Edit tour

Windows Analysis Report
GIYUCke96G.exe

Overview

General Information

Sample name:	GIYUCke96G.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	bc00fef073d78e021e5273735cd8a75b55261a7564a01af944ed35f4513aadf9
Analysis ID:	1446955
MD5:	63ba5ec400ebbe6af65441f442652faa
SHA1:	3b8807f8124c0e0d8c8cd816f9a7bc30476fbf5c
SHA256:	bc00fef073d78e021e5273735cd8a75b55261a7564a01af944ed35f4513aadf9
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found direct / indirect Syscall (likely to bypass EDR)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

GIYUCke96G.exe (PID: 2724 cmdline: "C:\Users\user\Desktop\GIYUCke96G.exe" MD5: 63BA5EC400EBBE6AF65441F442652FAA)

WerFault.exe (PID: 3664 cmdline: C:\Windows\system32\WerFault.exe -u -p 2724 -s 396 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: GIYUCke96G.exe

Virustotal: Detection: 13%

Perma Link

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Code function: 0_2_00000001402B25F8 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00000001402B25F8

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_0000000140008E2E	0_2_0000000140008E2E
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_00000001402B109C	0_2_00000001402B109C
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_00000001402B25F8	0_2_00000001402B25F8
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_0000000140008ED6	0_2_0000000140008ED6

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2724 -s 396

Source: GIYUCke96G.exe	Binary or memory string: OriginalFilename vs GIYUCke96G.exe
Source: GIYUCke96G.exe, 00000000.00000000.2003520250.00000001402E1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpaceflight> vs GIYUCke96G.exe
Source: GIYUCke96G.exe	Binary or memory string: OriginalFilenameSpaceflight> vs GIYUCke96G.exe

Source: classification engine

Classification label: mal52.evad.winEXE@2/5@0/0

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2724

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\517a9fb7-3793-4e23-978f-cdbe69ec6437

Jump to behavior

Source: GIYUCke96G.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GIYUCke96G.exe

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\GIYUCke96G.exe "C:\Users\user\Desktop\GIYUCke96G.exe"
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2724 -s 396

Source: C:\Users\user\Desktop\GIYUCke96G.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: GIYUCke96G.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: GIYUCke96G.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: GIYUCke96G.exe

Static file information: File size 2983936 > 1048576

Source: GIYUCke96G.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2b8e00

Source: GIYUCke96G.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Code function: 0_2_00000001400041A0 LoadLibraryA,GetProcAddress,

0_2_00000001400041A0

Source: GIYUCke96G.exe

Static PE information: section name: _RDATA

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\GIYUCke96G.exe

API coverage: 3.0 %

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Code function: 0_2_00000001402B25F8 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00000001402B25F8

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\GIYUCke96G.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Code function: 0_2_00000001402B1FEC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00000001402B1FEC

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Code function: 0_2_00000001400041A0 LoadLibraryA,GetProcAddress,

0_2_00000001400041A0

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Code function: 0_2_00000001402B4E20 GetProcessHeap,

0_2_00000001402B4E20

Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_00000001402B1FEC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00000001402B1FEC
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_00000001402AC894 SetUnhandledExceptionFilter,	0_2_00000001402AC894
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_00000001402AC6B4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00000001402AC6B4
Source: C:\Users\user\Desktop\GIYUCke96G.exe	Code function: 0_2_00000001402B8BC8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00000001402B8BC8

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\GIYUCke96G.exe

NtMapViewOfSection: Indirect: 0x1402A95E9

Jump to behavior

Source: C:\Users\user\Desktop\GIYUCke96G.exe

Code function: 0_2_00000001402AC58C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00000001402AC58C

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
GIYUCke96G.exe	17%	ReversingLabs
GIYUCke96G.exe	14%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446955
Start date and time:	2024-05-24 05:24:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GIYUCke96G.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	bc00fef073d78e021e5273735cd8a75b55261a7564a01af944ed35f4513aadf9
Detection:	MAL
Classification:	mal52.evad.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 6 Number of non-executed functions: 30

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com

Simulations

Behavior and APIs

Time	Type	Description
23:25:43	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GIYUCke96G.exe_4f8fc75c7ae03519ba32df973fcbeda86d1ecbbb_135d818b_9064d5b3-0f98-489e-9c5d-f62a688a6a9c\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.745139971575256
Encrypted:	false
SSDEEP:	96:AtF1t44FzGsycqhsoa7JnuQXIDcQNc6dcEjcw3eM+HbHg/TgJ3YOZUXOyKnhfHNI:A3t4qzGxu0zZZa1j/yzuiFSZ24lO8I
MD5:	7718659ED72AAADC4C66260869ED5DE1
SHA1:	73E1D294BBA0B133C45F7FF64591BBF560251B87
SHA-256:	51DD5720C8BCD3DBDFDE6C5070A294CFA3F38E855BC4D2284C1E7B622BF88484
SHA-512:	C2FE993DC4A6D56C79068C879CB2AC8126FFD1FB608F78ABD26EED16067B598350201CADD461E3C16CD83593AB678822B2D2A38F07EA9C7D53D2C1F2E93F195E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.0.9.9.4.7.2.3.5.7.0.8.2.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.0.9.9.4.7.2.4.6.4.8.9.4.1.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.6.4.d.5.b.3.-.0.f.9.8.-.4.8.9.e.-.9.c.5.d.-.f.6.2.a.6.8.8.a.6.a.9.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.b.7.b.f.5.d.-.d.b.1.1.-.4.8.d.4.-.9.d.9.f.-.4.3.5.5.9.f.4.c.a.3.4.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.G.I.Y.U.C.k.e.9.6.G...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.p.a.c.e.f.l.i.g.h.t.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.a.4.-.0.0.0.1.-.0.0.1.4.-.a.0.3.5.-.c.9.0.2.8.a.a.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.b.d.1.5.b.f.1.8.8.d.2.d.8.8.2.c.e.f.5.6.0.a.3.4.4.a.8.5.1.b.3.0.0.0.0.1.d.0.4.!.0.0.0.0.3.b.8.8.0.7.f.8.1.2.4.c.0.e.0.d.8.c.8.c.d.8.1.6.f.9.a.7.b.c.3.0.4.7.6.f.b.f.5.c.!.G.I.Y.U.C.k.e.9.6.G...

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD900.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri May 24 03:25:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	295220
Entropy (8bit):	2.652347589422294
Encrypted:	false
SSDEEP:	3072:fqqSyxQf7GmTWZikG9e4vvYTFpCPxLHk9EMG6h1HOE1t:fqTGAWCvMqHtMG/E1
MD5:	362BC322FD2ED697FA854D6F3D379361
SHA1:	BF53CA314CD01C18D7008DC571E308992E7B2096
SHA-256:	A2DCD1BE59F91D37797C7AABA59AED063763674E6F30A1FC8592749251AAEF2A
SHA-512:	D3C8DF8CE196D0E7823747FE56C376D80C767B0B817158CFFD6C6CA5FD4719C63F3B960F1D63FFE7C6DEB6354A8AFEC24F833AF80CE1895748C71A4ACCBD5D5D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........Pf....................................<...........$...6(..........`.......8...........T...............\q......................................................................................................eJ......p.......Lw......................T.............Pf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBFF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	3.708714771647923
Encrypted:	false
SSDEEP:	192:R6l7wVeJ17cRRBQ6YEIsE2SzgmfYVTprV89bXngfUq9m:R6lXJZcRRBQ6YEzE2SzgmfYWXgfUZ
MD5:	3ACB8FE8E07C479A490D3E8351931A95
SHA1:	FCDEE5500DFB41F777D72D0369C97F0281CA7852
SHA-256:	86FA126B26F23FDEF6EECE0AE6A0EE813E1A8072A25088958FDC7E35A0722FA6
SHA-512:	1FC71C78030DDD473EE27BFACD7EEDEB11D7A83BB5E21664C5D639BCE18FA6C33DB85D4E67206CD840B758A079C2691B98DBEDC29A2DBF2C28D3C3015BA3CC86
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCBB.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4752
Entropy (8bit):	4.515548037207879
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9xmWpW8VY375Ym8M4JdzFuPyq85YqhZko+Pfd:uIjfsI7+n7VEoJ+Pyoo+nd
MD5:	DFF5547E812D29404E1B7C7D21C21040
SHA1:	E6E62A3FCA6F226C8A0838AC006349FE44438F05
SHA-256:	8451172605F0D6D68711E4674CE4E4A7960EE68FB4B3C0F84F83736CAA346BAA
SHA-512:	64D38B6009A6FAEB98542B0DC8B1C03E5518404D938BAB822EB4A6BE5737421AA6A1078F0C972D02C1752829DB7F56010EB6A11A319E57EE2B7C84929CC095B9
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="336628" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.42205093861428
Encrypted:	false
SSDEEP:	6144:qSvfpi6ceLP/9skLmb0OT3WSPHaJG8nAgeMZMMhA2fX4WABlEnNX0uhiTw:ZvloT3W+EZMM6DFyh03w
MD5:	C199CD56AEA1F55A426FD179DCDE59DA
SHA1:	71B790689E8732CF76DCEBF189C999374E976FFB
SHA-256:	6B54B6ECF8B3F9B0CDA7DB6107475F1D8729591C4883D1F4FD06D552C324F09C
SHA-512:	C43817830796541C65B0BC3F7B734F94FA50657D03E5EDFFACDD54463ED5884A8E1825A2EF650E95F3BF9566E5FB5B9F374C9DDC679A8D0F7FDDEFFEAA617FB0
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmz.O.................................................................................................................................................................................................................................................................................................................................................V.Y7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

GetModuleHandleA, GetProcAddress, LoadLibraryA, HeapCreate, WriteConsoleW, CloseHandle, CreateFileW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapReAlloc, HeapSize, GetProcessHeap, LCMapStringW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetStringTypeW, GetFileType, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, MultiByteToWideChar, GetCommandLineW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, RtlUnwindEx, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, EncodePointer, RaiseException, RtlPcToFileHeader, GetStdHandle, WriteFile, GetModuleFileNameW, GetCurrentProcess, ExitProcess, TerminateProcess, GetModuleHandleExW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA

ole32.dll

OleGetAutoConvert, IsAccelerator, GetClassFile, MonikerRelativePathTo, CoGetObject, CoTreatAsClass, CoFileTimeToDosDateTime, CoIsOle1Class, CoGetInstanceFromFile, CoRevokeInitializeSpy, CoRevokeMallocSpy, CLSIDFromProgIDEx, CoFileTimeNow, CoTaskMemFree, CoTaskMemRealloc, CoInvalidateRemoteMachineBindings, CoGetInterceptor, ProgIDFromCLSID, IIDFromString, StringFromIID, CoSetCancelObject, CoRevertToSelf, CoQueryClientBlanket, CoQueryProxyBlanket, CoGetCallContext, CoLockObjectExternal, CoUnmarshalHresult, CoGetPSClsid, CoResumeClassObjects, CoGetObjectContext, CoGetCurrentLogicalThreadId, CoGetCallerTID, CoGetMalloc, CoGetTreatAsClass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	23:25:22
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\GIYUCke96G.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\GIYUCke96G.exe"
Imagebase:	0x140000000
File size:	2'983'936 bytes
MD5 hash:	63BA5EC400EBBE6AF65441F442652FAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:25:23
Start date:	23/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2724 -s 396
Imagebase:	0x7ff69d980000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	949
Total number of Limit Nodes:	17

Executed Functions

Function 0000000140008E2E Relevance: 27.5, Strings: 6, Instructions: 20001
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400041A0: LoadLibraryA.KERNELBASE ref: 00000001400041C5
Part of subcall function 00000001400041A0: GetProcAddress.KERNEL32 ref: 0000000140004200

CoGetPSClsid.OLE32 ref: 00000001402AB4D7
CoGetTreatAsClass.OLE32 ref: 00000001402AB751
MonikerRelativePathTo.OLE32 ref: 00000001402AB7DA
CoGetCurrentLogicalThreadId.OLE32 ref: 00000001402AB8CB
CoGetPSClsid.OLE32 ref: 00000001402ABA77
CoGetCallerTID.OLE32 ref: 00000001402A91D1

Part of subcall function 00000001402ABF50: CLSIDFromProgIDEx.OLE32 ref: 00000001402ABF6C

Part of subcall function 00000001400040D0: GetModuleHandleA.KERNEL32 ref: 00000001400040F5
Part of subcall function 00000001400040D0: GetProcAddress.KERNEL32 ref: 0000000140004123
Part of subcall function 00000001400040D0: GetModuleHandleA.KERNEL32 ref: 000000014000414C
Part of subcall function 00000001400040D0: GetProcAddress.KERNEL32 ref: 000000014000417D

StringFromIID.OLE32 ref: 00000001402AB581
CoQueryProxyBlanket.OLE32 ref: 00000001402AB62E
CoGetObject.OLE32 ref: 00000001402AB6DB

Strings

H, xrefs: 00000001402A8A24
@, xrefs: 00000001402A9592
r, xrefs: 00000001402A9037
@, xrefs: 00000001402A94FF
Y, xrefs: 00000001402AB3F7
H, xrefs: 00000001402A8944

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: AddressProc$ClsidFromHandleModule$BlanketCallerClassCurrentLibraryLoadLogicalMonikerObjectPathProgProxyQueryRelativeStringThreadTreat
String ID: @$@$H$H$Y$r
API String ID: 1894718216-3629373268
Opcode ID: 038f2c05af8015c05d38ad835665cb5cf977f3dfd20b3bc0a05d218bb1fc8148
Instruction ID: db909e0964cc4a4f4073fb0fa6d168423cbb36b7abef90c82d75138de18a117d
Opcode Fuzzy Hash: 038f2c05af8015c05d38ad835665cb5cf977f3dfd20b3bc0a05d218bb1fc8148
Instruction Fuzzy Hash: 4FC4A236208AC4CAC775CF29E8906EAB7A1F7C8B41F44411AEA8DC7B68DA7DD550DF10

Function 00000001400041A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000001400041C5
GetProcAddress.KERNEL32 ref: 0000000140004200

Strings

dxgi.dll, xrefs: 00000001400041A4, 00000001400041BE
CreateDXGIFactory, xrefs: 00000001400041DA, 00000001400041F9

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateDXGIFactory$dxgi.dll
API String ID: 2574300362-1239289089
Opcode ID: 6fd33beb336cd2bc201b088de60c2f410a9f6ad0272571c72995a5aab73a9aac
Instruction ID: a5d12e359f0ca4f603bb42c86ca6ac546ffcac3e2eea99c56795c456df7880c0
Opcode Fuzzy Hash: 6fd33beb336cd2bc201b088de60c2f410a9f6ad0272571c72995a5aab73a9aac
Instruction Fuzzy Hash: 3DF01DB0205E40A2EA12DF16F889BC53330FB8C388F800111EA8D026B5DFBCC65AC704

Function 00000001402AC202 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_release_startup_lock.LIBCMT ref: 00000001402AC256
__scrt_get_show_window_mode.LIBCMT ref: 00000001402AC2A9

Strings

XK, xrefs: 00000001402AC327
G, xrefs: 00000001402AC2B1

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: __scrt_get_show_window_mode__scrt_release_startup_lock
String ID: XK$G
API String ID: 2313669860-2418997595
Opcode ID: 2a7e03f0da093cdaf4e397b5df884c7b75e1e2e389455218759f041a7d0a0718
Instruction ID: 19d0ab484c720362ae3384981da683f41ac2caa8475927e3aab0f052a83844e2
Opcode Fuzzy Hash: 2a7e03f0da093cdaf4e397b5df884c7b75e1e2e389455218759f041a7d0a0718
Instruction Fuzzy Hash: 7D215C71220A0151FE57EFA7A49EFE923A19BCD744F645425AB094B2F3DEF8C884CA04

Function 00000001402B3B90 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001402B3BBB

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d4681ef3ba11a55dceac8b37cdcae43a6c1429e8e55df718a07245dda3385595
Instruction ID: 2c4f90d464d89ff6f086db49541c5f5935f9be18aa01c26d9aa92a074346ade7
Opcode Fuzzy Hash: d4681ef3ba11a55dceac8b37cdcae43a6c1429e8e55df718a07245dda3385595
Instruction Fuzzy Hash: 6811A032204E8082F3129F16E448BDAB7B5F74C780F590925EB99A77F6EBB8D8519700

Function 00000001402B2530 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00000001402B1DAE,?,?,?,00000001402B2519,?,?,?,?,00000001402B0EB8), ref: 00000001402B2585

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 40713ccbbc1d0f54883f72b9beb1289b3dcab3e5003ac53910a298c115c6ae3e
Instruction ID: 91be01660be9446b6c820d9b2f3def065acd19d33041fa6b28724a6111d43bdf
Opcode Fuzzy Hash: 40713ccbbc1d0f54883f72b9beb1289b3dcab3e5003ac53910a298c115c6ae3e
Instruction Fuzzy Hash: C4F0F974301B0551FE7B5EA75869BE952A16B5CB80F8C84204F0A966F6EABCC889C310

Function 00000001402AC388 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000001402AC39C

Part of subcall function 00000001402ACD70: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00000001402ACD78
Part of subcall function 00000001402ACD70: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00000001402ACD7D

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: ec16af84989917c27705a06c4fef5840aa6d90286ed2c06e97257fc3bee4fb4b
Instruction ID: bf3cdbdc8a70876a40036b231d277068856ae36f7c587f60011e48209eddc925
Opcode Fuzzy Hash: ec16af84989917c27705a06c4fef5840aa6d90286ed2c06e97257fc3bee4fb4b
Instruction Fuzzy Hash: BEE0E27453564081FEAB3A27150EFE906840FEE308FB084E9AB52661F3DDF644D65E22

Non-executed Functions

Function 0000000140008ED6 Relevance: 26.3, Strings: 5, Instructions: 20001
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400041A0: LoadLibraryA.KERNELBASE ref: 00000001400041C5
Part of subcall function 00000001400041A0: GetProcAddress.KERNEL32 ref: 0000000140004200

CoGetCallerTID.OLE32 ref: 00000001402A91D1
StringFromIID.OLE32 ref: 00000001402AB581
CoQueryProxyBlanket.OLE32 ref: 00000001402AB62E
CoGetObject.OLE32 ref: 00000001402AB6DB

Strings

H, xrefs: 00000001402A8A24
@, xrefs: 00000001402A9592
r, xrefs: 00000001402A9037
@, xrefs: 00000001402A94FF
H, xrefs: 00000001402A8944

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: AddressBlanketCallerFromLibraryLoadObjectProcProxyQueryString
String ID: @$@$H$H$r
API String ID: 666015294-3945287539
Opcode ID: a0c1e5eb2b1411516c88b3d173d62224a84b06e26947a95c75cd411bf50de0b9
Instruction ID: c5bbe874826d3746ab1ef076448cef3d6fb6239318b3dc67789aa3bc30945ca1
Opcode Fuzzy Hash: a0c1e5eb2b1411516c88b3d173d62224a84b06e26947a95c75cd411bf50de0b9
Instruction Fuzzy Hash: C9C4A236208AC4CAC775CF29E8906EAB7A1F7C8B41F44411AEA8DC3B68DA7DD550DF10

Function 00000001402AC6B4 Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000001402AC6D0
RtlCaptureContext.KERNEL32 ref: 00000001402AC6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00000001402AC717
RtlVirtualUnwind.KERNEL32 ref: 00000001402AC758
IsDebuggerPresent.KERNEL32 ref: 00000001402AC7AC
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001402AC7C9
UnhandledExceptionFilter.KERNEL32 ref: 00000001402AC7D4

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 7afb6d694b222e546b645fc65cd3fe91a7edead463a92d789e7364e493699f52
Instruction ID: 83fb1b7315c843de182df63247d62886b70938f64d569180b938eb02df73d946
Opcode Fuzzy Hash: 7afb6d694b222e546b645fc65cd3fe91a7edead463a92d789e7364e493699f52
Instruction Fuzzy Hash: 8C313B72215F8096EB618F65E844BED7374F788744F44402ADB4E47BA8DFB8C588CB10

Function 00000001402B1FEC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001402B2065
RtlLookupFunctionEntry.KERNEL32 ref: 00000001402B207D
RtlVirtualUnwind.KERNEL32 ref: 00000001402B20B8
IsDebuggerPresent.KERNEL32 ref: 00000001402B20F1
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001402B20FB
UnhandledExceptionFilter.KERNEL32 ref: 00000001402B2106

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4ecea2e15c50c040234c0291c608cc000d4d494e678835bf060f456b328a71e0
Instruction ID: c444432125d9f9a79dc32746f9ad1b7773f3e3bb89bb8b4eb258b07f06d9c8fc
Opcode Fuzzy Hash: 4ecea2e15c50c040234c0291c608cc000d4d494e678835bf060f456b328a71e0
Instruction Fuzzy Hash: B4313A32214F8096DB618F2AE844BDA73B4F798754F500126EB9D43BA9EF78C549CB00

Function 00000001402B25F8 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001402B2644
FindFirstFileExW.KERNEL32 ref: 00000001402B274E

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: fc25b786cef1f5a770a2721d84f12a51ee61daf0edec9664a92732eaae3375a1
Instruction ID: 77de8bb249ac00d04cb752a060f1fe343503dfef3a3a4c6c0652030635d203e0
Opcode Fuzzy Hash: fc25b786cef1f5a770a2721d84f12a51ee61daf0edec9664a92732eaae3375a1
Instruction Fuzzy Hash: 7AB1BF32714F9041EA66DF279818BE9A3B0E74DBE0F545521EF9A17BE9DEB8C449C300

Function 00000001402AC58C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001402AC5B8
GetCurrentThreadId.KERNEL32 ref: 00000001402AC5C6
GetCurrentProcessId.KERNEL32 ref: 00000001402AC5D2
QueryPerformanceCounter.KERNEL32 ref: 00000001402AC5E2

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1d5a125baf1684abd2bac30192f0ce4b34ea4ad278dec54152c71ef2b7d62ff5
Instruction ID: cd2491e243a284785d01627eb49247af546fe745c2aaeddbc20f1ebf55742304
Opcode Fuzzy Hash: 1d5a125baf1684abd2bac30192f0ce4b34ea4ad278dec54152c71ef2b7d62ff5
Instruction Fuzzy Hash: 64112A36710F009AEB00DF65E8587A833B4F75D758F441E21EB6D467A4EFB8C5998380

Function 00000001402B8BC8 Relevance: 4.5, APIs: 3, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00000001,00000001402B8CC9,?,?,?,?,?,?,00000001402B212F), ref: 00000001402B8BD3
UnhandledExceptionFilter.KERNEL32(?,?,00000001,00000001402B8CC9,?,?,?,?,?,?,00000001402B212F), ref: 00000001402B8BDC
GetCurrentProcess.KERNEL32(?,?,00000001,00000001402B8CC9,?,?,?,?,?,?,00000001402B212F), ref: 00000001402B8BE2

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: 3c02acc70f0df77d87e0d5b1984459dd989929ec50c3f486856a545a05351746
Instruction ID: 3aef326eb1f4ca4ea36ee6b3ab0b679ace7ee8178ade7272b6060aa97718c362
Opcode Fuzzy Hash: 3c02acc70f0df77d87e0d5b1984459dd989929ec50c3f486856a545a05351746
Instruction Fuzzy Hash: 49D0C972620E05A6FB9A1F67AC1DBA53274A75CB55F041024CB8B463B0EDBCC8858B00

Function 00000001402B4E20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001402B4E24

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 16544bf4b707b4a64cbb28ea833b87f135aa1759d969d46fabe785ab77718a3b
Instruction ID: 74d79dc8844c5c2b7bacbea1c1cd9462be4e2e3e852a3e9f97c073a02851643e
Opcode Fuzzy Hash: 16544bf4b707b4a64cbb28ea833b87f135aa1759d969d46fabe785ab77718a3b
Instruction Fuzzy Hash: 35B09230A0BB10C6EA4A2B1A6C8AB4432A57B8C700F884018820D40370DB7C04AEA700

Function 00000001402B109C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8dd82e51f9094549ab372f28f6d10f50b60e234daa541b0fb578bf1e71a59b57
Instruction ID: 184f0d3e74c4f3ea14d1a38f50f63c01c45697b48cde2d777242e4a59ee03b9e
Opcode Fuzzy Hash: 8dd82e51f9094549ab372f28f6d10f50b60e234daa541b0fb578bf1e71a59b57
Instruction Fuzzy Hash: F2419372320E5441EF08CF6BD958B9963A5B74CFD0F899426EF0D97BA8EA7CC5428340

Function 00000001402AC894 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44a64da980616001572add55df9b11eca919e0492d44fc2c0d224aef2fd1f8a
Instruction ID: 98b10b4cb8a65fdcffe13ad5fb5942c90e1b934b02d98d098e411b4ea6ffe468
Opcode Fuzzy Hash: b44a64da980616001572add55df9b11eca919e0492d44fc2c0d224aef2fd1f8a
Instruction Fuzzy Hash: 5AA00231124D00E8EA478F0AE958B903370F7DC711F561011C28D450F09FBCC580CB00

Function 00000001400040D0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 35
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000001400040F5
GetProcAddress.KERNEL32 ref: 0000000140004123
GetModuleHandleA.KERNEL32 ref: 000000014000414C
GetProcAddress.KERNEL32 ref: 000000014000417D

Strings

MpIntHandlerReturnAddress, xrefs: 0000000140004157, 0000000140004176
kernel32.dll, xrefs: 00000001400040D4, 00000001400040EE
MpExitThread, xrefs: 0000000140004100, 000000014000411C
ntdll.dll, xrefs: 000000014000412E, 0000000140004145

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: MpExitThread$MpIntHandlerReturnAddress$kernel32.dll$ntdll.dll
API String ID: 1646373207-4278568421
Opcode ID: 9d6eb343c31b395ef900622fd9a5d8ba87d908a8a948cb6debcc423d49452964
Instruction ID: b849397bb44b0204d56fe51950d9367d1ff3146b5519135c410321b03221b8da
Opcode Fuzzy Hash: 9d6eb343c31b395ef900622fd9a5d8ba87d908a8a948cb6debcc423d49452964
Instruction Fuzzy Hash: 4211DAB0615E45A2EA02EF06F899BD53331FF98789F805112E78D026BADFBCC51AC745

Function 00000001402ADEF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000001402ADF4C

Part of subcall function 00000001402AEE94: __GetUnwindTryBlock.LIBCMT ref: 00000001402AEED7
Part of subcall function 00000001402AEE94: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000001402AEEFC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000001402AE024
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000001402AE273
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001402AE37F

Strings

csm, xrefs: 00000001402AE047
csm, xrefs: 00000001402ADFCD
csm, xrefs: 00000001402ADF66

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 53ba46935211f5bb2626f798b32362ec7b2ee2b9245032b631a617e438222d51
Instruction ID: 82d85fddde6d129d42f4bf4f3b2058e7b870944069e593be76e93710cec264b3
Opcode Fuzzy Hash: 53ba46935211f5bb2626f798b32362ec7b2ee2b9245032b631a617e438222d51
Instruction Fuzzy Hash: 50D18E326047408AEFA29F669448BED77A4F789788F100116EF8957BE6DFB4D4D2CB00

Function 00000001402B4930 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00000001402B4B14,?,?,00000000,00000001402B3A87,?,?,?,00000001402B0D85), ref: 00000001402B4AAC
GetProcAddress.KERNEL32(?,?,?,00000001402B4B14,?,?,00000000,00000001402B3A87,?,?,?,00000001402B0D85), ref: 00000001402B4AB8

Strings

ext-ms-, xrefs: 00000001402B4A09
api-ms-, xrefs: 00000001402B49F6

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 5d6a5311eb4bc1c95701d5d1e895e2b0fd73fdef6fdd7d0d0f7372516c60878a
Instruction ID: 06d522773d8a8ca9966846ec17400faa1ad987793dd7ec90bd03e2a83c5148b6
Opcode Fuzzy Hash: 5d6a5311eb4bc1c95701d5d1e895e2b0fd73fdef6fdd7d0d0f7372516c60878a
Instruction Fuzzy Hash: 7941EF32311E0055FA57DF17A868FE633A5BB4DBA0F494525DF1A877E4EBB8C8458304

Function 00000001402AD1A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000001402AD456,?,?,?,00000001402AD148,?,?,?,00000001402ACD51), ref: 00000001402AD229
GetLastError.KERNEL32(?,?,?,00000001402AD456,?,?,?,00000001402AD148,?,?,?,00000001402ACD51), ref: 00000001402AD237
LoadLibraryExW.KERNEL32(?,?,?,00000001402AD456,?,?,?,00000001402AD148,?,?,?,00000001402ACD51), ref: 00000001402AD261
FreeLibrary.KERNEL32(?,?,?,00000001402AD456,?,?,?,00000001402AD148,?,?,?,00000001402ACD51), ref: 00000001402AD2CF
GetProcAddress.KERNEL32(?,?,?,00000001402AD456,?,?,?,00000001402AD148,?,?,?,00000001402ACD51), ref: 00000001402AD2DB

Strings

api-ms-, xrefs: 00000001402AD249

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: e9c3f50ec1f98a7e9b1b681d67c19bc6bc9752d652689df3ffb4f6013840189f
Instruction ID: b63d76a067078693628ebc254d0fe4b49e9123f586089ee67f1a61bb1a305f04
Opcode Fuzzy Hash: e9c3f50ec1f98a7e9b1b681d67c19bc6bc9752d652689df3ffb4f6013840189f
Instruction Fuzzy Hash: 8C316F31212A4095FE539B57A808FA973A4BB4DBA0F490525DF2A0B7E5DFF8C484C710

Function 00000001402B1BD4 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001402B1BE3
FlsGetValue.KERNEL32 ref: 00000001402B1BF8
FlsSetValue.KERNEL32 ref: 00000001402B1C19
FlsSetValue.KERNEL32 ref: 00000001402B1C46
FlsSetValue.KERNEL32 ref: 00000001402B1C57
FlsSetValue.KERNEL32 ref: 00000001402B1C68
SetLastError.KERNEL32 ref: 00000001402B1C83

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a70fca26f3ff1ffc5a55be8c5e041165c6d3e87c69df41f6170837a29767432e
Instruction ID: b86a79f1a6aacf9c4149a11fb0b2c54f4f4af59a35e7c725aabdc827c6088df9
Opcode Fuzzy Hash: a70fca26f3ff1ffc5a55be8c5e041165c6d3e87c69df41f6170837a29767432e
Instruction Fuzzy Hash: BF219F30640E4046FA6B6F27559DFE9A2725F8C7B0F8407159B3617AFBEAB8D4418341

Function 00000001402B7F14 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001402B7F45
GetLastError.KERNEL32 ref: 00000001402B7F51
CloseHandle.KERNEL32 ref: 00000001402B7F69
CreateFileW.KERNEL32 ref: 00000001402B7F94
WriteConsoleW.KERNEL32 ref: 00000001402B7FB3

Strings

CONOUT$, xrefs: 00000001402B7F75

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 59020282af0195f56efa03fd2ec33a8f64bf3b3806e062863287542de83bc4c3
Instruction ID: 5d1e608fd77b7b2910ede1372bd08be6ab464e9527296ee1406915c86026e712
Opcode Fuzzy Hash: 59020282af0195f56efa03fd2ec33a8f64bf3b3806e062863287542de83bc4c3
Instruction Fuzzy Hash: 93114631614F4086E7529F57A848BA9B2B0B78CBE4F044224EB5A87BE4CFBCC9098744

Function 00000001402AB84B Relevance: 9.3, APIs: 6, Instructions: 259threadCOMMON

Download Yara Rule

APIs

CoGetCurrentLogicalThreadId.OLE32 ref: 00000001402AB8CB
CoGetPSClsid.OLE32 ref: 00000001402ABA77
IIDFromString.OLE32 ref: 00000001402ABC62
CoTreatAsClass.OLE32 ref: 00000001402ABB7B

Part of subcall function 00000001402ABF90: CoIsOle1Class.OLE32 ref: 00000001402ABF99

Part of subcall function 00000001402ABF50: CLSIDFromProgIDEx.OLE32 ref: 00000001402ABF6C

CoLockObjectExternal.OLE32 ref: 00000001402ABEF0
MonikerRelativePathTo.OLE32 ref: 00000001402ABDDA

Part of subcall function 00000001402AC010: CoGetCallContext.OLE32 ref: 00000001402AC03A

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ClassFrom$CallClsidContextCurrentExternalLockLogicalMonikerObjectOle1PathProgRelativeStringThreadTreat
String ID:
API String ID: 2790724248-0
Opcode ID: 9e723ffa1d0d076d79e1c5e55415b8ae45ace31598d3c28666bc8cd7fd53cc10
Instruction ID: 129da82e473dd3075e7a8703c3825d575e70e3cce9467bf59fede5eea76b9eb4
Opcode Fuzzy Hash: 9e723ffa1d0d076d79e1c5e55415b8ae45ace31598d3c28666bc8cd7fd53cc10
Instruction Fuzzy Hash: 4DE1B6762086D48AD775CF29F8906EAB7A1F7C8B45F044016EAC9C3B69DA3DD454DF00

Function 00000001402B1D4C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000001402B2519,?,?,?,?,00000001402B0EB8,?,?,?,?,00000001402AC0FC), ref: 00000001402B1D5B
FlsSetValue.KERNEL32(?,?,?,00000001402B2519,?,?,?,?,00000001402B0EB8,?,?,?,?,00000001402AC0FC), ref: 00000001402B1D91
FlsSetValue.KERNEL32(?,?,?,00000001402B2519,?,?,?,?,00000001402B0EB8,?,?,?,?,00000001402AC0FC), ref: 00000001402B1DBE
FlsSetValue.KERNEL32(?,?,?,00000001402B2519,?,?,?,?,00000001402B0EB8,?,?,?,?,00000001402AC0FC), ref: 00000001402B1DCF
FlsSetValue.KERNEL32(?,?,?,00000001402B2519,?,?,?,?,00000001402B0EB8,?,?,?,?,00000001402AC0FC), ref: 00000001402B1DE0
SetLastError.KERNEL32(?,?,?,00000001402B2519,?,?,?,?,00000001402B0EB8,?,?,?,?,00000001402AC0FC), ref: 00000001402B1DFB

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c03ad0e9a7b733168ec2961516d68cdbe639793b0b399b3b9eeecdd25207eff4
Instruction ID: 0080a9497d16bcc9fe18a3875e0d67d3ae284b14e83a5c6cf68b654368fd94c1
Opcode Fuzzy Hash: c03ad0e9a7b733168ec2961516d68cdbe639793b0b399b3b9eeecdd25207eff4
Instruction Fuzzy Hash: 3A116D30700E4142FA6A6F6755ADFE9A2765F8C7B4F844724AB36177FAEEB8D4018340

Function 00000001402B0DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000001402B0DC5
GetProcAddress.KERNEL32 ref: 00000001402B0DDB
FreeLibrary.KERNEL32 ref: 00000001402B0E02

Strings

CorExitProcess, xrefs: 00000001402B0DD4
mscoree.dll, xrefs: 00000001402B0DBC

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e55bd0b1403aa2014f467cd01813cc845d5c2c56ced8563d805b4115a3cf5df4
Instruction ID: add9246c5e9ede50f4bf8aa1e29a6c9535212e6fcf2bea2237dcd7864fc0db9c
Opcode Fuzzy Hash: e55bd0b1403aa2014f467cd01813cc845d5c2c56ced8563d805b4115a3cf5df4
Instruction Fuzzy Hash: 48F06D71314E0592FB128F66E88DBAA7370EB8D7A1F9806158B6A452F4DFBCC089C300

Function 00000001402ABA10 Relevance: 7.7, APIs: 5, Instructions: 209COMMON

Download Yara Rule

APIs

CoGetPSClsid.OLE32 ref: 00000001402ABA77
CoTreatAsClass.OLE32 ref: 00000001402ABB7B

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ClassClsidTreat
String ID:
API String ID: 1148556228-0
Opcode ID: 75d63db680d2b9a16afb577865a4eb3da8d832d55886949f4a7a4e6320b6c736
Instruction ID: 32e909c1382f93d16e67e44568d2f9aef9a5eeaa51fffa28eb5c5f75dc019e5d
Opcode Fuzzy Hash: 75d63db680d2b9a16afb577865a4eb3da8d832d55886949f4a7a4e6320b6c736
Instruction Fuzzy Hash: D9B1B5762086D48AD776CF29F890AEAB7A1F7C8745F048016EAC9C3B69DA3DD454CF04

Function 00000001402B8264 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001402B828C
_set_statfp.LIBCMT ref: 00000001402B82A7
_set_statfp.LIBCMT ref: 00000001402B82C3
_set_statfp.LIBCMT ref: 00000001402B82FF

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b80ed0dcba908c0d23072d7c689e1cccf0bae32d795691e632377f55b12a9daf
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F011C233A10E9047FA56196AE45EBFA11A06B5D378F480635EF7E163F7DAF88840C209

Function 00000001402B1E14 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000001402B1F7B,?,?,00000000,00000001402B2216,?,?,?,?,?,00000001402B21A2), ref: 00000001402B1E33
FlsSetValue.KERNEL32(?,?,?,00000001402B1F7B,?,?,00000000,00000001402B2216,?,?,?,?,?,00000001402B21A2), ref: 00000001402B1E52
FlsSetValue.KERNEL32(?,?,?,00000001402B1F7B,?,?,00000000,00000001402B2216,?,?,?,?,?,00000001402B21A2), ref: 00000001402B1E7A
FlsSetValue.KERNEL32(?,?,?,00000001402B1F7B,?,?,00000000,00000001402B2216,?,?,?,?,?,00000001402B21A2), ref: 00000001402B1E8B
FlsSetValue.KERNEL32(?,?,?,00000001402B1F7B,?,?,00000000,00000001402B2216,?,?,?,?,?,00000001402B21A2), ref: 00000001402B1E9C

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 898527402b68eac5eba767d064792ed4a7aab93ace82e8ef198652dc0915b7c1
Instruction ID: 4de571638f706919ae6df25c6cfd96c35e49882626082051ae5f3ce0676307ee
Opcode Fuzzy Hash: 898527402b68eac5eba767d064792ed4a7aab93ace82e8ef198652dc0915b7c1
Instruction Fuzzy Hash: BD115130700E4041FA5A5F67559EFE9A1A25F8C3B0F9447246B39177FAEEB8D8028340

Function 00000001402B1CA8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00000001402B1CB9
FlsSetValue.KERNEL32 ref: 00000001402B1CD8
FlsSetValue.KERNEL32 ref: 00000001402B1D00
FlsSetValue.KERNEL32 ref: 00000001402B1D11
FlsSetValue.KERNEL32 ref: 00000001402B1D22

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 529461bfbc01e1e61aa39a4dc4aba4134dc8f89f54d25a08f6b99f85dc5ce63e
Instruction ID: 33bcb0b588fee5aa3df39017ac49c15cd0a577b8baf74d9793db043eb8b25273
Opcode Fuzzy Hash: 529461bfbc01e1e61aa39a4dc4aba4134dc8f89f54d25a08f6b99f85dc5ce63e
Instruction Fuzzy Hash: 75111E30600E0645F96FAF77546EFE951724F8D374F9807245B361A2FBEAB8D8428351

Function 00000001402AE3C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000001402AE41F
_CallSETranslator.LIBVCRUNTIME ref: 00000001402AE46B

Strings

RCC, xrefs: 00000001402AE43B
MOC, xrefs: 00000001402AE433

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: edbae846c16a31a88edb43714467db7abe634e46478ac1c1383c172d6a8dd652
Instruction ID: 3adc480d23967df44db561f9c056a6374caac20ecc543d29073b36b63c61db7d
Opcode Fuzzy Hash: edbae846c16a31a88edb43714467db7abe634e46478ac1c1383c172d6a8dd652
Instruction Fuzzy Hash: 0761AF32504BC485EB729F16E444BDAB7A4F798B88F044215EB9943BA9DFB8C1D1CF00

Function 00000001402AE770 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001402AE798
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000001402AE880

Strings

csm, xrefs: 00000001402AE7BA
csm, xrefs: 00000001402AE8D2

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 152d4bd7917869bd52f2caa6e71b97cace402a0d297fb2f9916aea461b0fb961
Instruction ID: ebb6f32fa9368eb824865e4ca584f9252a2abe74f33584830eec0ab777c4956f
Opcode Fuzzy Hash: 152d4bd7917869bd52f2caa6e71b97cace402a0d297fb2f9916aea461b0fb961
Instruction Fuzzy Hash: 58516A321043818AEFB68F279448B99B7A0F798B94F184116DB9947BF5CFB8D492CF01

Function 00000001402B06C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001402B06F6

Part of subcall function 00000001402B25A8: HeapFree.KERNEL32(?,?,?,00000001402B41E2,?,?,?,00000001402B421F,?,?,00000000,00000001402B4779,?,?,?,00000001402B46AB), ref: 00000001402B25BE
Part of subcall function 00000001402B25A8: GetLastError.KERNEL32(?,?,?,00000001402B41E2,?,?,?,00000001402B421F,?,?,00000000,00000001402B4779,?,?,?,00000001402B46AB), ref: 00000001402B25C8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00000001402AC135), ref: 00000001402B0714

Strings

C:\Users\user\Desktop\GIYUCke96G.exe, xrefs: 00000001402B0702
&#\, xrefs: 00000001402B071A

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: &#\$C:\Users\user\Desktop\GIYUCke96G.exe
API String ID: 3580290477-673798171
Opcode ID: 1f182a73aac2f63ee901aeb77ae39cd8f7c5f534c323df601954f97e71ed5bc6
Instruction ID: 731d5fcc0904e1efb9e29ed5133549a2c8bcba74a995fe2bbd9c4cfb65c02b1d
Opcode Fuzzy Hash: 1f182a73aac2f63ee901aeb77ae39cd8f7c5f534c323df601954f97e71ed5bc6
Instruction Fuzzy Hash: 9E415A36200F1086EB5BDF269499BD867B4FB49784F544025EF4A47BE5DEB4C886C340

Function 00000001402B64CC Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000001402B654B
WriteFile.KERNEL32 ref: 00000001402B6813
WriteFile.KERNEL32 ref: 00000001402B6859
GetLastError.KERNEL32 ref: 00000001402B690F

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3e55d197cb4fd040717d7d18928ff8f083d1fdba854d7873bf9f6328faa62473
Instruction ID: 8a4ca609e0459c841ebcfda85ff955622ac0de25bdc95d7efa7edcb538ba1ec2
Opcode Fuzzy Hash: 3e55d197cb4fd040717d7d18928ff8f083d1fdba854d7873bf9f6328faa62473
Instruction Fuzzy Hash: F7D1C072B14A8089EB12CF7AD448BEC37B2F348798F544216DF5997BE9DA78C656C300

Function 00000001402B6DF4 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000001402B6DDF,00000000), ref: 00000001402B6F10
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000001402B6DDF,00000000), ref: 00000001402B6F9B

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 9eac54bd6c75c4ebe736856536f372676b4d86a5fcdbfb547ee41adf422539b4
Instruction ID: afa4170ec0e156098d3d032a1e4e5eebcc79cd74d045bb7713ee4ed03bbbe6a1
Opcode Fuzzy Hash: 9eac54bd6c75c4ebe736856536f372676b4d86a5fcdbfb547ee41adf422539b4
Instruction Fuzzy Hash: 4991B072A10E5089FB62DF76944CFED2BB0B748B88F54450ADF0A67AE5DBB8C546C700

Function 00000001402ACB30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001402ACB5B
RtlUnwindEx.KERNEL32 ref: 00000001402ACC4C

Strings

csm, xrefs: 00000001402ACBD9

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: Unwind__except_validate_context_record
String ID: csm
API String ID: 2208346422-1018135373
Opcode ID: 02e68a7d6bb79483a0bbcb538f19e95ff16182eddf9f76867ba183ede814b7c6
Instruction ID: 9033415f59a6bcbf5142e4a7ac6e387891085fea44cfb2b43f7779141293c78b
Opcode Fuzzy Hash: 02e68a7d6bb79483a0bbcb538f19e95ff16182eddf9f76867ba183ede814b7c6
Instruction Fuzzy Hash: 395197313216048ADB56CF16D448FAC7792F78CBA8F214126DB59477E8DFB9C881CB40

Function 00000001402B6B64 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000001402B6C7B
GetLastError.KERNEL32 ref: 00000001402B6C9D

Strings

U, xrefs: 00000001402B6C27

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: d98ccc516a040d0fbb63b4cb3d17f57cbb66125e9d0163cf1dc3dc5065568bda
Instruction ID: 2a36691b13364a63a1313190ee8f24a34a05acf339daa4aacc758e743ed2f374
Opcode Fuzzy Hash: d98ccc516a040d0fbb63b4cb3d17f57cbb66125e9d0163cf1dc3dc5065568bda
Instruction Fuzzy Hash: 35419F72615A4096EB618F26E84C7EA67B1F798784F804022EF8D877A8EB7CC541CB40

Function 00000001402AF218 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001402AF268
RaiseException.KERNEL32 ref: 00000001402AF2A9

Strings

csm, xrefs: 00000001402AF296

Memory Dump Source

Source File: 00000000.00000002.2219093308.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.2219074004.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219337706.00000001402BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219371480.00000001402CD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219394102.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2219415648.00000001402E1000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_GIYUCke96G.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4fc5bd0555118f10ac28622562c5a9382fbcb77a1f611ff60af8d35965ad6150
Instruction ID: 4d6c75e4a0dae62cc35f78e48ce22abc3b9a7a6f2557e454d25e43e1e41479b6
Opcode Fuzzy Hash: 4fc5bd0555118f10ac28622562c5a9382fbcb77a1f611ff60af8d35965ad6150
Instruction Fuzzy Hash: 9C112B36214B8082EBA28F16E444799B7E4F78CB84F584220EF8D077A8DF7CC5518B00

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	5.506337696486408
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GIYUCke96G.exe
File size:	2'983'936 bytes
MD5:	63ba5ec400ebbe6af65441f442652faa
SHA1:	3b8807f8124c0e0d8c8cd816f9a7bc30476fbf5c
SHA256:	bc00fef073d78e021e5273735cd8a75b55261a7564a01af944ed35f4513aadf9
SHA512:	e240e9e07d88908057bba587e32ef1499d0c2d235eed61f1e996ce8959e1c323068ad483a96a7010ea0050440e12a0d82782e79baa186e880e4727452f3a4baf
SSDEEP:	49152:2mVZpRE5HFjH4MLMmcX17+kSmn75+dEsgY5OK:fgvFcXV3cJ5
TLSH:	4CD564092A3E0A95E0519CF0A23B4552A9BD7D1CC01C66F9CFD49B457F9AF50A0FA3EC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............n...n...n...m...n...k...n...j...n.Gek...n.Gej...n.Gem...n...o...n...o...n..em...n...n...n.vfk...n.vf....n.vfl...n.Rich..n

Entrypoint:	0x1402ac338
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x663BBDCA [Wed May 8 18:00:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	05f2715d0397538255a9df69b1b5b827

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2cbc7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e3000	0x628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2e1000	0xffc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2ca600	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ca4c0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2ba000	0x370	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b8d10	0x2b8e00	a04fa86212fb20790f5541270260e5d2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2ba000	0x1283c	0x12a00	bedf5cc00eb85189c09aa8e63533827d	False	0.688863255033557	data	6.694651511423994	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2cd000	0x13098	0xb200	869ad6d69795428d7887f676a87fb57f	False	0.9097392907303371	data	7.555905753084373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2e1000	0xffc	0x1000	af9df1cd9b1dc42a0358078c4a79b40c	False	0.490478515625	data	5.411108677102532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x2e2000	0x1f4	0x200	5ac9d95ea0733dc97f6055d8be2e8295	False	0.5078125	data	4.198538142721472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2e3000	0x628	0x800	c9b6fe748d633493bb092a6791cac656	False	0.357421875	data	3.260315682123659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2e3200	0x428	data	English	United States	0.4718045112781955
RT_MANIFEST	0x2e30a0	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GIYUCke96G.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GIYUCke96G.exe_4f8fc75c7ae03519ba32df973fcbeda86d1ecbbb_135d818b_9064d5b3-0f98-489e-9c5d-f62a688a6a9c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD900.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBFF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCBB.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: GIYUCke96G.exePID: 2724, Parent PID: 1028

Windows Analysis Report
GIYUCke96G.exe

Function 0000000140008E2E Relevance: 27.5, Strings: 6, Instructions: 20001
threadCOMMON

Function 00000001400041A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21
libraryloaderCOMMON

Function 00000001402AC202 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71
COMMON

Function 00000001402B3B90 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00000001402B2530 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Function 00000001402AC388 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Function 0000000140008ED6 Relevance: 26.3, Strings: 5, Instructions: 20001
COMMON

Function 00000001402AC6B4 Relevance: 10.6, APIs: 7, Instructions: 71
COMMON

Function 00000001400040D0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 35
libraryloaderCOMMON

Function 00000001402ADEF0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312
COMMON

Function 00000001402B4930 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Function 00000001402AD1A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE