac3acc94d2151d20904ce42116fb0c0e2c157db59552b9a1ce8
                  • Opcode Fuzzy Hash: d5ea70ca177011969eb85e430d49eb803d467ac3b2a0863a2be913de104a1ddc
                  • Instruction Fuzzy Hash: 70715030309E248FEBA89B1881843ACB7D2FB97325F64515AB499C66DAC7B1D881C743
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 557 6d7c1010-6d7c1024 558 6d7c1026-6d7c1030 557->558 559 6d7c10a0-6d7c10a3 557->559 560 6d7c108b-6d7c1097 558->560 561 6d7c1032-6d7c1050 558->561 562 6d7c10a9-6d7c10c6 559->562 563 6d7c1153-6d7c1164 559->563 564 6d7c105a-6d7c1068 561->564 565 6d7c10e0-6d7c10eb 562->565 566 6d7c106a-6d7c1076 564->566 567 6d7c1052-6d7c1057 Sleep 564->567 568 6d7c10ed 565->568 569 6d7c10d0-6d7c10d3 565->569 570 6d7c107c-6d7c1086 _amsg_exit 566->570 571 6d7c1165-6d7c118b call 6d81eff0 566->571 567->564 574 6d7c10ef-6d7c10fb 568->574 572 6d7c10d9-6d7c10de Sleep 569->572 573 6d7c1190-6d7c1195 569->573 570->560 572->565 573->574 576 6d7c11f0-6d7c11fa call 6d81eee8 574->576 577 6d7c1101-6d7c1105 574->577 580 6d7c110b-6d7c1110 576->580 577->580 581 6d7c11b0-6d7c11c9 _initterm 577->581 582 6d7c1116-6d7c1118 580->582 583 6d7c11d0-6d7c11e9 call 6d81eee0 580->583 581->580 585 6d7c111e-6d7c112b 582->585 586 6d7c11a0-6d7c11a5 582->586 583->582 588 6d7c112d-6d7c1135 585->588 589 6d7c113a-6d7c1152 585->589 586->585 588->589
                  APIs
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081689356.000000006D7C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D7C0000, based on PE: true
                  • Associated: 00000005.00000002.2081676559.000000006D7C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081719467.000000006D820000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081735965.000000006D83C000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081747544.000000006D841000.00000004.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D846000.00000002.00000001.01000000.00000004.sdmpDownload File
                  • Associated: 00000005.00000002.2081758280.000000006D84B000.00000002.00000001.01000000.00000004.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_6d7c0000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: Sleep_amsg_exit
                  • String ID:
                  • API String ID: 1015461914-0
                  • Opcode ID: 2b49f828df25c7504276480ae1f8d3e5692604d7af01f57826d84bd0556cc8c9
                  • Instruction ID: e0a8b54186713688f984d1e52cb8d521f43b4d6b19b3803fe2e3250357c5b56a
                  • Opcode Fuzzy Hash: 2b49f828df25c7504276480ae1f8d3e5692604d7af01f57826d84bd0556cc8c9
                  • Instruction Fuzzy Hash: DB419032B056558EE7038B9AEE5475522A6B784BE5F898437DE1C87350DF3EC4D1C342
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  APIs
                  • __scrt_initialize_crt.LIBCMT ref: 000001A500BA1DFB
                    • Part of subcall function 000001A500BA1FB0: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001A500BA1FD2
                  • __scrt_acquire_startup_lock.LIBCMT ref: 000001A500BA1E10
                  • __scrt_release_startup_lock.LIBCMT ref: 000001A500BA1E7E
                  • __scrt_get_show_window_mode.LIBCMT ref: 000001A500BA1ED1
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                  • String ID:
                  • API String ID: 1452418845-0
                  • Opcode ID: fff619cecbfd043d8d146dc78237dedbc44789d86068deb7e7ce02ed1ecd986d
                  • Instruction ID: 52342516f831e02accb15e050379f4ac2cae087dd46d0ee8c0ba7517b30eb1a0
                  • Opcode Fuzzy Hash: fff619cecbfd043d8d146dc78237dedbc44789d86068deb7e7ce02ed1ecd986d
                  • Instruction Fuzzy Hash: AA417C3070EE648EFB98A76CCA553ED3293AB57321F44492878C6D72DBDE2948458253
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Control-flow Graph

                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.2081890082.000001A500BA1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A500BA1000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_1a500ba1000_rundll32.jbxd
                  Yara matches
                  Similarity
                  • API ID: CallTranslator
                  • String ID: MOC$RCC
                  • API String ID: 3163161869-2084237596
                  • Opcode ID: 5ea54aec067562482f4b68b493fd0d2592e30a206b4815ae92b23c2db257c6ef
                  • Instruction ID: 9e7482e7cdd47045e33c822e59873056db3e81fdd74ad3e3f470971c10561f22
                  • Opcode Fuzzy Hash: 5ea54aec067562482f4b68b493fd0d2592e30a206b4815ae92b23c2db257c6ef
                  • Instruction Fuzzy Hash: 38719E30619A1C8FEB58EF58C5427EDB3E1FB9A310F100259F48AD3156D7B4E9418B82
                  Uniqueness

                  Uniqueness Score: -1.00%