Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll
Analysis ID:	1419153
MD5:	cd943166310d5c29ea7fecdd00c23957
SHA1:	f14eb88f4cdc2fc251b4471a2975f0576b4df61c
SHA256:	05d741cbb567eb90955cca6eba3b377351976e2d5d013ba3ea42ad04aad72bdb
Tags:	dll
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5220 cmdline: loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 3668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6704 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 2080 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6728 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,_main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6876 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll, MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1892 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll, MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	ReversingLabs: Detection: 50%
Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	Virustotal: Detection: 55%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source:

Binary string: sc.pdb source: loaddll32.exe, 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4066979714.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4067008230.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Source: loaddll32.exe, 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4066979714.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4067008230.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	String found in binary or memory: http://www.kaikuoyun.com/list-127-1.htmlDVarFileInfo$
Source: loaddll32.exe, 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4066979714.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4067008230.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	String found in binary or memory: http://www.kaikuoyun.com/list-127-1.htmll)

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100511B0	0_2_100511B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100A75C6	0_2_100A75C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100511B0	3_2_100511B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100A75C6	3_2_100A75C6

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	Binary or memory string: OriginalFilenamebszip.dll" vs SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll
Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	Binary or memory string: OriginalFilenamesc.exej% vs SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal52.winDLL@12/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3668:120:WilError_03

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,_main

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	ReversingLabs: Detection: 50%
Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	Virustotal: Detection: 55%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,_main
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,_main	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}\InprocServer32

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Static file information: File size 2334720 > 1048576

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x150000

Source:

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10050430 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,

0_2_10050430

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1009FAD0 push eax; ret	0_2_1009FAFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10013787 push ecx; retf 0001h	0_2_10013788
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100A1798 push eax; ret	0_2_100A17B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1009FAD0 push eax; ret	3_2_1009FAFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10013787 push ecx; retf 0001h	3_2_10013788
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100A1798 push eax; ret	3_2_100A17B6

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_100060FC rdtsc

0_2_100060FC

Source: C:\Windows\System32\loaddll32.exe	API coverage: 9.5 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 6.7 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	API call chain: ExitProcess graph end node	graph_0-19116
Source: C:\Windows\System32\loaddll32.exe	API call chain: ExitProcess graph end node	graph_0-18447
Source: C:\Windows\System32\loaddll32.exe	API call chain: ExitProcess graph end node	graph_0-18446
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-18447
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-18446
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-19119

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_100060FC rdtsc

0_2_100060FC

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10050430 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,

0_2_10050430

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000BC31 mov ebx, dword ptr fs:[00000030h]	0_2_1000BC31
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000DC38 mov ecx, dword ptr fs:[00000030h]	0_2_1000DC38
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000E4D8 mov ebx, dword ptr fs:[00000030h]	0_2_1000E4D8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000B391 mov ecx, dword ptr fs:[00000030h]	0_2_1000B391
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000BC31 mov ebx, dword ptr fs:[00000030h]	3_2_1000BC31
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000DC38 mov ecx, dword ptr fs:[00000030h]	3_2_1000DC38
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000E4D8 mov ebx, dword ptr fs:[00000030h]	3_2_1000E4D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B391 mov ecx, dword ptr fs:[00000030h]	3_2_1000B391

Source: C:\Windows\System32\loaddll32.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	Binary or memory string: Program ManagerProgman
Source: loaddll32.exe, loaddll32.exe, 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, rundll32.exe, 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000101CD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, loaddll32.exe, 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, rundll32.exe, 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000101CD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Progman

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_1002F8C8 cpuid

0_2_1002F8C8

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_1009E49D GetVersion,GetCommandLineA,

0_2_1009E49D

Source: loaddll32.exe, loaddll32.exe, 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, rundll32.exe, 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4066979714.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4067008230.00000000101CD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: kxetray.exe
Source: loaddll32.exe, loaddll32.exe, 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, rundll32.exe, 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4066979714.00000000101CD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4067008230.00000000101CD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: 360Tray.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	1 Rundll32	OS Credential Dumping	2 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	50%	ReversingLabs	Win32.PUA.Generic
SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	56%	Virustotal		Browse
SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.kaikuoyun.com/list-127-1.htmlDVarFileInfo$	0%	Avira URL Cloud	safe
http://www.kaikuoyun.com/list-127-1.htmll)	0%	Avira URL Cloud	safe
http://www.kaikuoyun.com/list-127-1.htmll)	0%	Virustotal		Browse
http://www.kaikuoyun.com/list-127-1.htmlDVarFileInfo$	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.kaikuoyun.com/list-127-1.htmll)	loaddll32.exe, 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4066979714.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4067008230.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.kaikuoyun.com/list-127-1.htmlDVarFileInfo$	loaddll32.exe, 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4066881545.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4066979714.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4067008230.00000000100BE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1419153
Start date and time:	2024-04-03 07:21:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll
Detection:	MAL
Classification:	mal52.winDLL@12/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.198716405019505
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll
File size:	2'334'720 bytes
MD5:	cd943166310d5c29ea7fecdd00c23957
SHA1:	f14eb88f4cdc2fc251b4471a2975f0576b4df61c
SHA256:	05d741cbb567eb90955cca6eba3b377351976e2d5d013ba3ea42ad04aad72bdb
SHA512:	b74199ce9a52d76cb7c6dd712b2baf9fd488e7f09216716748cb43cc2156ac324a26723a11639608bb8559b8525753ce7238c2c5271e30642fd7d43d90d74973
SSDEEP:	49152:v+4MAGd9NjIC9Cmf9LGFA5m5edFMxfSb7C1jMz0:un9NjIsCmf9WgdaxV1jMz
TLSH:	1CB5BF13F69644F1D10C37BA2AA5273D39F59E202A65CC47EBF0EEB63C72951962320D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*./.K.\|.K.\|.K.\|.W.\|.K.\|.m.\|+K.\|.W.\|.K.\|.T.\|.K.\|.T.\|.K.\|.K.\|.I.\|.m.\|.K.\|.T.\|.K.\|.T.\|.K.\|.K.\|.K.\|PM.\|.K.\|hk.\|.K.\|Rich.K.\|.......

File Icon


Icon Hash:	9eb3c18c2ceea99a

Static PE Info

General

Entrypoint:	0x1009e576
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x6605888F [Thu Mar 28 15:11:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	09adf08de1c24b959dc1d60d4aeafc73

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F385CCA128Bh
cmp dword ptr [102375F8h], 00000000h
jmp 00007F385CCA12A8h
cmp esi, 01h
je 00007F385CCA1287h
cmp esi, 02h
jne 00007F385CCA12A4h
mov eax, dword ptr [10238D68h]
test eax, eax
je 00007F385CCA128Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F385CCA128Eh
push edi
push esi
push ebx
call 00007F385CCA116Ch
test eax, eax
jne 00007F385CCA1286h
xor eax, eax
jmp 00007F385CCA12D0h
push edi
push esi
push ebx
call 00007F385CCA006Fh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F385CCA128Eh
test eax, eax
jne 00007F385CCA12B9h
push edi
push eax
push ebx
call 00007F385CCA1148h
test esi, esi
je 00007F385CCA1287h
cmp esi, 03h
jne 00007F385CCA12A8h
push edi
push esi
push ebx
call 00007F385CCA1137h
test eax, eax
jne 00007F385CCA1285h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F385CCA1293h
mov eax, dword ptr [10238D68h]
test eax, eax
je 00007F385CCA128Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
mov eax, dword ptr [10237604h]
cmp eax, 01h
je 00007F385CCA128Fh
test eax, eax
jne 00007F385CCA1290h
cmp dword ptr [10237608h], 01h
jne 00007F385CCA1287h
call 00007F385CCA60E2h
push dword ptr [esp+04h]
call 00007F385CCA6112h
push 000000FFh

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804
[LNK] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x20dd00	0xae	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20b990	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x239000	0x5758	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23f000	0x971c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xbe000	0x708	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbc0e2	0xbd000	a92b9144edb8252b8145430e69544fce	False	0.4707728794642857	data	6.530144673517311	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xbe000	0x14fdae	0x150000	add82c211ac47f171f4eb18e1addd05a	False	0.7559843517485119	data	7.572126946883007	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20e000	0x2ad6c	0x12000	07051be0d9064b7957bcf78f94ca5455	False	0.3106011284722222	data	5.2063919782989725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x239000	0x5758	0x6000	14ec16686192035bb705814998a976a0	False	0.2864583333333333	data	4.261691498308698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x23f000	0x13f9c	0x14000	db9f1e0f6b77f2e8fe158b0c084b3352	False	0.30501708984375	data	4.0208220606384835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TEXTINCLUDE	0x23aa10	0xb	ASCII text, with no line terminators	Chinese	China	1.7272727272727273
TEXTINCLUDE	0x23aa20	0x16	data	Chinese	China	1.3636363636363635
TEXTINCLUDE	0x23aa38	0x151	C source, ASCII text, with CRLF line terminators	Chinese	China	0.6201780415430267
RT_CURSOR	0x23c2f0	0x134	data	Chinese	China	0.5811688311688312
RT_CURSOR	0x23c440	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x23c590	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x23c6c8	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_BITMAP	0x239bc0	0x248	Device independent bitmap graphic, 64 x 15 x 4, image size 480	Chinese	China	0.3407534246575342
RT_BITMAP	0x239e08	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.4444444444444444
RT_BITMAP	0x239f50	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.26453488372093026
RT_BITMAP	0x23a0a8	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2616279069767442
RT_BITMAP	0x23a200	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2441860465116279
RT_BITMAP	0x23a358	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.24709302325581395
RT_BITMAP	0x23a4b0	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2238372093023256
RT_BITMAP	0x23a608	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.19476744186046513
RT_BITMAP	0x23a760	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.20930232558139536
RT_BITMAP	0x23a8b8	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.18895348837209303
RT_BITMAP	0x23c7a8	0x5e4	Device independent bitmap graphic, 70 x 39 x 4, image size 1404	Chinese	China	0.34615384615384615
RT_BITMAP	0x23ce78	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x23cf30	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.28296703296703296
RT_BITMAP	0x23d0a0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x23ab90	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.26344086021505375
RT_ICON	0x23ae90	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.41216216216216217
RT_ICON	0x23dae0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.3885135135135135
RT_ICON	0x23dc08	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.33198924731182794
RT_ICON	0x23def0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536			0.22378048780487805
RT_MENU	0x23c058	0xc	data	Chinese	China	1.5
RT_MENU	0x23c068	0x284	data	Chinese	China	0.5
RT_DIALOG	0x23bd40	0x98	data	Chinese	China	0.7171052631578947
RT_DIALOG	0x23bdd8	0x17a	data	Chinese	China	0.5185185185185185
RT_DIALOG	0x23bf58	0xfa	data	Chinese	China	0.696
RT_DIALOG	0x23ba08	0xea	data	Chinese	China	0.6239316239316239
RT_DIALOG	0x23afd0	0x8ae	data	Chinese	China	0.39603960396039606
RT_DIALOG	0x23b880	0xb2	data	Chinese	China	0.7359550561797753
RT_DIALOG	0x23b938	0xcc	data	Chinese	China	0.7647058823529411
RT_DIALOG	0x23baf8	0xb2	data	Chinese	China	0.6629213483146067
RT_DIALOG	0x23cd90	0xe2	data	Chinese	China	0.6637168141592921
RT_DIALOG	0x23bbb0	0x18c	data	Chinese	China	0.5227272727272727
RT_STRING	0x23d1e8	0x50	data	Chinese	China	0.85
RT_STRING	0x23d238	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x23d268	0x78	data	Chinese	China	0.925
RT_STRING	0x23d2e0	0x1c4	data	Chinese	China	0.8141592920353983
RT_STRING	0x23d630	0x12a	data	Chinese	China	0.5201342281879194
RT_STRING	0x23d4e8	0x146	data	Chinese	China	0.6288343558282209
RT_STRING	0x23d4a8	0x40	data	Chinese	China	0.65625
RT_STRING	0x23da50	0x64	data	Chinese	China	0.73
RT_STRING	0x23d760	0x1d8	data	Chinese	China	0.6758474576271186
RT_STRING	0x23d938	0x114	data	Chinese	China	0.6376811594202898
RT_STRING	0x23dab8	0x24	data	Chinese	China	0.4444444444444444
RT_GROUP_CURSOR	0x23c578	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x23c428	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x23c780	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_ICON	0x23e558	0x30	data			0.9166666666666666
RT_GROUP_ICON	0x23ae78	0x14	data	Chinese	China	1.2
RT_GROUP_ICON	0x23afb8	0x14	data	Chinese	China	1.25
RT_MANIFEST	0x23e588	0x1cd	XML 1.0 document, ASCII text, with very long lines (461), with no line terminators			0.5878524945770065

Imports

DLL	Import
KERNEL32.dll	lstrcpynA, SetLastError, FileTimeToLocalFileTime, FileTimeToSystemTime, LocalFree, InterlockedDecrement, GetCurrentProcess, CreateSemaphoreA, ResumeThread, ReleaseSemaphore, EnterCriticalSection, LeaveCriticalSection, GetProfileStringA, WriteFile, SetStdHandle, IsBadCodePtr, IsBadReadPtr, CompareStringW, CompareStringA, SetUnhandledExceptionFilter, GetStringTypeW, GetStringTypeA, IsBadWritePtr, VirtualAlloc, LCMapStringW, LCMapStringA, SetEnvironmentVariableA, VirtualFree, HeapCreate, HeapDestroy, GetEnvironmentVariableA, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, GetStdHandle, SetHandleCount, GetACP, HeapSize, TerminateProcess, GetLocalTime, GetSystemTime, GetTimeZoneInformation, RaiseException, WaitForMultipleObjects, CreateFileA, SetEvent, FindResourceA, LoadResource, LockResource, ReadFile, lstrlenW, RemoveDirectoryA, GetModuleFileNameA, WideCharToMultiByte, MultiByteToWideChar, GetCurrentThreadId, ExitProcess, GlobalSize, GlobalFree, DeleteCriticalSection, InitializeCriticalSection, lstrcatA, lstrlenA, WinExec, lstrcpyA, FindNextFileA, GlobalReAlloc, HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetUserDefaultLCID, GetFullPathNameA, FreeLibrary, LoadLibraryA, GetLastError, GetVersionExA, WritePrivateProfileStringA, CreateThread, CreateEventA, Sleep, ExpandEnvironmentStringsA, GlobalAlloc, GlobalLock, GlobalUnlock, FindFirstFileA, FindClose, GetFileAttributesA, DeleteFileA, SetCurrentDirectoryA, RtlUnwind, GetOEMCP, GetCPInfo, GetProcessVersion, SetErrorMode, GlobalFlags, GetCurrentThread, GetFileTime, GetFileSize, TlsGetValue, LocalReAlloc, TlsSetValue, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, lstrcmpA, GetVersion, GlobalGetAtomNameA, GetVolumeInformationA, GetModuleHandleA, GetProcAddress, MulDiv, GetCommandLineA, GetTickCount, WaitForSingleObject, CloseHandle, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcmpiA, DuplicateHandle, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, InterlockedIncrement
USER32.dll	GetCursorPos, MessageBoxA, SetWindowPos, SendMessageA, DestroyCursor, SetParent, IsWindow, PostMessageA, GetTopWindow, GetParent, GetFocus, GetClientRect, InvalidateRect, ValidateRect, UpdateWindow, EqualRect, GetWindowRect, SetForegroundWindow, DestroyMenu, EmptyClipboard, SetClipboardData, OpenClipboard, GetClipboardData, CloseClipboard, wsprintfA, GetSystemMetrics, IsChild, ReleaseDC, IsRectEmpty, FillRect, GetDC, SetCursor, LoadCursorA, SetCursorPos, SetActiveWindow, GetSysColor, SetWindowLongA, GetWindowLongA, RedrawWindow, EnableWindow, IsWindowVisible, OffsetRect, PtInRect, DestroyIcon, IntersectRect, InflateRect, SetRect, SetScrollPos, SetScrollRange, GetScrollRange, SetCapture, GetCapture, ReleaseCapture, SetTimer, GetForegroundWindow, LoadIconA, TranslateMessage, DrawFrameControl, DrawEdge, DrawFocusRect, WindowFromPoint, GetMessageA, DispatchMessageA, SetRectEmpty, RegisterClipboardFormatA, CreateIconFromResourceEx, CreateIconFromResource, DrawIconEx, CreatePopupMenu, AppendMenuA, ModifyMenuA, CreateMenu, CreateAcceleratorTableA, GetDlgCtrlID, GetSubMenu, EnableMenuItem, ClientToScreen, EnumDisplaySettingsA, LoadImageA, SystemParametersInfoA, ShowWindow, IsWindowEnabled, TranslateAcceleratorA, GetKeyState, CopyAcceleratorTableA, PostQuitMessage, IsZoomed, GetClassInfoA, DefWindowProcA, GetMenu, SetMenu, PeekMessageA, IsIconic, GetWindowTextA, GetWindowTextLengthA, CharUpperA, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, GetDlgItem, DestroyWindow, CreateDialogIndirectParamA, EndDialog, GetNextDlgTabItem, GetWindowPlacement, RegisterWindowMessageA, GetLastActivePopup, GetMessageTime, RemovePropA, CallWindowProcA, GetPropA, UnhookWindowsHookEx, SetPropA, GetClassLongA, CallNextHookEx, SetWindowsHookExA, CreateWindowExA, GetMenuItemID, GetMenuItemCount, RegisterClassA, GetScrollPos, AdjustWindowRectEx, MapWindowPoints, SendDlgItemMessageA, ScrollWindowEx, IsDialogMessageA, SetWindowTextA, MoveWindow, CheckMenuItem, SetMenuItemBitmaps, GetMenuState, GetMenuCheckMarkDimensions, GetClassNameA, GetDesktopWindow, UnregisterClassA, LoadStringA, GetSysColorBrush, SetFocus, GetActiveWindow, GetWindow, DestroyAcceleratorTable, SetWindowRgn, GetMessagePos, ScreenToClient, ChildWindowFromPointEx, CopyRect, LoadBitmapA, WinHelpA, KillTimer
GDI32.dll	SelectPalette, RealizePalette, GetDIBits, GetWindowExtEx, GetViewportOrgEx, GetWindowOrgEx, BeginPath, EndPath, PathToRegion, CreateEllipticRgn, CreateRoundRectRgn, GetTextColor, GetBkMode, GetBkColor, GetROP2, GetStretchBltMode, GetPolyFillMode, CreateCompatibleBitmap, CreateDCA, CreateBitmap, SelectObject, CreatePen, PatBlt, CombineRgn, CreateRectRgn, FillRgn, CreateSolidBrush, CreateFontIndirectA, GetStockObject, GetObjectA, CreateRectRgnIndirect, EndDoc, DeleteDC, StartDocA, StartPage, StretchBlt, CreateCompatibleDC, Ellipse, Rectangle, LPtoDP, DPtoLP, GetCurrentObject, RoundRect, GetTextExtentPoint32A, GetDeviceCaps, SaveDC, RestoreDC, SetBkMode, SetPolyFillMode, SetROP2, SetTextColor, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, GetClipBox, ExcludeClipRect, MoveToEx, LineTo, CreatePalette, GetSystemPaletteEntries, CreateDIBitmap, DeleteObject, SelectClipRgn, CreatePolygonRgn, GetClipRgn, SetStretchBltMode, BitBlt, SetBkColor, EndPage, GetTextMetricsA, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, GetViewportExtEx, ExtSelectClipRgn
WINMM.dll	midiStreamRestart, midiStreamClose, midiOutReset, midiStreamStop, midiStreamOut, midiOutPrepareHeader, midiStreamProperty, midiStreamOpen, midiOutUnprepareHeader, waveOutOpen, waveOutGetNumDevs, waveOutClose, waveOutReset, waveOutPause, waveOutWrite, waveOutPrepareHeader, waveOutUnprepareHeader
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesA, OpenPrinterA
ADVAPI32.dll	RegQueryValueA, RegDeleteKeyA, RegDeleteValueA, RegCreateKeyA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, RegCreateKeyExA
SHELL32.dll	Shell_NotifyIconA, ShellExecuteA
ole32.dll	CLSIDFromProgID, OleInitialize, OleUninitialize, CLSIDFromString, CoCreateInstance, OleRun
OLEAUT32.dll	VariantCopy, VariantClear, VariantChangeType, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayGetDim, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetElement, VariantCopyInd, VariantInit, SysAllocString, SafeArrayDestroy, SafeArrayCreate, SafeArrayPutElement, RegisterTypeLib, LHashValOfNameSys, LoadTypeLib, UnRegisterTypeLib
COMCTL32.dll	ImageList_Destroy
WS2_32.dll	closesocket, WSAAsyncSelect, gethostname, recvfrom, WSACleanup, ioctlsocket, recv, inet_ntoa, getpeername, accept, WSAStartup
comdlg32.dll	GetFileTitleA, GetSaveFileNameA, ChooseColorA, GetOpenFileNameA

Exports

Name	Ordinal	Address
_main	1	0x10036717

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Target ID:	0
Start time:	07:21:51
Start date:	03/04/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll"
Imagebase:	0xb50000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:21:51
Start date:	03/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:21:51
Start date:	03/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	07:21:51
Start date:	03/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,_main
Imagebase:	0xd30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	07:21:51
Start date:	03/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll",#1
Imagebase:	0xd30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:21:54
Start date:	03/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,
Imagebase:	0xd30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:21:57
Start date:	03/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll,
Imagebase:	0xd30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 5220, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	1161
Total number of Limit Nodes:	6

Executed Functions

Function 1009E49D Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(1009E5B6,?,?,?), ref: 1009E4AA

Part of subcall function 100A3387: HeapCreate.KERNELBASE(00000000,00001000,00000000,1009E4BC,00000001), ref: 100A3398
Part of subcall function 100A3387: HeapDestroy.KERNEL32 ref: 100A33D7

Part of subcall function 100A2A3E: TlsAlloc.KERNEL32(?,1009E4F4), ref: 100A2A44
Part of subcall function 100A2A3E: TlsSetValue.KERNEL32(00000000), ref: 100A2A6C
Part of subcall function 100A2A3E: GetCurrentThreadId.KERNEL32 ref: 100A2A7D

GetCommandLineA.KERNEL32 ref: 1009E501

Part of subcall function 100A33E4: VirtualFree.KERNEL32(0000000C,00100000,00004000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A341C
Part of subcall function 100A33E4: VirtualFree.KERNEL32(0000000C,00000000,00008000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3427
Part of subcall function 100A33E4: HeapFree.KERNEL32(00000000,?,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3434
Part of subcall function 100A33E4: HeapFree.KERNEL32(00000000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3450
Part of subcall function 100A33E4: HeapDestroy.KERNEL32(?,?,1009E562,1009E5B6,?,?,?), ref: 100A3483

Part of subcall function 100A2B2A: TlsGetValue.KERNEL32(00000017,?,1009E56F,00000000,1009E5B6,?,?,?), ref: 100A2B42
Part of subcall function 100A2B2A: TlsSetValue.KERNEL32(00000000,?,1009E56F,00000000,1009E5B6,?,?,?), ref: 100A2BC2

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: Heap$Free$Value$DestroyVirtual$AllocCommandCreateCurrentLineThreadVersion
String ID:
API String ID: 1348591257-0
Opcode ID: b62ed5e9b170dc615ee856b52960cc7ab2e07d0f34fed048d9349b4bef9ece36
Instruction ID: 856035bf9b8e1d64d5efb4ff41082b77b2ecb92965152f642118a98844d452bf
Opcode Fuzzy Hash: b62ed5e9b170dc615ee856b52960cc7ab2e07d0f34fed048d9349b4bef9ece36
Instruction Fuzzy Hash: 15114F79514BA2DBDF28DBB88D9B60937E4FB18345B12482AF405CA153EB71AD80EE11

Uniqueness

Uniqueness Score: -1.00%

Function 100B7F61 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(102372C8,1023729C,?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6), ref: 100B7F70
GlobalAlloc.KERNELBASE(00002002,00000000,?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6), ref: 100B7FC5
GlobalHandle.KERNEL32(013C97C8), ref: 100B7FCE
GlobalUnlock.KERNEL32(00000000,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B7FD7
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 100B7FE9
GlobalHandle.KERNEL32(013C97C8), ref: 100B8000
GlobalLock.KERNEL32(00000000,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B8007
LeaveCriticalSection.KERNEL32(?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B800D
GlobalLock.KERNEL32(?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B801C
LeaveCriticalSection.KERNEL32(?), ref: 100B8065

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 816c57c658faaec40744c78e48b38dfd795ba1b4105b7cc5cddf4eb03449103e
Instruction ID: 498a4d4b33ea80642452fd91aee4d4dcedf663756efad2e5077c2c69e86dd376
Opcode Fuzzy Hash: 816c57c658faaec40744c78e48b38dfd795ba1b4105b7cc5cddf4eb03449103e
Instruction Fuzzy Hash: E2318C7920030A9FE720DF28CC89A6AB7E9FB44351B054A3DF9A6C3661E775ED04CB10

Uniqueness

Uniqueness Score: -1.00%

Function 100A2BCA Relevance: 7.6, APIs: 5, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 100A2C28
GetFileType.KERNEL32(00000480), ref: 100A2CD3
GetStdHandle.KERNEL32(-000000F6), ref: 100A2D36
GetFileType.KERNELBASE(00000000), ref: 100A2D44
SetHandleCount.KERNEL32 ref: 100A2D7B

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 0e924dc1c542710af7069442172a20ff571d159eb0aded0f43bbca21da910724
Instruction ID: a57c1ff5f4c9d2183571c2b3e2f5e9ee1434f23135dc258d1b4e813c33f5582b
Opcode Fuzzy Hash: 0e924dc1c542710af7069442172a20ff571d159eb0aded0f43bbca21da910724
Instruction Fuzzy Hash: 64510131914265CFD720CBACC8987597BE0FB19378F268678C5A39B2E2D7309906C751

Uniqueness

Uniqueness Score: -1.00%

Function 100B8BAA Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000,00000000,1009D3DA,?,00000000,102024D8,00000000,?,?,?,?,1009E5C6,?,?,?,?), ref: 100B8BB3
SetErrorMode.KERNELBASE(00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B8BBA

Part of subcall function 100B8C0D: GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 100B8C3E
Part of subcall function 100B8C0D: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 100B8CDF
Part of subcall function 100B8C0D: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 100B8D0C

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: 15b3d953bc19076414d90048a8f5b616186e41622a36a53b224c1c9f87799652
Instruction ID: 087b8daccc1f6c15232af1c7bc50bfed5f7c389513a8762a668d1110a768dc41
Opcode Fuzzy Hash: 15b3d953bc19076414d90048a8f5b616186e41622a36a53b224c1c9f87799652
Instruction Fuzzy Hash: 6AF0F9BD9142509FD704EF24D445B1A7BE5EF48750F06888EF4489B3A3CB74E940CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 100A3387 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,1009E4BC,00000001), ref: 100A3398

Part of subcall function 100A323F: GetVersionExA.KERNEL32 ref: 100A325E

HeapDestroy.KERNEL32 ref: 100A33D7

Part of subcall function 100A6D75: HeapAlloc.KERNEL32(00000000,00000140,100A33C0,000003F8), ref: 100A6D82

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: f07123f8dac605b98cec2a6f8b1d4210e4128eb9820a7e61b3c40568f6776003
Instruction ID: afadf4824ae4ff731c78a4d48753470203b12de417edcdbfda830e2e05446c17
Opcode Fuzzy Hash: f07123f8dac605b98cec2a6f8b1d4210e4128eb9820a7e61b3c40568f6776003
Instruction Fuzzy Hash: F7F06536648352EAFF10D7B44C8A75D37D4EB447D2F208C25F401D80A1EEF48781D652

Uniqueness

Uniqueness Score: -1.00%

Function 1009FE15 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 1009FEFC

Part of subcall function 100A5B60: InitializeCriticalSection.KERNEL32(00000000,?,?,?,1009FD6D,00000009,?,?,?), ref: 100A5B9D
Part of subcall function 100A5B60: EnterCriticalSection.KERNEL32(?,?,?,1009FD6D,00000009,?,?,?), ref: 100A5BB8

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 5576f0b4b5dd33d69d6b247caf3936a612d61cb94d29ddb3121c0dbe64597b0b
Instruction ID: bb554ffa4fab1a68767529a3e5eef4976a3ac405748671115ccdc5b027cee7f2
Opcode Fuzzy Hash: 5576f0b4b5dd33d69d6b247caf3936a612d61cb94d29ddb3121c0dbe64597b0b
Instruction Fuzzy Hash: F6212835A00219EBDB10DFA9DC42BEEB7A4FB00760F21451AF818EB5E2C774AD41E664

Uniqueness

Uniqueness Score: -1.00%

Function 10053B30 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(013A0000,00000000,?), ref: 10053B41

Part of subcall function 100507D0: wsprintfA.USER32 ref: 100507E2

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: AllocateHeapwsprintf
String ID:
API String ID: 1352872168-0
Opcode ID: 8f4a746dc0311a72110d9e9e0d91b23e593a354499c0ef69cf1bc2cb8c0bafbd
Instruction ID: 6d07ddb9d044c094a66013f31d76628e75d4fba66ab6e66e8110b09e59daf6fa
Opcode Fuzzy Hash: 8f4a746dc0311a72110d9e9e0d91b23e593a354499c0ef69cf1bc2cb8c0bafbd
Instruction Fuzzy Hash: C3E046B9900208EBEB00CBA0D985A9A77B8EB08300F008258FA094B200D632EE009B91

Uniqueness

Uniqueness Score: -1.00%

Function 100B43FE Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(?,00000100,00000100,00000100), ref: 100B4415

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 9b75291d1cc68b3889218e39b470f55b1b3f212765dcf4c0af887729f4fae742
Instruction ID: 8359965a88f82c01c0158bd845a499ad04138399ba43e1135119a8c9ab86c759
Opcode Fuzzy Hash: 9b75291d1cc68b3889218e39b470f55b1b3f212765dcf4c0af887729f4fae742
Instruction Fuzzy Hash: 4ED09E7A5193A29BC611DF61C804D9FBBA8BF55250B054C49F49453111C720D8548666

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 100511B0 Relevance: 18.3, APIs: 12, Instructions: 273threadwindownetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100511D5
IsWindow.USER32(00020464), ref: 100511F1
SendMessageA.USER32(00020464,000083E7,?,00000000), ref: 1005120A
ExitProcess.KERNEL32 ref: 1005121F
FreeLibrary.KERNEL32(?), ref: 10051303
FreeLibrary.KERNEL32 ref: 10051357
DestroyCursor.USER32(00000000), ref: 100513A7
DestroyCursor.USER32(00000000), ref: 100513BE
IsWindow.USER32(00020464), ref: 100513D5
DestroyCursor.USER32(?), ref: 10051484
WSACleanup.WS2_32 ref: 100514CF

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: CursorDestroy$FreeLibraryWindow$CleanupCurrentExitMessageProcessSendThread
String ID:
API String ID: 2560087610-0
Opcode ID: 707b8f6f0e4e0ea7670fbf31e7e102d33ce47446a8d090316e7ce72e96af57c6
Instruction ID: 469d989f5cfea75ff7cb4fb78b9694011f68c50ed32e348f67c6d81aea70ebb5
Opcode Fuzzy Hash: 707b8f6f0e4e0ea7670fbf31e7e102d33ce47446a8d090316e7ce72e96af57c6
Instruction Fuzzy Hash: D7B157B46007029BD724DF64C8D5BDAB7E9FF48340F51492DE9AAC7281DB30B989CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10050430 Relevance: 15.3, APIs: 10, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,1021B674), ref: 10050497
LoadLibraryA.KERNEL32(?,?,1022BC38), ref: 10050589
LoadLibraryA.KERNEL32(?,?), ref: 100505CF
LoadLibraryA.KERNEL32(?,?,1022BB40,00000001), ref: 10050617
LoadLibraryA.KERNEL32(00000001), ref: 1005062D
GetProcAddress.KERNEL32(00000000,?), ref: 1005063F
FreeLibrary.KERNEL32(00000000), ref: 100506D2

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: Library$Load$AddressProc$Free
String ID:
API String ID: 3120990465-0
Opcode ID: 75f8b8f97f2a34dd914fdd3f315ff725e8f10e0936d79b99ee6fa344b573f52f
Instruction ID: 05b09a8fc11e86cb4538e7611abaae9387d229b962f2f119f66d44664a6082ad
Opcode Fuzzy Hash: 75f8b8f97f2a34dd914fdd3f315ff725e8f10e0936d79b99ee6fa344b573f52f
Instruction Fuzzy Hash: D4A19EB5A04752ABD314DF64C881B9BB3E8FF89310F044A2DF95597281EB34AD19CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000DC38 Relevance: 13.1, Strings: 10, Instructions: 581COMMON

Download Yara Rule

Strings

GetM, xrefs: 1000DE29
ualF, xrefs: 1000DE0A
RtlM, xrefs: 1000DDAF
eNam, xrefs: 1000DE43
Virt, xrefs: 1000DDE6
ualA, xrefs: 1000DDF1
Load, xrefs: 1000DD37
eFil, xrefs: 1000DE3A
GetP, xrefs: 1000DD6A
odul, xrefs: 1000DE31

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID: GetM$GetP$Load$RtlM$Virt$eFil$eNam$odul$ualA$ualF
API String ID: 0-2330598228
Opcode ID: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction ID: 3f8558a2541e45efa72f5b4ea6ff21bd80ef3481b67304b042cdcb36b97d6d8b
Opcode Fuzzy Hash: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction Fuzzy Hash: 0A327D70A002869FEB54DF58C884B9DBBF1FF44394F16816AE854AB399D7B0DD80CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1000B391 Relevance: 13.1, Strings: 10, Instructions: 581COMMON

Download Yara Rule

Strings

eNam, xrefs: 1000B59C
eFil, xrefs: 1000B593
Load, xrefs: 1000B490
ualF, xrefs: 1000B563
GetP, xrefs: 1000B4C3
RtlM, xrefs: 1000B508
odul, xrefs: 1000B58A
Virt, xrefs: 1000B53F
GetM, xrefs: 1000B582
ualA, xrefs: 1000B54A

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID: GetM$GetP$Load$RtlM$Virt$eFil$eNam$odul$ualA$ualF
API String ID: 0-2330598228
Opcode ID: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction ID: d2a28ff6a50f632bb3572c5c41ab9e449cdfeca98239b3fecef99f91761cde9a
Opcode Fuzzy Hash: e95b2be4774fe56dce19853926b31ae9608be0e86b70fc2631ec137b1f0567bd
Instruction Fuzzy Hash: 91329E70A00A06DFEB24CF58C880B99B7F1FF44395F1681AAE955AB399D770DD80CB85

Uniqueness

Uniqueness Score: -1.00%

Function 100A75C6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 2e70ce2c9f22321860c42d5244e68513028ae2390af2eec8113b033fec0f6edb
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 46B15975A0424ADFDB15CF44C9D0AA8BBE1FF48358F25C1ADD81A5B382C731EA46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1002F8C8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056a4eb8a90d97f007b015fba570332645c5903c738d8b8e17427a0223d64916
Instruction ID: be240a574cd6c0a663734a8f5f1201e3ab864da3c6c584b283b6f2e4c7219627
Opcode Fuzzy Hash: 056a4eb8a90d97f007b015fba570332645c5903c738d8b8e17427a0223d64916
Instruction Fuzzy Hash: E85188B1E00345EFEB01CFE498467AEBB74EF18310F54416DE518BB282D6716A54CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1000BC31 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df243571f50a38fa1868784450a17c7f6b8ff57fb907259a4febf094eb20b85c
Instruction ID: 3b95a3801ed842e95b57732c3bb335540bb9858d0a048c30426e45c69e30bfce
Opcode Fuzzy Hash: df243571f50a38fa1868784450a17c7f6b8ff57fb907259a4febf094eb20b85c
Instruction Fuzzy Hash: 1D112B64A10609C7EB00CFA4D480BAEB3B5FF1C700F105069D508EB395E77A9E10C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 1000E4D8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df243571f50a38fa1868784450a17c7f6b8ff57fb907259a4febf094eb20b85c
Instruction ID: b80e278ba4c6a1cff5842473d39247c98dcd9125a09afdc6cc5c560dcf043612
Opcode Fuzzy Hash: df243571f50a38fa1868784450a17c7f6b8ff57fb907259a4febf094eb20b85c
Instruction Fuzzy Hash: 3D112B64A10248C7EB00CFA4D580BAEB3B5FF1C700F105469D508EB395E77A9E10C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 100060FC Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668ced5cacfd4194cfd49e06589f7fa115bc68af22e0a86f89cc01be1e0e93bc
Instruction ID: d9338f4b4855b6357680b1363d73f70f08ba4e2496a1850d1e1eed54151e7907
Opcode Fuzzy Hash: 668ced5cacfd4194cfd49e06589f7fa115bc68af22e0a86f89cc01be1e0e93bc
Instruction Fuzzy Hash: 57E0867375410A5BA70CCC15DD15975374BD7C0370B14C33EF85686285DD68E9618150

Uniqueness

Uniqueness Score: -1.00%

Function 100AA9EF Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,100A35E9,?,Microsoft Visual C++ Runtime Library,00012010,?,1020493C,?,1020498C,?,?,?,Runtime Error!Program: ), ref: 100AAA01
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 100AAA19
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 100AAA2A
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 100AAA37

Strings

GetActiveWindow, xrefs: 100AAA24
MessageBoxA, xrefs: 100AAA13
user32.dll, xrefs: 100AA9FC
GetLastActivePopup, xrefs: 100AAA2C

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: a74306af38e9c4c1ad1bdd7639b7635a187d018bb3919e0ac27513e2504a79e1
Instruction ID: e8165724b945ed01e0431c187fec83e22f06b7cef257cb198dd2aeaf103b0a81
Opcode Fuzzy Hash: a74306af38e9c4c1ad1bdd7639b7635a187d018bb3919e0ac27513e2504a79e1
Instruction Fuzzy Hash: 44012131601373DBDB50DFF58DC8A6B7BE9EB9E6907010529E501C6162DB348844DB62

Uniqueness

Uniqueness Score: -1.00%

Function 100A6A64 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,10204BCC,00000001,00000000,00000000,74DEE860,102379F4,?,00000003,00000000,00000001,00000000,?,?,100A028D), ref: 100A6AA6
LCMapStringA.KERNEL32(00000000,00000100,10204BC8,00000001,00000000,00000000,?,?,100A028D,?), ref: 100A6AC2
LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,74DEE860,102379F4,?,00000003,00000000,00000001,00000000,?,?,100A028D), ref: 100A6B0B
MultiByteToWideChar.KERNEL32(?,102379F5,00000000,00000001,00000000,00000000,74DEE860,102379F4,?,00000003,00000000,00000001,00000000,?,?,100A028D), ref: 100A6B43
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 100A6B9B
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 100A6BB1
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 100A6BE4
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 100A6C4C

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 2eb373ebfc1d7118cb6b1b919dbfd7a6d673843321a28c43fb8b50629bc801ef
Instruction ID: 4b4af60aba4e7cb564ae3ff0afe7de9f29bdb185e78238d85ae9a8b434eff6c1
Opcode Fuzzy Hash: 2eb373ebfc1d7118cb6b1b919dbfd7a6d673843321a28c43fb8b50629bc801ef
Instruction Fuzzy Hash: D6515A71900259EFDF22CF94CC85ADE3FB9FB89794F208629F955A2160D3318D60EB61

Uniqueness

Uniqueness Score: -1.00%

Function 100A34C5 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 100A3532
GetStdHandle.KERNEL32(000000F4,1020493C,00000000,?,00000000,?), ref: 100A3608
WriteFile.KERNEL32(00000000), ref: 100A360F

Strings

..., xrefs: 100A3584
<program name unknown>, xrefs: 100A3542
Runtime Error!Program: , xrefs: 100A3598
Microsoft Visual C++ Runtime Library, xrefs: 100A35DE

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: cf1c400a80d1d6f8f519c7d20f52625956d6cac42374561a115919b0d26c4895
Instruction ID: 75d7edd16df77553bd8204fdcf0ca45fb0a31db4b3d302c0142d5476c8e90829
Opcode Fuzzy Hash: cf1c400a80d1d6f8f519c7d20f52625956d6cac42374561a115919b0d26c4895
Instruction Fuzzy Hash: 7031B076A0021CEFDF20DAE4CC86FEA73ADEB45380F608566F545A7141EB70AA80CA51

Uniqueness

Uniqueness Score: -1.00%

Function 100A30E0 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,1009E511), ref: 100A30FB
GetEnvironmentStrings.KERNEL32(?,?,?,?,1009E511), ref: 100A310F
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,1009E511), ref: 100A313B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,1009E511), ref: 100A3173
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,1009E511), ref: 100A3195
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,1009E511), ref: 100A31AE
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,1009E511), ref: 100A31C1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 100A31FF

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 4433bf0067b83a4e270eb803c1c9dab745779409026a448051f151cc50177b59
Instruction ID: cfb908c35fc159720ef29b2f4a78f0df2796ecd962675dfef85bfa5d948f7730
Opcode Fuzzy Hash: 4433bf0067b83a4e270eb803c1c9dab745779409026a448051f151cc50177b59
Instruction Fuzzy Hash: 9E310A765043A6EFE320FFF94CC882B7BDCF64A6D47124929F952C3111E6A09C40C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 100AA1BE Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,10204BCC,00000001,?,74DEE860,102379F4,?,?,00000002,00000000,?,?,100A028D,?), ref: 100AA1FD
GetStringTypeA.KERNEL32(00000000,00000001,10204BC8,00000001,?,?,?,100A028D,?), ref: 100AA217
GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,74DEE860,102379F4,?,?,00000002,00000000,?,?,100A028D,?), ref: 100AA24B
MultiByteToWideChar.KERNEL32(?,102379F5,?,00000000,00000000,00000000,74DEE860,102379F4,?,?,00000002,00000000,?,?,100A028D,?), ref: 100AA283
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 100AA2D9
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 100AA2EB

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: d6005f5fd8e7dc4fcddc91b1c410834bfd2c5813bb1634ad19983f3edefd3277
Instruction ID: dc7f85178876988037882e2667c7c8db75f15d7d67f101b0e09ba79dbe70e586
Opcode Fuzzy Hash: d6005f5fd8e7dc4fcddc91b1c410834bfd2c5813bb1634ad19983f3edefd3277
Instruction Fuzzy Hash: F7416B7690025AEFCF20DF98CC89AEE7FB9FB0A290F104525F915D6190C73289A0DB91

Uniqueness

Uniqueness Score: -1.00%

Function 100B80D0 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(102372AC,1023729C,00000000,?,102372AC,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?), ref: 100B80DB
EnterCriticalSection.KERNEL32(102372C8,00000010,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B812A
LeaveCriticalSection.KERNEL32(102372C8,00000000,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B813D
LocalAlloc.KERNEL32(00000000,00000003,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B8153
LocalReAlloc.KERNEL32(?,00000003,00000002,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B8165
TlsSetValue.KERNEL32(102372AC,00000000), ref: 100B81A1

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: f5c7ee422b9b62af0218e44f22bcecb7798588a3e08037c1fcf44bd7f7dfd589
Instruction ID: 1f78184cf6855ae451c4be3816702cafbf4a8a272def4790b2df67d60753a780
Opcode Fuzzy Hash: f5c7ee422b9b62af0218e44f22bcecb7798588a3e08037c1fcf44bd7f7dfd589
Instruction Fuzzy Hash: D0314F79100605EFE714CF59C889E96B7E8FF44750F10CA19E56687650E770EE06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 100A33E4 Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(0000000C,00100000,00004000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A341C
VirtualFree.KERNEL32(0000000C,00000000,00008000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3427
HeapFree.KERNEL32(00000000,?,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3434
HeapFree.KERNEL32(00000000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3450
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3471
HeapDestroy.KERNEL32(?,?,1009E562,1009E5B6,?,?,?), ref: 100A3483

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: 9907b2dbabc6b22c07ae2e13deedde6ce08470b4c1765e03c905028d89642275
Instruction ID: 921bf33908d7db1bb4f467f63baf701047519ebc96a747b42b8b88cbf22fbdcb
Opcode Fuzzy Hash: 9907b2dbabc6b22c07ae2e13deedde6ce08470b4c1765e03c905028d89642275
Instruction Fuzzy Hash: 82117C3A240265EBEA32CB54DCC9F49B7A5F748750F228920F6806A4A1C6B1BD41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 100A323F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 100A325E
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 100A3293
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100A32F3

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 100A32CD
__MSVCRT_HEAP_SELECT, xrefs: 100A328E

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: b0fc5c1220a8d89f4271bdd84652c32ab713099f1f215e31a0b58349a27fde11
Instruction ID: 64265b808d29a985652b266f1d5153974a033dd7018804ba12ce5284c4d75aa8
Opcode Fuzzy Hash: b0fc5c1220a8d89f4271bdd84652c32ab713099f1f215e31a0b58349a27fde11
Instruction Fuzzy Hash: 7031D276809298EDEF61C6F05C92BDD7BACDB12384F24C4E9F145D6042EAB19F89CB11

Uniqueness

Uniqueness Score: -1.00%

Function 100B8C0D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 100B8C3E

Part of subcall function 100B8D2A: lstrlenA.KERNEL32(?,00000000,?), ref: 100B8D61

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 100B8CDF
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 100B8D0C

Strings

.INI, xrefs: 100B8D06
.HLP, xrefs: 100B8CD9

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: 215b2dbbfd57f928c0a465aa8ae17e0194eb6833960b13584e80889fe829a9ba
Instruction ID: a6b310693537a418bf49237501887c8a255ee275912405b3828120ee16d60506
Opcode Fuzzy Hash: 215b2dbbfd57f928c0a465aa8ae17e0194eb6833960b13584e80889fe829a9ba
Instruction Fuzzy Hash: 3D3170B9800719DFD720DFB0C885BCAB7FCEF04350F10496AE589D2151EB70AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 100A2AC3 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,100A0892,100A240A,00000000,?,?,00000000,00000001), ref: 100A2AC5
TlsGetValue.KERNEL32 ref: 100A2AD3
SetLastError.KERNEL32(00000000), ref: 100A2B1F

Part of subcall function 100A0C42: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,100A7F94,10204500,000000FF,?,100A2AE8,00000001,00000074), ref: 100A0D38

TlsSetValue.KERNEL32(00000000), ref: 100A2AF7
GetCurrentThreadId.KERNEL32 ref: 100A2B08

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 84d35f0546d9f5a6aaf9d057484cbaa8b6fc2a4440836c52497e07e6645ad6e5
Instruction ID: 30303a567b2660ae9c6e8a5ee3af6970a8f412036590442b6ba16ce2a8e49bf2
Opcode Fuzzy Hash: 84d35f0546d9f5a6aaf9d057484cbaa8b6fc2a4440836c52497e07e6645ad6e5
Instruction Fuzzy Hash: 8AF0BB3D6002719BE2355FB89C4DA893B94EF00BB17210728F546E71E1DF308C41D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 100A5AF4 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,100A2A97,1009E55D,1009E5B6,?,?,?), ref: 100A5B28

Part of subcall function 1009FCEE: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 1009FDC2

DeleteCriticalSection.KERNEL32(?,?,100A2A97,1009E55D,1009E5B6,?,?,?), ref: 100A5B43
DeleteCriticalSection.KERNEL32 ref: 100A5B4B
DeleteCriticalSection.KERNEL32 ref: 100A5B53
DeleteCriticalSection.KERNEL32 ref: 100A5B5B

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 80839d8ce2d3efbf508084d642a8e5c906a0010bae696f60ecfb8db0e32d920c
Instruction ID: c8a102261e4439f78ff6b81f4ec57b3b509e4cb3a60c0317ba03094adb996b3b
Opcode Fuzzy Hash: 80839d8ce2d3efbf508084d642a8e5c906a0010bae696f60ecfb8db0e32d920c
Instruction Fuzzy Hash: 60F05B2D85012CE6DA65BB59DD49C55FA95EA802623660072E8967B130CB334CA0C5E0

Uniqueness

Uniqueness Score: -1.00%

Function 100A78BC Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,1021CFC0,?,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?), ref: 100A78DD
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?), ref: 100A7901
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?), ref: 100A791B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?,?), ref: 100A79DC
HeapFree.KERNEL32(00000000,00000000,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?,?,?), ref: 100A79F3

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: a5e1a649ebce402a5b434beaf74f24afdac75aa47d117765f0271bb3c3eb6095
Instruction ID: fc3b1f2f16ac1edc27d23eacd074c2d4b113a642641c364ce0c648309d99aa48
Opcode Fuzzy Hash: a5e1a649ebce402a5b434beaf74f24afdac75aa47d117765f0271bb3c3eb6095
Instruction Fuzzy Hash: 1631267664071ADFD320CF28CC84B2677E5FB45790F20862BE59A9B6D0DB70A841C758

Uniqueness

Uniqueness Score: -1.00%

Function 100A289D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 100A28B1

Strings

, xrefs: 100A28D6
, xrefs: 100A28FA

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 773b63946a54e029279f74e363202ac7e46494e809db1a43909fca302e94e3e1
Instruction ID: 1c73a3fad27fc45726235786101f17ef1dd38906a74bbd67e98ce6f7336eb253
Opcode Fuzzy Hash: 773b63946a54e029279f74e363202ac7e46494e809db1a43909fca302e94e3e1
Instruction Fuzzy Hash: 664147311042B89BEB36CA98CD99FEBBFA9EB09B04F1010F5D585DB193C3214944DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 100B362C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100B363F
SetWindowsHookExA.USER32(000000FF,V&C,00000000,00000000), ref: 100B364F

Part of subcall function 100B83CB: __EH_prolog.LIBCMT ref: 100B83D0

Strings

V&C, xrefs: 100B3648

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: V&C
API String ID: 2183259885-1695398598
Opcode ID: 4a0c23395f836818af9c28b16c4f11915896402e82734140c132ba99e29c509b
Instruction ID: 78048515fd0e9a15a43ecb7b518d2917f0918a3669aac28163517432cd1fc61c
Opcode Fuzzy Hash: 4a0c23395f836818af9c28b16c4f11915896402e82734140c132ba99e29c509b
Instruction Fuzzy Hash: 79F0A03D4006506FD7209B70ED08B9936A0FF04761F650744F953AA2A1DB30AD80CB62

Uniqueness

Uniqueness Score: -1.00%

Function 100B8217 Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(102372C8,?,102372AC,102372C8,102372AC,?,100B82F6,013C1248,00000000,00000000,?,?,1009D472,?,000000FF), ref: 100B8274
LeaveCriticalSection.KERNEL32(102372C8,?,?,100B82F6,013C1248,00000000,00000000,?,?,1009D472,?,000000FF,?,1009E5C6,?,?), ref: 100B8284
LocalFree.KERNEL32(00000003,?,100B82F6,013C1248,00000000,00000000,?,?,1009D472,?,000000FF,?,1009E5C6,?,?,?), ref: 100B828D
TlsSetValue.KERNEL32(102372AC,00000000,?,100B82F6,013C1248,00000000,00000000,?,?,1009D472,?,000000FF,?,1009E5C6,?,?), ref: 100B82A3

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: ff663e0cca6a86ed0dadfcb778f9189d686d9368ccdec6cb3665bc74eaabb359
Instruction ID: ed143d64073d0a1e94eaf9b39500f5f4128a1b4499ab4b215e09bcaa61158b4e
Opcode Fuzzy Hash: ff663e0cca6a86ed0dadfcb778f9189d686d9368ccdec6cb3665bc74eaabb359
Instruction Fuzzy Hash: 11217939601610EFEB14CF84C885BAA77E5FF45751F108469EA529B1A1C771FE41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 100A741A Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,100A71E2,?,?,?,1009FE63,?,?,?,?,?,?), ref: 100A7442
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,100A71E2,?,?,?,1009FE63,?,?,?,?,?,?), ref: 100A7476
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 100A7490
HeapFree.KERNEL32(00000000,?), ref: 100A74A7

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: c1ea4dfeddbe9e6ed8214b2c14d7306fbc4eade8343a3f74ef79499c1336384a
Instruction ID: 2c20319bad1c28ef711661fa7fbd9028b6d979ea8596f2957e05b0d7aaae370e
Opcode Fuzzy Hash: c1ea4dfeddbe9e6ed8214b2c14d7306fbc4eade8343a3f74ef79499c1336384a
Instruction Fuzzy Hash: 871158702006619FEB31CF58CCC9D5A7BB6FB8D3607108A29E1A6CA5B2C3309942DF10

Uniqueness

Uniqueness Score: -1.00%

Function 100B8E13 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(102373A0,?,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B), ref: 100B8E4E
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B), ref: 100B8E60
LeaveCriticalSection.KERNEL32(102373A0,?,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B), ref: 100B8E69
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B,100B40F3), ref: 100B8E7B

Part of subcall function 100B8D80: GetVersion.KERNEL32(?,100B8E23,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B,100B40F3,1009D463), ref: 100B8D93

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: e531bb49b0eba0f39f75e835d722d6ac0fe849d55abdcbee5780fa29f2afd9b5
Instruction ID: d995fcdc5bfdd8422e1df45e00fb7c6f237e9ea7424d40d11a5b460f46ec3cfe
Opcode Fuzzy Hash: e531bb49b0eba0f39f75e835d722d6ac0fe849d55abdcbee5780fa29f2afd9b5
Instruction Fuzzy Hash: D3F04F3900126BDFDB10EFA8CCC8996B3ADFB58326B400436EA1586032D735F959DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100A5ACB Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,100A2A44,?,1009E4F4), ref: 100A5AD8
InitializeCriticalSection.KERNEL32 ref: 100A5AE0
InitializeCriticalSection.KERNEL32 ref: 100A5AE8
InitializeCriticalSection.KERNEL32 ref: 100A5AF0

Memory Dump Source

Source File: 00000000.00000002.4066811340.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.4066790968.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4066903929.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067077680.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067103438.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067126691.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067154895.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067180288.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067201577.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067225750.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4067288229.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: a3dbd360746503a390bcc2d4b67aa406925a366b79a2ef3cc35c529021e603d2
Instruction ID: 29c78103e5d665d90befb387c0a0bcd68c9463bf0efcf30c9ccee5b762416334
Opcode Fuzzy Hash: a3dbd360746503a390bcc2d4b67aa406925a366b79a2ef3cc35c529021e603d2
Instruction Fuzzy Hash: 13C0023980103CAADE126B75EE8E88A7F26EB082A13218073E50853134CE321C20EFD0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 6728, Parent PID: 5220COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1164
Total number of Limit Nodes:	5

Executed Functions

Function 100B7F61 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(102372C8,1023729C,?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6), ref: 100B7F70
GlobalAlloc.KERNELBASE(00002002,00000000,?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6), ref: 100B7FC5
GlobalHandle.KERNEL32(009A0988), ref: 100B7FCE
GlobalUnlock.KERNEL32(00000000,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B7FD7
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 100B7FE9
GlobalHandle.KERNEL32(009A0988), ref: 100B8000
GlobalLock.KERNEL32(00000000,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B8007
LeaveCriticalSection.KERNEL32(?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B800D
GlobalLock.KERNEL32(?,?,102372AC,102372AC,100B833D,?,?,100B7D4F,100B7644,100B7D6B,100B40F3,1009D463,?,1009E5C6,?,?), ref: 100B801C
LeaveCriticalSection.KERNEL32(?), ref: 100B8065

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 816c57c658faaec40744c78e48b38dfd795ba1b4105b7cc5cddf4eb03449103e
Instruction ID: 498a4d4b33ea80642452fd91aee4d4dcedf663756efad2e5077c2c69e86dd376
Opcode Fuzzy Hash: 816c57c658faaec40744c78e48b38dfd795ba1b4105b7cc5cddf4eb03449103e
Instruction Fuzzy Hash: E2318C7920030A9FE720DF28CC89A6AB7E9FB44351B054A3DF9A6C3661E775ED04CB10

Uniqueness

Uniqueness Score: -1.00%

Function 100B8BAA Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000,00000000,1009D3DA,?,00000000,102024D8,00000000,?,?,?,?,1009E5C6,?,?,?,?), ref: 100B8BB3
SetErrorMode.KERNELBASE(00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B8BBA

Part of subcall function 100B8C0D: GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 100B8C3E
Part of subcall function 100B8C0D: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 100B8CDF
Part of subcall function 100B8C0D: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 100B8D0C

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: 15b3d953bc19076414d90048a8f5b616186e41622a36a53b224c1c9f87799652
Instruction ID: 087b8daccc1f6c15232af1c7bc50bfed5f7c389513a8762a668d1110a768dc41
Opcode Fuzzy Hash: 15b3d953bc19076414d90048a8f5b616186e41622a36a53b224c1c9f87799652
Instruction Fuzzy Hash: 6AF0F9BD9142509FD704EF24D445B1A7BE5EF48750F06888EF4489B3A3CB74E940CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 100A3387 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,1009E4BC,00000001), ref: 100A3398

Part of subcall function 100A323F: GetVersionExA.KERNEL32 ref: 100A325E

HeapDestroy.KERNEL32 ref: 100A33D7

Part of subcall function 100A6D75: HeapAlloc.KERNEL32(00000000,00000140,100A33C0,000003F8), ref: 100A6D82

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: f07123f8dac605b98cec2a6f8b1d4210e4128eb9820a7e61b3c40568f6776003
Instruction ID: afadf4824ae4ff731c78a4d48753470203b12de417edcdbfda830e2e05446c17
Opcode Fuzzy Hash: f07123f8dac605b98cec2a6f8b1d4210e4128eb9820a7e61b3c40568f6776003
Instruction Fuzzy Hash: F7F06536648352EAFF10D7B44C8A75D37D4EB447D2F208C25F401D80A1EEF48781D652

Uniqueness

Uniqueness Score: -1.00%

Function 1009FE15 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?), ref: 1009FEFC

Part of subcall function 100A5B60: InitializeCriticalSection.KERNEL32(00000000,?,?,?,1009FD6D,00000009,?,?,?), ref: 100A5B9D
Part of subcall function 100A5B60: EnterCriticalSection.KERNEL32(?,?,?,1009FD6D,00000009,?,?,?), ref: 100A5BB8

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 5576f0b4b5dd33d69d6b247caf3936a612d61cb94d29ddb3121c0dbe64597b0b
Instruction ID: bb554ffa4fab1a68767529a3e5eef4976a3ac405748671115ccdc5b027cee7f2
Opcode Fuzzy Hash: 5576f0b4b5dd33d69d6b247caf3936a612d61cb94d29ddb3121c0dbe64597b0b
Instruction Fuzzy Hash: F6212835A00219EBDB10DFA9DC42BEEB7A4FB00760F21451AF818EB5E2C774AD41E664

Uniqueness

Uniqueness Score: -1.00%

Function 10053B30 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 10053B41

Part of subcall function 100507D0: wsprintfA.USER32 ref: 100507E2

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocateHeapwsprintf
String ID:
API String ID: 1352872168-0
Opcode ID: 8f4a746dc0311a72110d9e9e0d91b23e593a354499c0ef69cf1bc2cb8c0bafbd
Instruction ID: 6d07ddb9d044c094a66013f31d76628e75d4fba66ab6e66e8110b09e59daf6fa
Opcode Fuzzy Hash: 8f4a746dc0311a72110d9e9e0d91b23e593a354499c0ef69cf1bc2cb8c0bafbd
Instruction Fuzzy Hash: C3E046B9900208EBEB00CBA0D985A9A77B8EB08300F008258FA094B200D632EE009B91

Uniqueness

Uniqueness Score: -1.00%

Function 100B43FE Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32(?,00000100,00000100,00000100), ref: 100B4415

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 9b75291d1cc68b3889218e39b470f55b1b3f212765dcf4c0af887729f4fae742
Instruction ID: 8359965a88f82c01c0158bd845a499ad04138399ba43e1135119a8c9ab86c759
Opcode Fuzzy Hash: 9b75291d1cc68b3889218e39b470f55b1b3f212765dcf4c0af887729f4fae742
Instruction Fuzzy Hash: 4ED09E7A5193A29BC611DF61C804D9FBBA8BF55250B054C49F49453111C720D8548666

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 100511B0 Relevance: 18.3, APIs: 12, Instructions: 273threadwindownetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100511D5
IsWindow.USER32(0001044C), ref: 100511F1
SendMessageA.USER32(0001044C,000083E7,?,00000000), ref: 1005120A
ExitProcess.KERNEL32 ref: 1005121F
FreeLibrary.KERNEL32(?), ref: 10051303
FreeLibrary.KERNEL32 ref: 10051357
DestroyCursor.USER32(00000000), ref: 100513A7
DestroyCursor.USER32(00000000), ref: 100513BE
IsWindow.USER32(0001044C), ref: 100513D5
DestroyCursor.USER32(?), ref: 10051484
WSACleanup.WS2_32 ref: 100514CF

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CursorDestroy$FreeLibraryWindow$CleanupCurrentExitMessageProcessSendThread
String ID:
API String ID: 2560087610-0
Opcode ID: 707b8f6f0e4e0ea7670fbf31e7e102d33ce47446a8d090316e7ce72e96af57c6
Instruction ID: 469d989f5cfea75ff7cb4fb78b9694011f68c50ed32e348f67c6d81aea70ebb5
Opcode Fuzzy Hash: 707b8f6f0e4e0ea7670fbf31e7e102d33ce47446a8d090316e7ce72e96af57c6
Instruction Fuzzy Hash: D7B157B46007029BD724DF64C8D5BDAB7E9FF48340F51492DE9AAC7281DB30B989CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10050430 Relevance: 15.3, APIs: 10, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,1021B674), ref: 10050497
LoadLibraryA.KERNEL32(?,?,1022BC38), ref: 10050589
LoadLibraryA.KERNEL32(?,?), ref: 100505CF
LoadLibraryA.KERNEL32(?,?,1022BB40,00000001), ref: 10050617
LoadLibraryA.KERNEL32(00000001), ref: 1005062D
GetProcAddress.KERNEL32(00000000,?), ref: 1005063F
FreeLibrary.KERNEL32(00000000), ref: 100506D2

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Library$Load$AddressProc$Free
String ID:
API String ID: 3120990465-0
Opcode ID: 75f8b8f97f2a34dd914fdd3f315ff725e8f10e0936d79b99ee6fa344b573f52f
Instruction ID: 05b09a8fc11e86cb4538e7611abaae9387d229b962f2f119f66d44664a6082ad
Opcode Fuzzy Hash: 75f8b8f97f2a34dd914fdd3f315ff725e8f10e0936d79b99ee6fa344b573f52f
Instruction Fuzzy Hash: D4A19EB5A04752ABD314DF64C881B9BB3E8FF89310F044A2DF95597281EB34AD19CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100AA9EF Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,100A35E9,?,Microsoft Visual C++ Runtime Library,00012010,?,1020493C,?,1020498C,?,?,?,Runtime Error!Program: ), ref: 100AAA01
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 100AAA19
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 100AAA2A
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 100AAA37

Strings

GetActiveWindow, xrefs: 100AAA24
MessageBoxA, xrefs: 100AAA13
GetLastActivePopup, xrefs: 100AAA2C
user32.dll, xrefs: 100AA9FC

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: a74306af38e9c4c1ad1bdd7639b7635a187d018bb3919e0ac27513e2504a79e1
Instruction ID: e8165724b945ed01e0431c187fec83e22f06b7cef257cb198dd2aeaf103b0a81
Opcode Fuzzy Hash: a74306af38e9c4c1ad1bdd7639b7635a187d018bb3919e0ac27513e2504a79e1
Instruction Fuzzy Hash: 44012131601373DBDB50DFF58DC8A6B7BE9EB9E6907010529E501C6162DB348844DB62

Uniqueness

Uniqueness Score: -1.00%

Function 100A6A64 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,10204BCC,00000001,00000000,00000000,74DEE860,102379F4,?,00000003,00000000,00000001,00000000,?,?,100A028D), ref: 100A6AA6
LCMapStringA.KERNEL32(00000000,00000100,10204BC8,00000001,00000000,00000000,?,?,100A028D,?), ref: 100A6AC2
LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,74DEE860,102379F4,?,00000003,00000000,00000001,00000000,?,?,100A028D), ref: 100A6B0B
MultiByteToWideChar.KERNEL32(?,102379F5,00000000,00000001,00000000,00000000,74DEE860,102379F4,?,00000003,00000000,00000001,00000000,?,?,100A028D), ref: 100A6B43
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 100A6B9B
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 100A6BB1
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 100A6BE4
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 100A6C4C

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 2eb373ebfc1d7118cb6b1b919dbfd7a6d673843321a28c43fb8b50629bc801ef
Instruction ID: 4b4af60aba4e7cb564ae3ff0afe7de9f29bdb185e78238d85ae9a8b434eff6c1
Opcode Fuzzy Hash: 2eb373ebfc1d7118cb6b1b919dbfd7a6d673843321a28c43fb8b50629bc801ef
Instruction Fuzzy Hash: D6515A71900259EFDF22CF94CC85ADE3FB9FB89794F208629F955A2160D3318D60EB61

Uniqueness

Uniqueness Score: -1.00%

Function 100A34C5 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 100A3532
GetStdHandle.KERNEL32(000000F4,1020493C,00000000,?,00000000,?), ref: 100A3608
WriteFile.KERNEL32(00000000), ref: 100A360F

Strings

<program name unknown>, xrefs: 100A3542
Microsoft Visual C++ Runtime Library, xrefs: 100A35DE
Runtime Error!Program: , xrefs: 100A3598
..., xrefs: 100A3584

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: cf1c400a80d1d6f8f519c7d20f52625956d6cac42374561a115919b0d26c4895
Instruction ID: 75d7edd16df77553bd8204fdcf0ca45fb0a31db4b3d302c0142d5476c8e90829
Opcode Fuzzy Hash: cf1c400a80d1d6f8f519c7d20f52625956d6cac42374561a115919b0d26c4895
Instruction Fuzzy Hash: 7031B076A0021CEFDF20DAE4CC86FEA73ADEB45380F608566F545A7141EB70AA80CA51

Uniqueness

Uniqueness Score: -1.00%

Function 100A30E0 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,1009E511), ref: 100A30FB
GetEnvironmentStrings.KERNEL32(?,?,?,?,1009E511), ref: 100A310F
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,1009E511), ref: 100A313B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,1009E511), ref: 100A3173
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,1009E511), ref: 100A3195
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,1009E511), ref: 100A31AE
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,1009E511), ref: 100A31C1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 100A31FF

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 4433bf0067b83a4e270eb803c1c9dab745779409026a448051f151cc50177b59
Instruction ID: cfb908c35fc159720ef29b2f4a78f0df2796ecd962675dfef85bfa5d948f7730
Opcode Fuzzy Hash: 4433bf0067b83a4e270eb803c1c9dab745779409026a448051f151cc50177b59
Instruction Fuzzy Hash: 9E310A765043A6EFE320FFF94CC882B7BDCF64A6D47124929F952C3111E6A09C40C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 100AA1BE Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,10204BCC,00000001,?,74DEE860,102379F4,?,?,00000002,00000000,?,?,100A028D,?), ref: 100AA1FD
GetStringTypeA.KERNEL32(00000000,00000001,10204BC8,00000001,?,?,?,100A028D,?), ref: 100AA217
GetStringTypeA.KERNEL32(?,?,?,00000000,00000002,74DEE860,102379F4,?,?,00000002,00000000,?,?,100A028D,?), ref: 100AA24B
MultiByteToWideChar.KERNEL32(?,102379F5,?,00000000,00000000,00000000,74DEE860,102379F4,?,?,00000002,00000000,?,?,100A028D,?), ref: 100AA283
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 100AA2D9
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 100AA2EB

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: d6005f5fd8e7dc4fcddc91b1c410834bfd2c5813bb1634ad19983f3edefd3277
Instruction ID: dc7f85178876988037882e2667c7c8db75f15d7d67f101b0e09ba79dbe70e586
Opcode Fuzzy Hash: d6005f5fd8e7dc4fcddc91b1c410834bfd2c5813bb1634ad19983f3edefd3277
Instruction Fuzzy Hash: F7416B7690025AEFCF20DF98CC89AEE7FB9FB0A290F104525F915D6190C73289A0DB91

Uniqueness

Uniqueness Score: -1.00%

Function 100B80D0 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(102372AC,1023729C,00000000,?,102372AC,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?), ref: 100B80DB
EnterCriticalSection.KERNEL32(102372C8,00000010,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B812A
LeaveCriticalSection.KERNEL32(102372C8,00000000,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B813D
LocalAlloc.KERNEL32(00000000,00000003,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B8153
LocalReAlloc.KERNEL32(?,00000003,00000002,?,100B8379,1023729C,00000000,?,1009E5C6,?,?,?,?,?,?), ref: 100B8165
TlsSetValue.KERNEL32(102372AC,00000000), ref: 100B81A1

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: f5c7ee422b9b62af0218e44f22bcecb7798588a3e08037c1fcf44bd7f7dfd589
Instruction ID: 1f78184cf6855ae451c4be3816702cafbf4a8a272def4790b2df67d60753a780
Opcode Fuzzy Hash: f5c7ee422b9b62af0218e44f22bcecb7798588a3e08037c1fcf44bd7f7dfd589
Instruction Fuzzy Hash: D0314F79100605EFE714CF59C889E96B7E8FF44750F10CA19E56687650E770EE06CB60

Uniqueness

Uniqueness Score: -1.00%

Function 100A33E4 Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(0000000C,00100000,00004000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A341C
VirtualFree.KERNEL32(0000000C,00000000,00008000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3427
HeapFree.KERNEL32(00000000,?,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3434
HeapFree.KERNEL32(00000000,?,?,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3450
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,1009E562,1009E5B6,?,?,?), ref: 100A3471
HeapDestroy.KERNEL32(?,?,1009E562,1009E5B6,?,?,?), ref: 100A3483

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: 9907b2dbabc6b22c07ae2e13deedde6ce08470b4c1765e03c905028d89642275
Instruction ID: 921bf33908d7db1bb4f467f63baf701047519ebc96a747b42b8b88cbf22fbdcb
Opcode Fuzzy Hash: 9907b2dbabc6b22c07ae2e13deedde6ce08470b4c1765e03c905028d89642275
Instruction Fuzzy Hash: 82117C3A240265EBEA32CB54DCC9F49B7A5F748750F228920F6806A4A1C6B1BD41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 100A323F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 100A325E
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 100A3293
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100A32F3

Strings

__MSVCRT_HEAP_SELECT, xrefs: 100A328E
__GLOBAL_HEAP_SELECTED, xrefs: 100A32CD

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: b0fc5c1220a8d89f4271bdd84652c32ab713099f1f215e31a0b58349a27fde11
Instruction ID: 64265b808d29a985652b266f1d5153974a033dd7018804ba12ce5284c4d75aa8
Opcode Fuzzy Hash: b0fc5c1220a8d89f4271bdd84652c32ab713099f1f215e31a0b58349a27fde11
Instruction Fuzzy Hash: 7031D276809298EDEF61C6F05C92BDD7BACDB12384F24C4E9F145D6042EAB19F89CB11

Uniqueness

Uniqueness Score: -1.00%

Function 100B8C0D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 100B8C3E

Part of subcall function 100B8D2A: lstrlenA.KERNEL32(?,00000000,?), ref: 100B8D61

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 100B8CDF
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 100B8D0C

Strings

.INI, xrefs: 100B8D06
.HLP, xrefs: 100B8CD9

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: 215b2dbbfd57f928c0a465aa8ae17e0194eb6833960b13584e80889fe829a9ba
Instruction ID: a6b310693537a418bf49237501887c8a255ee275912405b3828120ee16d60506
Opcode Fuzzy Hash: 215b2dbbfd57f928c0a465aa8ae17e0194eb6833960b13584e80889fe829a9ba
Instruction Fuzzy Hash: 3D3170B9800719DFD720DFB0C885BCAB7FCEF04350F10496AE589D2151EB70AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 100A2BCA Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 100A2C28
GetFileType.KERNEL32(00000480), ref: 100A2CD3
GetStdHandle.KERNEL32(-000000F6), ref: 100A2D36
GetFileType.KERNEL32(00000000), ref: 100A2D44
SetHandleCount.KERNEL32 ref: 100A2D7B

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 0e924dc1c542710af7069442172a20ff571d159eb0aded0f43bbca21da910724
Instruction ID: a57c1ff5f4c9d2183571c2b3e2f5e9ee1434f23135dc258d1b4e813c33f5582b
Opcode Fuzzy Hash: 0e924dc1c542710af7069442172a20ff571d159eb0aded0f43bbca21da910724
Instruction Fuzzy Hash: 64510131914265CFD720CBACC8987597BE0FB19378F268678C5A39B2E2D7309906C751

Uniqueness

Uniqueness Score: -1.00%

Function 100A2AC3 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,100A0892,100A240A,00000000,?,?,00000000,00000001), ref: 100A2AC5
TlsGetValue.KERNEL32 ref: 100A2AD3
SetLastError.KERNEL32(00000000), ref: 100A2B1F

Part of subcall function 100A0C42: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,100A7F94,10204500,000000FF,?,100A2AE8,00000001,00000074), ref: 100A0D38

TlsSetValue.KERNEL32(00000000), ref: 100A2AF7
GetCurrentThreadId.KERNEL32 ref: 100A2B08

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 84d35f0546d9f5a6aaf9d057484cbaa8b6fc2a4440836c52497e07e6645ad6e5
Instruction ID: 30303a567b2660ae9c6e8a5ee3af6970a8f412036590442b6ba16ce2a8e49bf2
Opcode Fuzzy Hash: 84d35f0546d9f5a6aaf9d057484cbaa8b6fc2a4440836c52497e07e6645ad6e5
Instruction Fuzzy Hash: 8AF0BB3D6002719BE2355FB89C4DA893B94EF00BB17210728F546E71E1DF308C41D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 100A5AF4 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,100A2A97,1009E55D,1009E5B6,?,?,?), ref: 100A5B28

Part of subcall function 1009FCEE: HeapFree.KERNEL32(00000000,?,?,?,?), ref: 1009FDC2

DeleteCriticalSection.KERNEL32(?,?,100A2A97,1009E55D,1009E5B6,?,?,?), ref: 100A5B43
DeleteCriticalSection.KERNEL32 ref: 100A5B4B
DeleteCriticalSection.KERNEL32 ref: 100A5B53
DeleteCriticalSection.KERNEL32 ref: 100A5B5B

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 80839d8ce2d3efbf508084d642a8e5c906a0010bae696f60ecfb8db0e32d920c
Instruction ID: c8a102261e4439f78ff6b81f4ec57b3b509e4cb3a60c0317ba03094adb996b3b
Opcode Fuzzy Hash: 80839d8ce2d3efbf508084d642a8e5c906a0010bae696f60ecfb8db0e32d920c
Instruction Fuzzy Hash: 60F05B2D85012CE6DA65BB59DD49C55FA95EA802623660072E8967B130CB334CA0C5E0

Uniqueness

Uniqueness Score: -1.00%

Function 100A78BC Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,1021CFC0,?,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?), ref: 100A78DD
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?), ref: 100A7901
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?), ref: 100A791B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?,?), ref: 100A79DC
HeapFree.KERNEL32(00000000,00000000,?,?,100A7D88,?,00000010,?,00000009,00000009,?,1009FEC1,00000010,?,?,?), ref: 100A79F3

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: a5e1a649ebce402a5b434beaf74f24afdac75aa47d117765f0271bb3c3eb6095
Instruction ID: fc3b1f2f16ac1edc27d23eacd074c2d4b113a642641c364ce0c648309d99aa48
Opcode Fuzzy Hash: a5e1a649ebce402a5b434beaf74f24afdac75aa47d117765f0271bb3c3eb6095
Instruction Fuzzy Hash: 1631267664071ADFD320CF28CC84B2677E5FB45790F20862BE59A9B6D0DB70A841C758

Uniqueness

Uniqueness Score: -1.00%

Function 100A289D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 100A28B1

Strings

, xrefs: 100A28FA
, xrefs: 100A28D6

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 773b63946a54e029279f74e363202ac7e46494e809db1a43909fca302e94e3e1
Instruction ID: 1c73a3fad27fc45726235786101f17ef1dd38906a74bbd67e98ce6f7336eb253
Opcode Fuzzy Hash: 773b63946a54e029279f74e363202ac7e46494e809db1a43909fca302e94e3e1
Instruction Fuzzy Hash: 664147311042B89BEB36CA98CD99FEBBFA9EB09B04F1010F5D585DB193C3214944DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 100B362C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100B363F
SetWindowsHookExA.USER32(000000FF,V&C,00000000,00000000), ref: 100B364F

Part of subcall function 100B83CB: __EH_prolog.LIBCMT ref: 100B83D0

Strings

V&C, xrefs: 100B3648

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: V&C
API String ID: 2183259885-1695398598
Opcode ID: 4a0c23395f836818af9c28b16c4f11915896402e82734140c132ba99e29c509b
Instruction ID: 78048515fd0e9a15a43ecb7b518d2917f0918a3669aac28163517432cd1fc61c
Opcode Fuzzy Hash: 4a0c23395f836818af9c28b16c4f11915896402e82734140c132ba99e29c509b
Instruction Fuzzy Hash: 79F0A03D4006506FD7209B70ED08B9936A0FF04761F650744F953AA2A1DB30AD80CB62

Uniqueness

Uniqueness Score: -1.00%

Function 100B8217 Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(102372C8,?,102372AC,102372C8,102372AC,?,100B82F6,0098EB38,00000000,00000000,?,?,1009D472,?,000000FF), ref: 100B8274
LeaveCriticalSection.KERNEL32(102372C8,?,?,100B82F6,0098EB38,00000000,00000000,?,?,1009D472,?,000000FF,?,1009E5C6,?,?), ref: 100B8284
LocalFree.KERNEL32(00000003,?,100B82F6,0098EB38,00000000,00000000,?,?,1009D472,?,000000FF,?,1009E5C6,?,?,?), ref: 100B828D
TlsSetValue.KERNEL32(102372AC,00000000,?,100B82F6,0098EB38,00000000,00000000,?,?,1009D472,?,000000FF,?,1009E5C6,?,?), ref: 100B82A3

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: ff663e0cca6a86ed0dadfcb778f9189d686d9368ccdec6cb3665bc74eaabb359
Instruction ID: ed143d64073d0a1e94eaf9b39500f5f4128a1b4499ab4b215e09bcaa61158b4e
Opcode Fuzzy Hash: ff663e0cca6a86ed0dadfcb778f9189d686d9368ccdec6cb3665bc74eaabb359
Instruction Fuzzy Hash: 11217939601610EFEB14CF84C885BAA77E5FF45751F108469EA529B1A1C771FE41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 100A741A Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,100A71E2,?,?,?,1009FE63,?,?,?,?,?,?), ref: 100A7442
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,100A71E2,?,?,?,1009FE63,?,?,?,?,?,?), ref: 100A7476
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 100A7490
HeapFree.KERNEL32(00000000,?), ref: 100A74A7

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: c1ea4dfeddbe9e6ed8214b2c14d7306fbc4eade8343a3f74ef79499c1336384a
Instruction ID: 2c20319bad1c28ef711661fa7fbd9028b6d979ea8596f2957e05b0d7aaae370e
Opcode Fuzzy Hash: c1ea4dfeddbe9e6ed8214b2c14d7306fbc4eade8343a3f74ef79499c1336384a
Instruction Fuzzy Hash: 871158702006619FEB31CF58CCC9D5A7BB6FB8D3607108A29E1A6CA5B2C3309942DF10

Uniqueness

Uniqueness Score: -1.00%

Function 100B8E13 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(102373A0,?,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B), ref: 100B8E4E
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B), ref: 100B8E60
LeaveCriticalSection.KERNEL32(102373A0,?,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B), ref: 100B8E69
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B,100B40F3), ref: 100B8E7B

Part of subcall function 100B8D80: GetVersion.KERNEL32(?,100B8E23,?,100B83EC,00000010,?,?,?,?,?,100B7D65,100B7DC8,100B7644,100B7D6B,100B40F3,1009D463), ref: 100B8D93

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: e531bb49b0eba0f39f75e835d722d6ac0fe849d55abdcbee5780fa29f2afd9b5
Instruction ID: d995fcdc5bfdd8422e1df45e00fb7c6f237e9ea7424d40d11a5b460f46ec3cfe
Opcode Fuzzy Hash: e531bb49b0eba0f39f75e835d722d6ac0fe849d55abdcbee5780fa29f2afd9b5
Instruction Fuzzy Hash: D3F04F3900126BDFDB10EFA8CCC8996B3ADFB58326B400436EA1586032D735F959DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100A5ACB Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,100A2A44,?,1009E4F4), ref: 100A5AD8
InitializeCriticalSection.KERNEL32 ref: 100A5AE0
InitializeCriticalSection.KERNEL32 ref: 100A5AE8
InitializeCriticalSection.KERNEL32 ref: 100A5AF0

Memory Dump Source

Source File: 00000003.00000002.4066840109.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4066812809.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000100BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4066921397.00000000101CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067104806.000000001020E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067127421.0000000010210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067152175.0000000010211000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067178887.000000001021B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067202705.000000001021F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067228057.000000001022B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010235000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067256180.0000000010237000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4067315947.0000000010239000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: a3dbd360746503a390bcc2d4b67aa406925a366b79a2ef3cc35c529021e603d2
Instruction ID: 29c78103e5d665d90befb387c0a0bcd68c9463bf0efcf30c9ccee5b762416334
Opcode Fuzzy Hash: a3dbd360746503a390bcc2d4b67aa406925a366b79a2ef3cc35c529021e603d2
Instruction Fuzzy Hash: 13C0023980103CAADE126B75EE8E88A7F26EB082A13218073E50853134CE321C20EFD0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 5220, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 3668, Parent PID: 5220

General

Chronological Activities

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.11946.22825.dll

Function 1009E49D Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Function 100B7F61 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMON

Function 100A2BCA Relevance: 7.6, APIs: 5, Instructions: 150
COMMON

Function 100B8BAA Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Function 100A3387 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Function 1009FE15 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Function 10053B30 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 100B43FE Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Function 100B7F61 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMON

Function 100B8BAA Relevance: 3.0, APIs: 2, Instructions: 32
COMMON