Edit tour

Windows Analysis Report
aleluia.exe.dll

Overview

General Information

Sample name:	aleluia.exe.dll
Analysis ID:	1466512
MD5:	7bf76a49be5da88a7a4d0654600cbc24
SHA1:	9d34f934ce69263f4b42b016201dbf28ae319325
SHA256:	616dd1b3695b4264f39b9d3db59c0d1df808fa3f953996b83a983df2248d358a
Tags:	dlllatamrat
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Sigma detected: Windows Binaries Write Suspicious Extensions

Abnormal high CPU Usage

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 1472 cmdline: loaddll32.exe "C:\Users\user\Desktop\aleluia.exe.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 4480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4616 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 2412 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5044 cmdline: rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyErr_Print MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4028 cmdline: rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyImport_Import MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2408 cmdline: rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyMem_Malloc MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1628 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyErr_Print MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7060 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyImport_Import MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1576 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyMem_Malloc MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3292 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",_Py_Dealloc MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1288 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetProgramName MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3716 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetPath MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2072 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_NoSiteFlag MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2284 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IsInitialized MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2764 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Initialize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3424 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IgnoreEnvironmentFlag MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7180 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FrozenFlag MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7232 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Finalize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7264 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FatalError MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7280 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyUnicode_FromString MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7288 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PySys_SetArgv MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7296 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_GetAttrString MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7304 cmdline: rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_CallObject MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Sigma Signatures

System Summary

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 5044, TargetFilename: C:\Users\user\Favorites\p1.ps1

HTTP traffic detected: GET /GOL/index.php?VS=V1.0&PL=NAO HTTP/1.1User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36"Host: 20.0.152.185Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: amxx1515cabreun23.asxo

Source: rundll32.exe, 00000005.00000002.4494175843.0000000004676000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.0.152.185
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.0.152.185/GOL/index.php
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.0.152.185/GOL/index.php?VS=V1.0&PL=NAO
Source: rundll32.exe, 00000005.00000002.4494175843.000000000466A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rundll32.exe, rundll32.exe, 0000000B.00000002.2162380317.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2161279575.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2159704101.00000000072C6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2154982099.0000000006AB6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2159135898.0000000006906000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2161205053.00000000071F6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2161623649.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2156602066.0000000006E96000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2161729578.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2160469310.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2160403127.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2151375619.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2162514523.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2160979498.0000000007316000.00000020.00000001.01000000.00000003.sdmp, aleluia.exe.dll	String found in binary or memory: http://stackoverflow.com/q/11564914;
Source: rundll32.exe, 00000004.00000002.2037144816.00000000073C6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4495576889.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2065543167.0000000007146000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2094735840.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.2160151197.0000000006F26000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000002.2155991941.00000000067F6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.2157909805.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.2162380317.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2161279575.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2159704101.00000000072C6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2154982099.0000000006AB6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2159135898.0000000006906000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2161205053.00000000071F6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2161623649.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2156602066.0000000006E96000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2161729578.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2160469310.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2160403127.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2151375619.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2162514523.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2160979498.0000000007316000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://stackoverflow.com/q/2152978/23354
Source: rundll32.exe, 00000005.00000002.4494175843.0000000004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amxx1515cabreun23.asxo
Source: rundll32.exe, 00000005.00000002.4494175843.0000000004680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amxx1515cabreun23.asxo/

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CE0C90	4_2_04CE0C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CE3120	4_2_04CE3120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CE30C1	4_2_04CE30C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CE0C53	4_2_04CE0C53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04100C90	5_2_04100C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0410B460	5_2_0410B460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04103130	5_2_04103130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04100C6A	5_2_04100C6A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_041030D0	5_2_041030D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067B6350	5_2_067B6350
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067B4850	5_2_067B4850
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067BC768	5_2_067BC768
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067B62B8	5_2_067B62B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067B6309	5_2_067B6309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067BEED8	5_2_067BEED8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067B4848	5_2_067B4848
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_07724A30	5_2_07724A30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_077236B8	5_2_077236B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_077229B7	5_2_077229B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03013120	6_2_03013120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03010C90	6_2_03010C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03013107	6_2_03013107
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03010841	6_2_03010841
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_03010C52	6_2_03010C52
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_030130C1	6_2_030130C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04D20C90	7_2_04D20C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04D23110	7_2_04D23110
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04D230B1	7_2_04D230B1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04D20C52	7_2_04D20C52
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_047E0C90	8_2_047E0C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_047E3130	8_2_047E3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_047E0C53	8_2_047E0C53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_047E30FF	8_2_047E30FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_047E30D0	8_2_047E30D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B0C90	9_2_006B0C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B3120	9_2_006B3120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B0841	9_2_006B0841
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_006B0BC1	9_2_006B0BC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00940C90	10_2_00940C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00943110	10_2_00943110
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_009430B1	10_2_009430B1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00940C27	10_2_00940C27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00940C58	10_2_00940C58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00940841	10_2_00940841
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00940C4A	10_2_00940C4A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_03743110	11_2_03743110
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_03740C90	11_2_03740C90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_03740C52	11_2_03740C52
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_037430B1	11_2_037430B1

Source: aleluia.exe.dll

Binary or memory string: OriginalFilenamelibpython3.8.dll4 vs aleluia.exe.dll

Source: aleluia.exe.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal64.evad.winDLL@46/1@1/1

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\n+LIJyYmA0uvilTY7MABDoMqXaw/bmQpzXeE3pIGgFLsJzOnIP2zcZ608F1F6NbT
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4480:120:WilError_03

Source: aleluia.exe.dll	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: aleluia.exe.dll	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: aleluia.exe.dll

Static file information: TRID: Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 44.54%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1

Source: aleluia.exe.dll

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\aleluia.exe.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyErr_Print
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyImport_Import
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyMem_Malloc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyErr_Print
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyImport_Import
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyMem_Malloc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",_Py_Dealloc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetProgramName
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetPath
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_NoSiteFlag
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IsInitialized
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Initialize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IgnoreEnvironmentFlag
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FrozenFlag
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Finalize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FatalError
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyUnicode_FromString
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PySys_SetArgv
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_GetAttrString
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_CallObject
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyErr_Print	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyImport_Import	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyMem_Malloc	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyErr_Print	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyImport_Import	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyMem_Malloc	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",_Py_Dealloc	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetProgramName	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetPath	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_NoSiteFlag	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IsInitialized	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Initialize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IgnoreEnvironmentFlag	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FrozenFlag	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Finalize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FatalError	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyUnicode_FromString	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PySys_SetArgv	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_GetAttrString	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_CallObject	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: aleluia.exe.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: aleluia.exe.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: aleluia.exe.dll

Static file information: File size 1662464 > 1048576

Source: aleluia.exe.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x156e00

Source: aleluia.exe.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_073C6113 push ebx; ret	4_2_073C6116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_073C610C pushfd ; ret	4_2_073C610D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_073C91A9 push FFFFFFB8h; ret	4_2_073C91AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_073CB8A5 push ebx; ret	4_2_073CB8B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB4B8A5 push ebx; ret	4_2_6CB4B8B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB491A9 push FFFFFFB8h; ret	4_2_6CB491AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB46113 push ebx; ret	4_2_6CB46116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6CB4610C pushfd ; ret	4_2_6CB4610D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0690B8A5 push ebx; ret	5_2_0690B8B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_069091A9 push FFFFFFB8h; ret	5_2_069091AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_06906113 push ebx; ret	5_2_06906116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0690610C pushfd ; ret	5_2_0690610D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CB4B8A5 push ebx; ret	5_2_6CB4B8B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CB491A9 push FFFFFFB8h; ret	5_2_6CB491AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CB46113 push ebx; ret	5_2_6CB46116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6CB4610C pushfd ; ret	5_2_6CB4610D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_067B62B8 push es; iretd	5_2_067B62C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_07723FF0 pushad ; retf	5_2_07723FF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_07722430 pushad ; retf	5_2_07722449
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_07146113 push ebx; ret	6_2_07146116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0714610C pushfd ; ret	6_2_0714610D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_071491A9 push FFFFFFB8h; ret	6_2_071491AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_0714B8A5 push ebx; ret	6_2_0714B8B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6CB4B8A5 push ebx; ret	6_2_6CB4B8B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6CB491A9 push FFFFFFB8h; ret	6_2_6CB491AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6CB46113 push ebx; ret	6_2_6CB46116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_6CB4610C pushfd ; ret	6_2_6CB4610D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_075A6113 push ebx; ret	7_2_075A6116
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_075A610C pushfd ; ret	7_2_075A610D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_075A91A9 push FFFFFFB8h; ret	7_2_075A91AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_075AB8A5 push ebx; ret	7_2_075AB8B4

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1359			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 8498			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe TID: 1632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3288	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3288	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3288	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3992	Thread sleep count: 1359 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3288	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3288	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3992	Thread sleep count: 8498 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2764	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7208	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7252	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7376	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7420	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7400	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7436	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7432	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7412	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7404	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477

Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Server
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Windows Essential Server Solutions without Hyper-V
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Enterprise Server without Hyper-V
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q3Standard Server without Hyper-V (core installation)@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\]q5Enterprise Server without Hyper-V (core installation)
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q5Datacenter Server without Hyper-V (core installation)@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q5Enterprise Server without Hyper-V (core installation)@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Standard Server without Hyper-V (core installation)
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Server@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\]q5Datacenter Server without Hyper-V (core installation)
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HPC Edition without Hyper-V
Source: rundll32.exe, 00000005.00000002.4492300698.0000000000675000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2147647958.0000000000675000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q!Enterprise Server without Hyper-V@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\]q!Enterprise Server without Hyper-V
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\]q3Standard Server without Hyper-V (core installation)
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Enterprise Server without Hyper-V (core installation)
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Standard Server without Hyper-V@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q!Datacenter Server without Hyper-V@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HPC Edition without Hyper-V@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Datacenter Server without Hyper-V
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Standard Server without Hyper-V
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\]q!Datacenter Server without Hyper-V
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\]q2Windows Essential Server Solutions without Hyper-V
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q2Windows Essential Server Solutions without Hyper-V@\]q
Source: rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Datacenter Server without Hyper-V (core installation)

Source: C:\Windows\SysWOW64\rundll32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 20.0.152.185 80

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1

Jump to behavior

Source: rundll32.exe, 00000005.00000002.4494175843.0000000004693000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4494175843.00000000047F8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\Desktop\aleluia.exe.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	112 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aleluia.exe.dll	13%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://20.0.152.185/GOL/index.php?VS=V1.0&PL=NAO	0%	Avira URL Cloud	safe
http://20.0.152.185/GOL/index.php	0%	Avira URL Cloud	safe
http://stackoverflow.com/q/2152978/23354	0%	Avira URL Cloud	safe
https://amxx1515cabreun23.asxo	0%	Avira URL Cloud	safe
https://amxx1515cabreun23.asxo/	0%	Avira URL Cloud	safe
http://20.0.152.185	0%	Avira URL Cloud	safe
http://stackoverflow.com/q/11564914;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
amxx1515cabreun23.asxo	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://20.0.152.185/GOL/index.php?VS=V1.0&PL=NAO	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://stackoverflow.com/q/11564914;	rundll32.exe, rundll32.exe, 0000000B.00000002.2162380317.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2161279575.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2159704101.00000000072C6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2154982099.0000000006AB6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2159135898.0000000006906000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2161205053.00000000071F6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2161623649.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2156602066.0000000006E96000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2161729578.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2160469310.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2160403127.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2151375619.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2162514523.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2160979498.0000000007316000.00000020.00000001.01000000.00000003.sdmp, aleluia.exe.dll	false	Avira URL Cloud: safe	unknown
http://20.0.152.185	rundll32.exe, 00000005.00000002.4494175843.0000000004676000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amxx1515cabreun23.asxo/	rundll32.exe, 00000005.00000002.4494175843.0000000004680000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amxx1515cabreun23.asxo	rundll32.exe, 00000005.00000002.4494175843.0000000004680000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://20.0.152.185/GOL/index.php	rundll32.exe, 00000005.00000002.4494175843.00000000043E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rundll32.exe, 00000005.00000002.4494175843.000000000466A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://stackoverflow.com/q/2152978/23354	rundll32.exe, 00000004.00000002.2037144816.00000000073C6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4495576889.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2065543167.0000000007146000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2094735840.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.2160151197.0000000006F26000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000002.2155991941.00000000067F6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.2157909805.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.2162380317.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2161279575.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2159704101.00000000072C6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2154982099.0000000006AB6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2159135898.0000000006906000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2161205053.00000000071F6000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2161623649.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2156602066.0000000006E96000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2161729578.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2160469310.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2160403127.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2151375619.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2162514523.000000006CB46000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2160979498.0000000007316000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
20.0.152.185	unknown	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466512
Start date and time:	2024-07-03 00:52:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aleluia.exe.dll
Detection:	MAL
Classification:	mal64.evad.winDLL@46/1@1/1
EGA Information:	Successful, ratio: 12.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 221 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 1576 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 1628 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 2408 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 2412 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 3292 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 4028 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 7060 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: aleluia.exe.dll

Simulations

Behavior and APIs

Time	Type	Description
18:53:03	API Interceptor	12800859x Sleep call for process: rundll32.exe modified
18:53:04	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://pub-1b634168cd404e2d8bece63d5ebb4798.r2.dev/uint.html?schweissdoors	Get hash	malicious	HTMLPhisher	Browse	20.76.252.24
	https://pub-9445ce0d74714d1c934c51ffcf83c3f2.r2.dev/slnt.html?nycsbs	Get hash	malicious	HTMLPhisher	Browse	20.76.252.24
	https://pub-fb608504b57048a1b1ca54c74dbf132d.r2.dev/rint.html?odwyerrealty	Get hash	malicious	HTMLPhisher	Browse	20.76.252.24
	https://pub-fb608504b57048a1b1ca54c74dbf132d.r2.dev/ront.html?ccsend	Get hash	malicious	HTMLPhisher	Browse	20.76.252.24
	http://bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://adminctpest-my.sharepoint.com/:o:/g/personal/betsy_demaio_ctpest_com/EnuH5GTI06tDnL4MKQfIJnUBl8HR6pXTwof138zpiDJjSg?e=5%3aZ14Hf4&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	The Siedenburg Group #24-051-553861 Project.pdf	Get hash	malicious	Unknown	Browse	52.146.76.30
	https://forms.office.com/Pages/ResponsePage.aspx?id=kZA3HqH2gEqpwIcJGXLNuDBzT6g5ZNhMmL9jEsYwErtUMzhHMkkxTzRBOUVVUEhRNFZQS1JVNFNLOS4u	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://texadasoftware.com	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://azotictechnologies953-my.sharepoint.com/:o:/g/personal/marilyn_hall_azotictechnologies_com/Eg8tk_4KvvpMk4ZCAagCmggBx_QeawKvcBXzwvKltGQxKw?e=5%3adBgRX2&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.361827289088002
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLUE4K5E4KH1qE4j
MD5:	64A2247B3C640AB3571D192DF2079FCF
SHA1:	A17AFDABC1A16A20A733D1FDC5DA116657AAB561
SHA-256:	87239BAD85A89EB90322C658DFD589B40229E57F05B181357FF834FCBABCB7E2
SHA-512:	CF71FE05075C7CAE036BD1B7192B8571C6F97A32209293B54FAEC79BAE0B6C3369946B277CE2E1F0BF455BF60FA0E8BB890E7E9AAE9137C79AB44C9C3D406D35
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.923247530533211
TrID:	Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 44.54% Win32 Dynamic Link Library (generic) (1002004/3) 44.12% Generic .NET DLL/Assembly (238134/4) 10.49% Windows Screen Saver (13104/52) 0.58% Win16/32 Executable Delphi generic (2074/23) 0.09%
File name:	aleluia.exe.dll
File size:	1'662'464 bytes
MD5:	7bf76a49be5da88a7a4d0654600cbc24
SHA1:	9d34f934ce69263f4b42b016201dbf28ae319325
SHA256:	616dd1b3695b4264f39b9d3db59c0d1df808fa3f953996b83a983df2248d358a
SHA512:	981af2e0058f2363dd435ab98a4ffb513d1a5d5863cec642aa8541883129b12abdc571e6fbdf95ada934e786b794fd0b08d3260e44e59af666843b19d79f56f1
SSDEEP:	12288:vk0wTKsZNzre0LbTMFh/tu1uCQ6nmLAV5+OaqHsCt7sczbDUdoj/XZSN9o3QhVYz:sSc341+pDVnDt7sijqYpEsk
TLSH:	7B7552782D990037D37EDE768BF62587B5F9A4E33949992750C203050B23A63B9827FD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D.f...........!.....H..........~.... ........... ....................................@.........................D...(..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1003f97e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x668244C3 [Mon Jul 1 05:55:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	dae02f32a21e03ce65412f6e56942daa

Entrypoint Preview

Instruction
jmp dword ptr [10002000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x40044	0x28	.sdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f92c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19e000	0x450	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x2c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x46000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3d984	0x3da00	35c6eccae7d70713c4932fe59c90c2db	False	0.0053641607505071	data	0.07720165491557254	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x40000	0x236	0x400	59af08b08372cdb32e0127b0d257c8a0	False	0.3583984375	data	3.5097630610938633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x42000	0x450	0x600	aff70e94e48f6a5cfb23a71f900aff04	False	0.2708333333333333	data	2.524304244097441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x44000	0x2c	0x200	2205a8c016908150f4d43598e6058c62	False	0.11328125	data	0.639517052955896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.text	0x46000	0x156de4	0x156e00	552eaf70aa37e5388b4a238c2be06d40	False	0.4336307760663507	data	5.559944700853393	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x19e000	0x450	0x600	aa4de713e0ac66bc73f18bdc07a0659c	False	0.2727864583333333	data	2.527956353781319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x19e058	0x3f4	data			0.37648221343873517

Imports

DLL	Import
mscoree.dll	_CorDllMain

Exports

Name	Ordinal	Address
PyErr_Print	0	0x1003f81e
PyImport_Import	1	0x1003f82e
PyMem_Malloc	2	0x1003f83e
PyObject_CallObject	3	0x1003f84e
PyObject_GetAttrString	4	0x1003f85e
PySys_SetArgv	5	0x1003f86e
PyUnicode_FromString	6	0x1003f87e
Py_FatalError	7	0x1003f88e
Py_Finalize	8	0x1003f89e
Py_FrozenFlag	9	0x1003f8ae
Py_IgnoreEnvironmentFlag	10	0x1003f8be
Py_Initialize	11	0x1003f8ce
Py_IsInitialized	12	0x1003f8de
Py_NoSiteFlag	13	0x1003f8ee
Py_SetPath	14	0x1003f8fe
Py_SetProgramName	15	0x1003f90e
_Py_Dealloc	16	0x1003f91e

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 00:53:03.306417942 CEST	49704	80	192.168.2.5	20.0.152.185
Jul 3, 2024 00:53:03.316951036 CEST	80	49704	20.0.152.185	192.168.2.5
Jul 3, 2024 00:53:03.317096949 CEST	49704	80	192.168.2.5	20.0.152.185
Jul 3, 2024 00:53:03.317502975 CEST	49704	80	192.168.2.5	20.0.152.185
Jul 3, 2024 00:53:03.322357893 CEST	80	49704	20.0.152.185	192.168.2.5
Jul 3, 2024 00:53:03.957606077 CEST	80	49704	20.0.152.185	192.168.2.5
Jul 3, 2024 00:53:04.006082058 CEST	49704	80	192.168.2.5	20.0.152.185
Jul 3, 2024 00:53:06.329925060 CEST	49704	80	192.168.2.5	20.0.152.185
Jul 3, 2024 00:53:06.335241079 CEST	80	49704	20.0.152.185	192.168.2.5
Jul 3, 2024 00:53:06.335514069 CEST	49704	80	192.168.2.5	20.0.152.185

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 00:53:04.219389915 CEST	61223	53	192.168.2.5	1.1.1.1
Jul 3, 2024 00:53:04.234903097 CEST	53	61223	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 00:53:04.219389915 CEST	192.168.2.5	1.1.1.1	0x4c18	Standard query (0)	amxx1515cabreun23.asxo	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 00:53:04.234903097 CEST	1.1.1.1	192.168.2.5	0x4c18	Name error (3)	amxx1515cabreun23.asxo	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

20.0.152.185

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	20.0.152.185	80	5044	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 00:53:03.317502975 CEST	192	OUT	GET /GOL/index.php?VS=V1.0&PL=NAO HTTP/1.1 User-Agent: "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36" Host: 20.0.152.185 Connection: Keep-Alive
Jul 3, 2024 00:53:03.957606077 CEST	257	IN	HTTP/1.1 302 Found Date: Tue, 02 Jul 2024 22:53:03 GMT Server: Apache/2.4.52 (Ubuntu) Location: https://amxx1515cabreun23.asxo/ Content-Length: 8 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 65 77 20 59 6f 72 6b Data Ascii: New York

Target ID:	0
Start time:	18:52:53
Start date:	02/07/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\aleluia.exe.dll"
Imagebase:	0xcb0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:52:53
Start date:	02/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:52:54
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:52:54
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",#1
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:52:54
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyErr_Print
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:52:57
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyImport_Import
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:53:00
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\aleluia.exe.dll,PyMem_Malloc
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyErr_Print
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyImport_Import
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyMem_Malloc
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",_Py_Dealloc
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetProgramName
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_SetPath
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_NoSiteFlag
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IsInitialized
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Initialize
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_IgnoreEnvironmentFlag
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:53:03
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FrozenFlag
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:53:04
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_Finalize
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:53:04
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",Py_FatalError
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:53:04
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyUnicode_FromString
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:53:04
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PySys_SetArgv
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:53:04
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_GetAttrString
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:53:04
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aleluia.exe.dll",PyObject_CallObject
Imagebase:	0xb60000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04CE30C1 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

#$y, xrefs: 04CE32F7

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 7210ac584602b996137191854f21539b56952eda36f5df9cd8f232b5f095a3ef
Instruction ID: a4da27596d37b3ba5a3a91f15a783f29bebe528bd214de48d928edd2d1b14c62
Opcode Fuzzy Hash: 7210ac584602b996137191854f21539b56952eda36f5df9cd8f232b5f095a3ef
Instruction Fuzzy Hash: E8910636B141058FC708CA7AD992669BFA3ABD4244B59C42AD806DB7B4EE34FC03CB41

Function 04CE3120 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#$y, xrefs: 04CE32F7

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 406ac9f93907a8b69a8abc3e757f6c4a78ea819a4e3bbdf03341b004573614c1
Instruction ID: 2d414118e3c7eace9e7770a471ca06b72b9b50da7e6a301547a252e2e96d1e70
Opcode Fuzzy Hash: 406ac9f93907a8b69a8abc3e757f6c4a78ea819a4e3bbdf03341b004573614c1
Instruction Fuzzy Hash: CE81D435B100058FC708CA7ADC92629BAE7AFD4644B59C42AD806EB3B4EF34FC02CB51

Function 04CE0C53 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1c4a41f4de465536846d6bacd63330ccc8cc1ab1252656040cb755a27ba0d0
Instruction ID: 398490fdaa2fcc90aabe70aa7e95340c559b62573b67bcef408abb3923942471
Opcode Fuzzy Hash: 7e1c4a41f4de465536846d6bacd63330ccc8cc1ab1252656040cb755a27ba0d0
Instruction Fuzzy Hash: FF41E635B241228FC30C5737D5961393B77FBE1358759C469DA879B2A2DE68BC02C6C2

Function 04CE0C90 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2612b4f1cc01ec120f0129c771b35c66dddaa6e845cd6dbba14c4109ee881b0
Instruction ID: 7b0e6c3865e8ea1f72b97da7e27a8bbf7e05b2701ec145b0248573fc074ccfe5
Opcode Fuzzy Hash: c2612b4f1cc01ec120f0129c771b35c66dddaa6e845cd6dbba14c4109ee881b0
Instruction Fuzzy Hash: C531F535B240228FC30C9737D5961393AA7FBE0758759C025DA879B2A1DF78BC01C6C2

Function 04CE2A6E Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

#PP, xrefs: 04CE2A6E

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID: #PP
API String ID: 0-565894853
Opcode ID: 6b99d5886aa5ed54b218f0eff4ece19d8bac4563fef8249716629f84e26122e0
Instruction ID: 69bc5619417817ae52b9eb82dbe80302f20466e7caa07e7fd7c21d06fe78ba0a
Opcode Fuzzy Hash: 6b99d5886aa5ed54b218f0eff4ece19d8bac4563fef8249716629f84e26122e0
Instruction Fuzzy Hash: A4F03C74E002498FCB04DFB5D494A5DBBB2FF84304F1085A8D0569B314DB34AC02CF81

Function 04CE3528 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba47a6536f0984b3c56c6fdcc205375b64a511a6d32dd13c63c8d906f6c239f8
Instruction ID: 67c862641bfbcedfcd006bcfeb633f4d72e789fe08af2d6dba084253a391ad93
Opcode Fuzzy Hash: ba47a6536f0984b3c56c6fdcc205375b64a511a6d32dd13c63c8d906f6c239f8
Instruction Fuzzy Hash: 50516C74B001058FCB08DF7AD994A6EBBF2FF89714B648469E906DB365DB30AD01CB51

Function 04CE3538 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447d46384211ab3d09e6e2cbaff0136bad610987752d69ac2ccf073adb6581e0
Instruction ID: 592c236323c6d94dc6aa67528dc5331f143a7006190be63f2aaf3a8221bf5b62
Opcode Fuzzy Hash: 447d46384211ab3d09e6e2cbaff0136bad610987752d69ac2ccf073adb6581e0
Instruction Fuzzy Hash: C8514C74B001058FCB08DF7AC994A6EBBF6FF88714B648469E906DB3B5DB30AD058B50

Function 04CE3759 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b20403f04971749dad378067f5e03bd78ff8e79772d58318c35ddbeface56fe
Instruction ID: 1ae97703a1a8a64cafd773fda601c8aa5ec1c42614638f725fe6e164a6f55262
Opcode Fuzzy Hash: 9b20403f04971749dad378067f5e03bd78ff8e79772d58318c35ddbeface56fe
Instruction Fuzzy Hash: CE213479B081924FD308CA7BDD9253A7BE7BBC820430AC42AE905CB261EF34BD02C351

Function 04CE297E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a9f41607ae50109fc76513cce7585ee027a90b9631890a22dff2027b66a580
Instruction ID: 5e704bcfe8943a22724fb02d1aede9066aa7c59fcb01bc841250cd06d35a5515
Opcode Fuzzy Hash: 92a9f41607ae50109fc76513cce7585ee027a90b9631890a22dff2027b66a580
Instruction Fuzzy Hash: FA215E74F002098FCF18DFB9D8A5A6DBBB2EF98304B1095A9D44AEB355DB34A905CF41

Function 049ED01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036496966.00000000049ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 049ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49ed000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd38e2221fd010b8e8cbf9adcb973ab963904e1fb17633fe3cee49bb1e713b6
Instruction ID: d656038e3ceb7c6fcf832df0a4f50e2ae499469c592fb96ce92d6abcce3da44b
Opcode Fuzzy Hash: bcd38e2221fd010b8e8cbf9adcb973ab963904e1fb17633fe3cee49bb1e713b6
Instruction Fuzzy Hash: 8A1156B06043419FDB12DF25E980B36BB99EB84315F248B7DD4094B241D33AE447C662

Function 04CE33C9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895dff453804dfa474db8c73e75bb96d84fe16ef085ca273d6bca972468201a1
Instruction ID: 1cad23a60e80f232e8061fcaa9af90b3d5032e485603d1cb9b30077e966d021c
Opcode Fuzzy Hash: 895dff453804dfa474db8c73e75bb96d84fe16ef085ca273d6bca972468201a1
Instruction Fuzzy Hash: AC119676B001058FDB149AB6DC5677D7AA7ABD4248F198825D406973A0DF38FD42CB41

Function 049B3007 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036172378.00000000049B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49b3000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542581b7db1dca4480b42f0cf72bac2c36691c220898b14cbcdf3b3f496d0c6b
Instruction ID: 08447767f34b886c9139cc287aea24f3775c02ed5473ccc8993f897eb30f2b3d
Opcode Fuzzy Hash: 542581b7db1dca4480b42f0cf72bac2c36691c220898b14cbcdf3b3f496d0c6b
Instruction Fuzzy Hash: 751160711097C09FD712CF15D984B52BFB8EF46610F0884ABD9898B2A3C279A845CBA1

Function 049B301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036172378.00000000049B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49b3000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb225d02696f70f7a701c12b6ff976ac204502164c0086c0a3260bb41105103
Instruction ID: 1206385ce51991780a5e1304fa7c539fa541da73699144c8009774c10b9cef3e
Opcode Fuzzy Hash: 1bb225d02696f70f7a701c12b6ff976ac204502164c0086c0a3260bb41105103
Instruction Fuzzy Hash: 99117071504A44DEE720CF59DA84B66FBA8EF44720F04C86EED894B652D37DA844CBB1

Function 049ED006 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036496966.00000000049ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 049ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49ed000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84bb66883f08618cad05f3d984b656aefe828eedac7c79bc8a8cae99e6a7c83
Instruction ID: 72c2a818391c5e15503f3414105ee508550d7c147bdb241039da2a0c9b3164d3
Opcode Fuzzy Hash: b84bb66883f08618cad05f3d984b656aefe828eedac7c79bc8a8cae99e6a7c83
Instruction Fuzzy Hash: 921151715097C08FDB13DF24D984725BF71EB46214F2886EAD4898B693C33A944AC762

Function 04CE2CC3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f5991a1a590ac5e02ef74bfe35ad5691193754c3e7813ce8a7f7ca39209b9b
Instruction ID: 6d60e46285b3067607fb5d67fda961ce78195f2bd085ca2abce74ec2914560fd
Opcode Fuzzy Hash: 06f5991a1a590ac5e02ef74bfe35ad5691193754c3e7813ce8a7f7ca39209b9b
Instruction Fuzzy Hash: 72F01D74A102158FCF14DF75D855A5DBBB2FF88208F008995D046AB354DB34AD01CF91

Function 04CE2C4E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c7f0741374d7fc3159a6e9e422384eedb857d955018975fe06437d032da5aa
Instruction ID: 3bb5fb564d1ba38b192a4e6250332170ce9cecaa1769f8f9fb07bb8f1f5ac6c1
Opcode Fuzzy Hash: d1c7f0741374d7fc3159a6e9e422384eedb857d955018975fe06437d032da5aa
Instruction Fuzzy Hash: 0EF03C74A102098FCF14DFB6D994A6DBBB2FF94304F1085A8D046AB355DB34AD01CB81

Function 04CE3002 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81814e89353f83f72e1deef5676b083b53c8fcfcf08a5fd3250e7730e0d0d6f
Instruction ID: c2e01622fc0a7fefe57a615825ace5983584841cebb22626d6546360c725b2d6
Opcode Fuzzy Hash: e81814e89353f83f72e1deef5676b083b53c8fcfcf08a5fd3250e7730e0d0d6f
Instruction Fuzzy Hash: 2EF0FF74E102098FCB08DFB5D495A9DBBB2FF99304F1085A9D44AAB364DB34AC42CF50

Function 04CE29F3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a16aedcf32d22b867f78b21bdb9f7811fa82bb96acac15ec2fdf5dc6cde556e
Instruction ID: 1a91c5c6cbdbe2a45d4a8f1112654b4e1be5379e0f1364bfcbd1902e853ff2ff
Opcode Fuzzy Hash: 4a16aedcf32d22b867f78b21bdb9f7811fa82bb96acac15ec2fdf5dc6cde556e
Instruction Fuzzy Hash: BDF0FF74E102098FCB14DFB5D995A5DBBB2FF98308F1098A5D04AAB355EB34AD02CF41

Function 04CE2DB3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c7f778804bbe37e09c05409b67e1b32b4cd7d5c856faaaf8c9196d7a561cc9
Instruction ID: 7758d64b140c86b140a225532a9981f32ad3c88219c45ad3a80134052c45941e
Opcode Fuzzy Hash: e6c7f778804bbe37e09c05409b67e1b32b4cd7d5c856faaaf8c9196d7a561cc9
Instruction Fuzzy Hash: 87F0FF74A10209CFCB14DFB5E89596DBBB2FF84308B1089A9D0469B354EB34A941CF81

Function 04CE2D3E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bcb3cb3314c447151618a8dc091bc844d2d47f7767d02bd05870932b3764a8e
Instruction ID: 5d02329464bbc6829f4d602ce61f9997c8cbcc71462d3119c66a452b960679e0
Opcode Fuzzy Hash: 8bcb3cb3314c447151618a8dc091bc844d2d47f7767d02bd05870932b3764a8e
Instruction Fuzzy Hash: 90F0FF74A103098FCB58DFB5E89495DBBB6FF88304B1189A9D04A9B364EB34AC41CB41

Function 04CE2AE3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42bcd3ce949c67052359ae074c4c244673a0cf494fb46d8cba4f5edfd49ec97
Instruction ID: e01ac508cfd3d02fb27dc6b354b78687044ed059563084acd19945a37904169a
Opcode Fuzzy Hash: f42bcd3ce949c67052359ae074c4c244673a0cf494fb46d8cba4f5edfd49ec97
Instruction Fuzzy Hash: C6F03C74B002098FCB14DFB5D995A5DBBB2FF84308F0084A4D14A9B359DB74AD02CF80

Function 04CE2E9D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009301c5707c0a9fa981a7c91fa9140fc5a34c315e2839f8337e3a9355a0e3a2
Instruction ID: 8366e4a70cea4754b205a12543da4a5034ddd98f6cd2e9832312d5a7b5b3c17a
Opcode Fuzzy Hash: 009301c5707c0a9fa981a7c91fa9140fc5a34c315e2839f8337e3a9355a0e3a2
Instruction Fuzzy Hash: B7F0FF74A112198FCB14DFB5D895A5DBBB2FF98308F0085A9D04A9B355DB34AD02CF80

Function 04CE2E28 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f4f3c7647c73603881e15d7c187bc4650bb5904bbd8161de6b35599292c356
Instruction ID: f508835d4c922a802dabeded64052f9e6b71752ffa6c3ed0e833f1adc52e19b4
Opcode Fuzzy Hash: 29f4f3c7647c73603881e15d7c187bc4650bb5904bbd8161de6b35599292c356
Instruction Fuzzy Hash: DDF01274A00209CFDB14DFB5E895A5DBBB2FF84308F1589A8D04AAB355DB34AC42CF80

Function 04CE2BD3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec7d588f289bd499d59c2fef802d6dd53401ffb784f43fd64ff0d495f1e54ff
Instruction ID: 5171fd17ae8f2940e74a1820b6a9fd97a6f52009650ceb4baf07ea84824404a0
Opcode Fuzzy Hash: 1ec7d588f289bd499d59c2fef802d6dd53401ffb784f43fd64ff0d495f1e54ff
Instruction Fuzzy Hash: 24F03174A102058FCB14DF75D894A5DBBB2FF89308F118495D08AAB354DF34AD41CF41

Function 04CE2F8D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825ca8c6cb75aec4c615900f87c8a3b83f6d4deb662115ab360326a79823c371
Instruction ID: 2fa6ccce829a954cc4cfd4a43e39a35b48500ef2a46546d93e62bdea02aae5bd
Opcode Fuzzy Hash: 825ca8c6cb75aec4c615900f87c8a3b83f6d4deb662115ab360326a79823c371
Instruction Fuzzy Hash: 7DF0F474E1020A8FCB14DFB5D85495DBBB2FF84308B118555D44A9B365DB34AD02CF80

Function 04CE2B5E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0745ffe293ce2315eb291eefef8436903c7c1ff55a7cd6d23ea4f3065ec8a0
Instruction ID: 7933417a7887fa598e42edd8462fb7cc7b9fcc181e05ba59a74ba4b6d3529509
Opcode Fuzzy Hash: 7b0745ffe293ce2315eb291eefef8436903c7c1ff55a7cd6d23ea4f3065ec8a0
Instruction Fuzzy Hash: 0EF01974A003098FCB14DFB5D89595DBBB6FF85304B0089A9D44AAB354EB34AC02CB80

Function 04CE2F18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56657a364c1a1c0db451b17a6590b719d2d2d93a0183d817ff32fdb457b5af41
Instruction ID: fe47a61618956d80443f018006a610132e1d5a2335f7862ba325f9a7f960ef4b
Opcode Fuzzy Hash: 56657a364c1a1c0db451b17a6590b719d2d2d93a0183d817ff32fdb457b5af41
Instruction Fuzzy Hash: CEF04F74E002199FCB58DFB5E89495DBBB2FF94304B1085A8D046AB365EF34AC42CF40

Function 04CE1F29 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2036731649.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91a1485d9fdba5db65ad6299eede4c58bf691e93353889a91623ae2eef69ac3
Instruction ID: c75aac2c4d74504dafb1768e8b11dab920939a4627da9730b067ca2f33628662
Opcode Fuzzy Hash: b91a1485d9fdba5db65ad6299eede4c58bf691e93353889a91623ae2eef69ac3
Instruction Fuzzy Hash: 34E0A0B06141018FCB08DF72E8916597BB6EFD4348F018874C0499B250EF346889CB80

Analysis Process: rundll32.exePID: 5044, Parent PID: 1472COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	8

Executed Functions

Function 077236B8 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4495431209.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7720000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a17c6a35ebc902000f2a9e5f9a14ff4db1cff9fcc2f9960365a9c631b189489
Instruction ID: 3422135ca64dd50b0918a05c2f25ce9fbe7c4d3c463d64443c19c32f77b699b6
Opcode Fuzzy Hash: 0a17c6a35ebc902000f2a9e5f9a14ff4db1cff9fcc2f9960365a9c631b189489
Instruction Fuzzy Hash: ACF19CB0A00219CFDB14DFA9C884BADBBF1FF49344F158569E415AF261DB78E846DB40

Function 067B72E8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 067B7366
GetCurrentThread.KERNEL32 ref: 067B73A3
GetCurrentProcess.KERNEL32 ref: 067B73E0
GetCurrentThreadId.KERNEL32 ref: 067B7439

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0e4162e6d3efd5eda5ce46ae6330f5726de1d35bf843c29aa42e5435cfd6db1a
Instruction ID: 35b32b0cdf0216c70f3e1c9fff0a3be7c3f4e190b190e94691119842599767c3
Opcode Fuzzy Hash: 0e4162e6d3efd5eda5ce46ae6330f5726de1d35bf843c29aa42e5435cfd6db1a
Instruction Fuzzy Hash: 315168B09003498FEB54DFA9D948BEEBBF5EF88304F209019E449A7360D738A944CB65

Function 067B72E6 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 067B7366
GetCurrentThread.KERNEL32 ref: 067B73A3
GetCurrentProcess.KERNEL32 ref: 067B73E0
GetCurrentThreadId.KERNEL32 ref: 067B7439

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cf9bd28c27b1f104ca746ee89788a7f876e94308e8b7e07a04a647389f43a45d
Instruction ID: 6761ab72fd95057ebf358890060c2a8b83636fb97ad460a27e4a48ee622d3c6c
Opcode Fuzzy Hash: cf9bd28c27b1f104ca746ee89788a7f876e94308e8b7e07a04a647389f43a45d
Instruction Fuzzy Hash: C35168B09002498FEB54DFA9D548BEEBBF5EF88304F249019E449A7360C738A944CB65

Function 067B72D8 Relevance: 6.1, APIs: 4, Instructions: 121
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 067B7366
GetCurrentThread.KERNEL32 ref: 067B73A3
GetCurrentProcess.KERNEL32 ref: 067B73E0
GetCurrentThreadId.KERNEL32 ref: 067B7439

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cbca2838c9613d3c759c3f82d0246ed30cf109f106efc812ee57d156b3ef8c93
Instruction ID: f0a4fb322af1b3e40d18df1a5b57362a614517de73cc1436f1e65cbb4f133c11
Opcode Fuzzy Hash: cbca2838c9613d3c759c3f82d0246ed30cf109f106efc812ee57d156b3ef8c93
Instruction Fuzzy Hash: 0D515AB49003498FEB54DFA9D5487EEBBF1EF88304F24D05AD449A72A0D7389944CF66

Function 067BE7D0 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 067BEA36

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d9195dbd91d2373a3028f7b092a858d98c9d739a1c08ea82cfa5f232261b4ff1
Instruction ID: d5112d2ff8ed9b56b202e9c40eac82a6887812cdfc0617d241761b28867e3822
Opcode Fuzzy Hash: d9195dbd91d2373a3028f7b092a858d98c9d739a1c08ea82cfa5f232261b4ff1
Instruction Fuzzy Hash: E4814670A00B058FD7A4CF29D4447AABBF5FF48340F00992AD49ADBB50DB74E849CB91

Function 0410DC90 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0410DDA2

Memory Dump Source

Source File: 00000005.00000002.4493509417.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_rundll32.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 38ab77227675ac9117dfa43c2e76c6cff3eef1f9a99da6448fafde0a75c2c73b
Instruction ID: 41b86f2baf090b779197c4ee1ec66ba1dc8225ec89c89bd98e98710cc2d0346c
Opcode Fuzzy Hash: 38ab77227675ac9117dfa43c2e76c6cff3eef1f9a99da6448fafde0a75c2c73b
Instruction Fuzzy Hash: 4741B1B1D10309DFDB14CFA9D984ADEBBB5BF48314F24812AE818AB250D7B5A845CF90

Function 04107F74 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04109411

Memory Dump Source

Source File: 00000005.00000002.4493509417.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2b2ff04d520b0907495d0b43079be32fdd0d0204ef1866e55b563a992efd10be
Instruction ID: eb127235cea5cc6b34a9d52ec43c74aefebe175686554c535a7bb9c2876ceea0
Opcode Fuzzy Hash: 2b2ff04d520b0907495d0b43079be32fdd0d0204ef1866e55b563a992efd10be
Instruction Fuzzy Hash: 4B4102B0D0061DCFDB24DFA9C994B9EBBB5BF49304F20806AD408AB255DBB56945CF90

Function 0410935E Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04109411

Memory Dump Source

Source File: 00000005.00000002.4493509417.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 53bd8b4505bddd1d5450cc6899b325aaa6ac1d6d266bb45ea4c53979d4c013d9
Instruction ID: 09d1a831526a9374e44bb9aba49a53cf6789f00f44baf3f4712917ffaf0d74af
Opcode Fuzzy Hash: 53bd8b4505bddd1d5450cc6899b325aaa6ac1d6d266bb45ea4c53979d4c013d9
Instruction Fuzzy Hash: E541F1B0C00719CFDB24DFA9C994BCEBBB1BF49304F20806AD418AB255DBB56946CF91

Function 07720C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 07720D31

Memory Dump Source

Source File: 00000005.00000002.4495431209.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7720000_rundll32.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 45a572178fdb0ce4c854b69d57bba9bdc219687ae0eefbc473f79c9853ebd978
Instruction ID: 2fdea00fe0db13d8ccd646fb3f26088cf5ca44ff0e914c311873b8b95341f780
Opcode Fuzzy Hash: 45a572178fdb0ce4c854b69d57bba9bdc219687ae0eefbc473f79c9853ebd978
Instruction Fuzzy Hash: 654106B8900715DFDB14CF99C448AAABBF5FF89314F24C899D529AB321D375A841CFA0

Function 04109356 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04109411

Memory Dump Source

Source File: 00000005.00000002.4493509417.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4100000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0821a5dfafbde3e79deada9832e2452d48db81b11431fc9048812f5c30472cd6
Instruction ID: 462f1afb79bf6e91ae17a705674c35f41f321b7f4ae2e9492c06a396608ba67e
Opcode Fuzzy Hash: 0821a5dfafbde3e79deada9832e2452d48db81b11431fc9048812f5c30472cd6
Instruction Fuzzy Hash: 033102B0C14219CFDB25DFA8C994BDDBBB1BF45308F20805AC418AB295DBB5694ACF91

Function 067B7530 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067B75B7

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ca4b3b62093cb5208ba8a49d36917da4f21cbbe0d5c3a02e9048abd95178798b
Instruction ID: 5576eacfc4791547d5a6205cfd05bc2203b5cd7105bf2e40e26eb76e6da651bd
Opcode Fuzzy Hash: ca4b3b62093cb5208ba8a49d36917da4f21cbbe0d5c3a02e9048abd95178798b
Instruction Fuzzy Hash: C721C4B5900249DFDB10CFAAD984AEEBBF5FF48310F14841AE918A7310D378A944CFA5

Function 067B7528 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067B75B7

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 09b4883da551773f03c75a459495758665c1875b3a1b787b94089713a3a8a040
Instruction ID: 1c1a8d7a5ce4fad89e837fa01b04bacb52903068dbb23a6a4b0adcee64aec14e
Opcode Fuzzy Hash: 09b4883da551773f03c75a459495758665c1875b3a1b787b94089713a3a8a040
Instruction Fuzzy Hash: 1521D4B5D00249DFDB10CFAAD585AEEBBF4EB48310F14805AE918A7350D378A950CFA5

Function 067BEC50 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,067BEAB1,00000800,00000000,00000000), ref: 067BECC2

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d80ac1e1c93c1a3f9e5d526efe5f11bf7360687ad1f15d8940177b5524ec1e59
Instruction ID: 9b7dcc3d008c5f45999ede10a3585c7a2117c1fd99f1b2bd9affe018413ed057
Opcode Fuzzy Hash: d80ac1e1c93c1a3f9e5d526efe5f11bf7360687ad1f15d8940177b5524ec1e59
Instruction Fuzzy Hash: 512100B68002499FDB20CFAAD844ADEFBF4EB88310F10852EE459A7300C379A545CFA5

Function 067BDBD8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,067BEAB1,00000800,00000000,00000000), ref: 067BECC2

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f6804f68d8c72492bd2f09d9b4bdbd391d73330c2a240253c8cd96eade1f9ba4
Instruction ID: 993810590b3b726f8957e6c4017d27b38602340bef52e8153dedaac82f31ebc4
Opcode Fuzzy Hash: f6804f68d8c72492bd2f09d9b4bdbd391d73330c2a240253c8cd96eade1f9ba4
Instruction Fuzzy Hash: 801114B6C002498FDB10CF9AD544BEEFBF4EB88310F10952AE519A7300C379A545CFA5

Function 067BE9D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 067BEA36

Memory Dump Source

Source File: 00000005.00000002.4494783347.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_rundll32.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f45a279947ca0c72ac4edb00b6e1922ace69298195daf0483583d8638f609339
Instruction ID: 248ea2a4ae307a949b2d5f8af38f8cad57521f9085e37678efb66a2fa4572724
Opcode Fuzzy Hash: f45a279947ca0c72ac4edb00b6e1922ace69298195daf0483583d8638f609339
Instruction Fuzzy Hash: FB11CDB5C002498ADB10DF9AD844AEEFBF8AB89210F14852AD429A7310C379A545CFA1

Function 03FAD0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493255674.0000000003FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3fad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fa027d899594bd770e43a6fbb3ce4815f2c75409c67fb2c9c877faf7062a9a
Instruction ID: e4dd154ecdccc36efba0576b6c08525791a7403f20c8d0cd6a2d979ca3ad5f1e
Opcode Fuzzy Hash: a8fa027d899594bd770e43a6fbb3ce4815f2c75409c67fb2c9c877faf7062a9a
Instruction Fuzzy Hash: 052104B5504604DFEB04DF28D9D0B26BB69FB88314F24C5ADE9094B766C33AD846CAA1

Function 03FAD01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493255674.0000000003FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3fad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7188552ed673d16c12716f1f58a9800107f0805aec158d7659152ed68b8fe9ca
Instruction ID: a4d07e3f15c1ead0a3bcbd288115a4529e18b3b5f5adf4d576ee736cd521fdfd
Opcode Fuzzy Hash: 7188552ed673d16c12716f1f58a9800107f0805aec158d7659152ed68b8fe9ca
Instruction Fuzzy Hash: F21156F1904B409FDB14DF2CD984B2ABF98FB44304F20CA6DE4094B669C33AD447D662

Function 03F93005 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493159804.0000000003F93000.00000040.00000800.00020000.00000000.sdmp, Offset: 03F93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3f93000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830ae94bdf002e0d792273ab0e9135e982b7c0151b3a2a939dd625d7a4f0cabd
Instruction ID: 92f3633e6374ef9d1ecabde9dfef9edea9eb9edaa49db46142c053f42e84fa04
Opcode Fuzzy Hash: 830ae94bdf002e0d792273ab0e9135e982b7c0151b3a2a939dd625d7a4f0cabd
Instruction Fuzzy Hash: 541190725087C09FE712CB15D894B12BFB8EB46614F08849BD9898F263C37C9808CB72

Function 03F9301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493159804.0000000003F93000.00000040.00000800.00020000.00000000.sdmp, Offset: 03F93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3f93000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca4b3c76f9052b66307a295050c87f689d0a12d595b23106039ea21a2d70175
Instruction ID: 6597314f6d11e2ab1d19fb92523d7994f431634b31b82f50e143c90ad5206f22
Opcode Fuzzy Hash: cca4b3c76f9052b66307a295050c87f689d0a12d595b23106039ea21a2d70175
Instruction Fuzzy Hash: EC11C276504645DEFB10CF5AD984B26FBA8EB84724F04C86FE9894B362C37C9804CB71

Function 03FAD0D7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493255674.0000000003FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3fad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99db45d672c4764d40f0ca8c7a9ed31cbd59fe0aa2a66517f4ed9da6a9e5e667
Instruction ID: 61372b247a1635a23ead7b5e89e28aa2759b2916dbeb9c1a30fe1fdc6e78155e
Opcode Fuzzy Hash: 99db45d672c4764d40f0ca8c7a9ed31cbd59fe0aa2a66517f4ed9da6a9e5e667
Instruction Fuzzy Hash: 9011BEB5904640DFEB05CF14D9D4B15BB71FB84218F28C6AAE8494B656C33AD40ACB61

Function 03FAD005 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493255674.0000000003FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 03FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3fad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e35081dbcf3176a5788f84df25cb1af86fdc0c23e64fc82b9626d664b1b0a7d
Instruction ID: e42c719ba52e890a6c324ec4b7d001db2cc5e22b01d2c3cdf1a93d5f4e0b5aac
Opcode Fuzzy Hash: 2e35081dbcf3176a5788f84df25cb1af86fdc0c23e64fc82b9626d664b1b0a7d
Instruction Fuzzy Hash: 981104B18097C08FDB12DF24C594710BF70FB42204F28C5EAD4898B6A3C33A940AC762

Analysis Process: rundll32.exePID: 4028, Parent PID: 1472COMMON

Executed Functions

Function 030130C1 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

#$y, xrefs: 030132F7

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 5e712cccd5a0e5c613fb57aac800046b0fc14af90c2503b283ee1539836a8cca
Instruction ID: 0f343c024983953959aa26976a95632fa1b8607989fd6f15356680bdcd6d849e
Opcode Fuzzy Hash: 5e712cccd5a0e5c613fb57aac800046b0fc14af90c2503b283ee1539836a8cca
Instruction Fuzzy Hash: 2591E07AB110158FCB08DB7CD896619BBE7BFD9244729C86AD406DB364EE34EC02CB41

Function 03013107 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

#$y, xrefs: 030132F7

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 0c0e3df1cef2a7c7706f6a127941059573b57662fbe6e0a012aa0f19c6ec88d3
Instruction ID: 59fe3389cdbe2a4397cc8a21de3d9439eaed32877512ea2574bfd54252842a99
Opcode Fuzzy Hash: 0c0e3df1cef2a7c7706f6a127941059573b57662fbe6e0a012aa0f19c6ec88d3
Instruction Fuzzy Hash: E291D03AB110048FC708DA7CDC9261ABBB7AFD5644769C86AD406EB3A4DE34EC02CB51

Function 03013120 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#$y, xrefs: 030132F7

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 4f13ab2bf74e8ec1e84c2319c4b650aaef5bb6fe2ef38137300c1dc5cb2ed924
Instruction ID: d41b9c304ae7801cf898cdf0a9c15ec999602646c32b854676170e56077ddb59
Opcode Fuzzy Hash: 4f13ab2bf74e8ec1e84c2319c4b650aaef5bb6fe2ef38137300c1dc5cb2ed924
Instruction Fuzzy Hash: 0481E239F110058FC708DB7DDC9261ABAE7AFD4644769C86AD506DB364DE34EC02CB51

Function 03010C52 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdda8656196e12e7ef0f4f90c832d203d511f9f3021f7903854b9d8a50f73d7
Instruction ID: 50a6155942ce616e11a84938c030d2eb1c9132fc70518de94b3c1bd421b99a2e
Opcode Fuzzy Hash: bfdda8656196e12e7ef0f4f90c832d203d511f9f3021f7903854b9d8a50f73d7
Instruction Fuzzy Hash: ED41C535B15115CFC31CE734E9961297B6BFBE0308759C865D8878F2A6DD28AC52CE82

Function 03010C90 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb202623942f2421546d748ac0cd21a08f3d301ef34e96387567204a1eee7b0
Instruction ID: 408b0efbfdaf70ecaa16b25cfd24a2c0bb175ebdb3657c5665da176a5c96be37
Opcode Fuzzy Hash: 1eb202623942f2421546d748ac0cd21a08f3d301ef34e96387567204a1eee7b0
Instruction Fuzzy Hash: 2C31EA35B11019CFC31CE734E99512DBA9BFBE0708759D825D8878F2A5DD38AC52CE82

Function 03012A6E Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

#PP, xrefs: 03012A6E

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID: #PP
API String ID: 0-565894853
Opcode ID: 12b11a56508adcfaca3b1cf03fa0748cdd356aeb8f041c80736834be8b948f64
Instruction ID: d92c8f9ed57670bad576e5d30d1da26cbb0934118b87b8e1e935aa4ac0e02762
Opcode Fuzzy Hash: 12b11a56508adcfaca3b1cf03fa0748cdd356aeb8f041c80736834be8b948f64
Instruction Fuzzy Hash: D1F0F974E002498FCB04DFA4E894A9DBBB6FF94304F14896990569F368DF34A847CF91

Function 03013528 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2335c1f63eaaadad52713fc2daefd126686a8b209a048236be9b1da1eecf184c
Instruction ID: c9216d0d4feb18f18ce613670e31779104fd809cfb1c1cc4c3cd3512f6db29bd
Opcode Fuzzy Hash: 2335c1f63eaaadad52713fc2daefd126686a8b209a048236be9b1da1eecf184c
Instruction Fuzzy Hash: 1D518074B101058FCB48DF69C895AAEBBF2FFC8710B6484A9E506DB365CA30DD05CB51

Function 03013538 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57bcf960a59fdcb64cf21f3ea720e4319b8c8ecb8c869ee815644bd85f6a031
Instruction ID: 9a88f93c63bc8b67e3371e5f7b55b432950a8cfb4f7fdbecb7457307f3dbc870
Opcode Fuzzy Hash: f57bcf960a59fdcb64cf21f3ea720e4319b8c8ecb8c869ee815644bd85f6a031
Instruction Fuzzy Hash: 7B516E78B101058FCB48DF69C994A6EBBF6FF88710B6484A9E506DB365CA30ED05CB51

Function 03013759 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961615ba55828cee820dee530d8684a953d90f0fd3238d37f4a6cdf5aeaf419
Instruction ID: a81841553439886ab72d05b28e0aba11f219d56a0b6600dfbb8cfd4bf46d421e
Opcode Fuzzy Hash: 9961615ba55828cee820dee530d8684a953d90f0fd3238d37f4a6cdf5aeaf419
Instruction Fuzzy Hash: 5021017EB051525FD308CB79DC9696BBFEBABC5210319C5A6E016CB368DE30AD02CB51

Function 0301297E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e310986a53b6ea33ad7665ac2d2c250b3774394a0789f7096a0f3caa332c38a
Instruction ID: b40d8f42b3fa273adca53fcca473dc3b089d7fd4b5c73af3670078f2218ce7da
Opcode Fuzzy Hash: 3e310986a53b6ea33ad7665ac2d2c250b3774394a0789f7096a0f3caa332c38a
Instruction Fuzzy Hash: CC215E74F002098FCF18DFA9D8A5A6DBBF6AF99300B149969D00AEB355DF34A905CF41

Function 02FAD01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064842403.0000000002FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64c9fb66c9460f8060541240038c3b8b2575081a7170957c49a0c32aa6e1b72
Instruction ID: eb8fa80d8fcc27f3d231912d3cd4febf9aba00867ec26a2a5af4c3dfcf30fcd4
Opcode Fuzzy Hash: a64c9fb66c9460f8060541240038c3b8b2575081a7170957c49a0c32aa6e1b72
Instruction Fuzzy Hash: BB1156F1A043409FDB14DF24D985B26BF94FB44B84F20CA6DD6094B649C33AD447C662

Function 030133C9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9f4846200bbbc7c5cb8eb1ea9ec3a480de00c369c566e4c496e3fcf756f94c
Instruction ID: a24a11622c5cae444a802d8e44815188a7799f2a87334bb9dec1b0f25c113448
Opcode Fuzzy Hash: ec9f4846200bbbc7c5cb8eb1ea9ec3a480de00c369c566e4c496e3fcf756f94c
Instruction Fuzzy Hash: 1C119679F010058FDB14DA78DC5672DBAB7ABD4644F198829D0069B694DE38ED42CB41

Function 02F93005 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064790756.0000000002F93000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f93000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b79933c56496456f5ceaf8db639af2dbdc6023f99faf96e1da14d3cea195fdb
Instruction ID: 6c903188efea315adce2b56a66beee6953e0b0a48955a493043b5c716e760777
Opcode Fuzzy Hash: 7b79933c56496456f5ceaf8db639af2dbdc6023f99faf96e1da14d3cea195fdb
Instruction Fuzzy Hash: 491182715097C09FE712CB15D994B62BFB4EB46614F0884DBD9898F2A3C37D9805CB72

Function 02FAD005 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064842403.0000000002FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2fad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be61353e101c8e7e61ceab69f4b06a55d3898b4c871276d0622f6f8571c9e5b
Instruction ID: f1af8c690317e6f0ac9da8894db8da33cc92e0cc046005232481b6258c14a2d9
Opcode Fuzzy Hash: 9be61353e101c8e7e61ceab69f4b06a55d3898b4c871276d0622f6f8571c9e5b
Instruction Fuzzy Hash: BB11C1B19093C08FDB13DF34D594715BF71EB46604F28C6EAC5898B6A7C33A944AC762

Function 02F9301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064790756.0000000002F93000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f93000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9d0ef54b51b6b0b65c9ad4ca1fc0b976c7feaa97b0d3e522610fe5de59247a
Instruction ID: d5dfca4be8ef6375a9bf927d384de67a36b8ffaffd1c30c3f2cc4a3dde3c72f0
Opcode Fuzzy Hash: 2e9d0ef54b51b6b0b65c9ad4ca1fc0b976c7feaa97b0d3e522610fe5de59247a
Instruction Fuzzy Hash: 99118672904644DEEB10CF59D984B26FBA8EB84B64F04C86AEA494B752C37D9444CB72

Function 03012F18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba98536eac43616ff6ffba8756be790d6b01136a7393e611c33dbc9fb9083b7
Instruction ID: c877de7888c41825ab8f1b34aa84f86b2024692460f40f2a9f0f145f9964a3ff
Opcode Fuzzy Hash: 3ba98536eac43616ff6ffba8756be790d6b01136a7393e611c33dbc9fb9083b7
Instruction Fuzzy Hash: ADF04974E012099FDB48DFB4E89495DBBB6FF94304B148968D01A9B369EF34AC42CF80

Function 03012B5E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27048cd2be39703bae247e44913d3a82365c529edaa18205707272190bc0c7d4
Instruction ID: babd610f1af6de3a4e30f76468491265c47dd69bfd1d206fc162bc7b7866029b
Opcode Fuzzy Hash: 27048cd2be39703bae247e44913d3a82365c529edaa18205707272190bc0c7d4
Instruction Fuzzy Hash: A5F0E774A00309CFCB04DFA4D99595DBBBAFF95304B108969941A9F364DB34AD46CF81

Function 03012F8D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c61be7f234d81c4f6c382633950c9c31b4d163bd3efccc5af354f381350a4c5
Instruction ID: 00fa7593dad115c71464034a89189aaba0b59b13976f949e8958707b906607b0
Opcode Fuzzy Hash: 6c61be7f234d81c4f6c382633950c9c31b4d163bd3efccc5af354f381350a4c5
Instruction Fuzzy Hash: EEF0F978E0120A8FCB04DFA5D89495DBBB6FF98304B118965D41A9F368DB38AD02CF90

Function 03012BD3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16f5e1114b3cfa448024b387b9b5de914a7c3e691cd1d5f9133eeb993eddc85
Instruction ID: 397a09c5569766a59d9b6eee81026f6a26dd996dfb708e17d0df2980a58041ac
Opcode Fuzzy Hash: b16f5e1114b3cfa448024b387b9b5de914a7c3e691cd1d5f9133eeb993eddc85
Instruction Fuzzy Hash: F4F04F74A002058FCB04DF74D894A9DBBB6FF99304F1188A5D04AAB354DF74AD42CF91

Function 03012E28 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da0ad77bec540c9b20eb81332a1c896b37b1bf5c2a9691e7f0cd3e9f36bfe16
Instruction ID: 4d1f177298577816389cdafcb4fa39c0dc05b5cd97c92cc9e9bbf7ba653a8102
Opcode Fuzzy Hash: 1da0ad77bec540c9b20eb81332a1c896b37b1bf5c2a9691e7f0cd3e9f36bfe16
Instruction Fuzzy Hash: D5F01D74A01209CFDB14DFB4E895A9DBBB6FF94304F158968D00A9B369DB34AC42CF90

Function 03012E9D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c777de7fdaf2e4efa3afa3fb4ad3316374339d6a75c7b4ea25f90dccc9e8fd
Instruction ID: 181cdcc16cffad5cfb1cd4d0720be321ca963ff1511ba8ab344ef413d3c27118
Opcode Fuzzy Hash: d4c777de7fdaf2e4efa3afa3fb4ad3316374339d6a75c7b4ea25f90dccc9e8fd
Instruction Fuzzy Hash: 39F01274E112158FCB14DFB4D995A5DBBB6FF94304F0089A9D00A9B365DB34AD02CF80

Function 03012AE3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f7948966878f307b398228a15a346377cfd9f06c2a2fbedf40d3c5fc05bf06
Instruction ID: ead6bc7e5c4e118d98569005a7b25e3025e6c461df71353342da422e6f1fcf66
Opcode Fuzzy Hash: 13f7948966878f307b398228a15a346377cfd9f06c2a2fbedf40d3c5fc05bf06
Instruction Fuzzy Hash: 43F03774A012098FCB04DFB4D994A9DBBB6FF84308F0088A4910A9F368DB74AD02CF80

Function 03012D3E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861c24208c3f97a7ea2e148f295b7b166585625f53c474b0115de88bfbf2508e
Instruction ID: 5921c95cb26b6c848503593b6a85fe1969c74109819aa1bed502a3d8cb6781ee
Opcode Fuzzy Hash: 861c24208c3f97a7ea2e148f295b7b166585625f53c474b0115de88bfbf2508e
Instruction Fuzzy Hash: 89F0FF74A103098FCB48DFB4E89495DBBBAFF94304B118969E00A9F364DF34AC41CB41

Function 03012DB3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c07cc863690417d4ede771899e9b44d6b86f8042432747f27bcdb5ed7ecf53e
Instruction ID: ff63447148aa13ffe4c60ef852b628a4e89eb0cc22a7896fc001f2412c23935e
Opcode Fuzzy Hash: 3c07cc863690417d4ede771899e9b44d6b86f8042432747f27bcdb5ed7ecf53e
Instruction Fuzzy Hash: 5CF0FF74A10205CFCB04DFB4E89595DBBB6FF94304B108969D0069B354EB34A941CF81

Function 030129F3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d06835c959e5ca7938d75530a6ea7843b97dc1efc860afa626fbb1ee9a6667
Instruction ID: b3ffd9933dd5afdf6a072ff73d84f8085199374b75e886c6f73612e689f6175a
Opcode Fuzzy Hash: 88d06835c959e5ca7938d75530a6ea7843b97dc1efc860afa626fbb1ee9a6667
Instruction Fuzzy Hash: 57F0FF74E111098FCF14DFB4D995A5DBBB6FF98304F1089A5904A9B364DB34AD02CF51

Function 03013002 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39627d400855995e03bc752e9f4eff5803ec4c0fed53bc392583ea21bde62005
Instruction ID: 814a7ba98c7ac5cd9657508da1872eec477e764995994066ac2c2a7bc1bd1963
Opcode Fuzzy Hash: 39627d400855995e03bc752e9f4eff5803ec4c0fed53bc392583ea21bde62005
Instruction Fuzzy Hash: 22F0EC78E002098FCB04DFB4D494A9DBBB5FF99304F148965D41AAB364DB34AC42CB90

Function 03012C4E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a636feb603b0f0615a264febb765f35587ce969cff7b5d83ae9805441be67d
Instruction ID: dd69a0ebe042514bd19f1685ce66c13ded9c42fa77bae62c79bc996bf1d84e1b
Opcode Fuzzy Hash: 05a636feb603b0f0615a264febb765f35587ce969cff7b5d83ae9805441be67d
Instruction Fuzzy Hash: 7FF03C74E012098FCB04DFB5D994A5DBBB6FF94304F104A6890169B354DB34AD02CB81

Function 03012CC3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c0af1c3650a0c3eeb3a77ab79afe34e44383fba91eeb0392e8f240296bfe0d
Instruction ID: 3a694aac8a8be4ab7fde6a1bacc277af43779123d7d367ff9c819a466aff73ca
Opcode Fuzzy Hash: f5c0af1c3650a0c3eeb3a77ab79afe34e44383fba91eeb0392e8f240296bfe0d
Instruction Fuzzy Hash: BCF0C974A102158FCB14DFA4D994A9DBBB6FF98204F1089A5D05A9B264DB34AD01CF91

Function 03011F29 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2064980502.0000000003010000.00000040.00000800.00020000.00000000.sdmp, Offset: 03010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5057027c7c22428d8bed224f21d8a4ec800b4c57a255d567d22ad9d8965dc4
Instruction ID: cd4b217bebff9ec27f62bb092141a1650d5e150dd588f70d2885380a6ab63610
Opcode Fuzzy Hash: ae5057027c7c22428d8bed224f21d8a4ec800b4c57a255d567d22ad9d8965dc4
Instruction Fuzzy Hash: 5FE03070A141058FCF58DF74E895A5DBBF6BF94344F05896590099B350DE346C85CB91

Analysis Process: rundll32.exePID: 2408, Parent PID: 1472COMMON

Executed Functions

Function 04D230B1 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

#$y, xrefs: 04D232E7

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: eb075a5a96c687cfa31429fc6e042ff1e088e2979cd64b01e687c5eba6ce59a0
Instruction ID: 550da051af80188495ab69fa98eb8a9f1367eb2b38ba776742eda635a2953675
Opcode Fuzzy Hash: eb075a5a96c687cfa31429fc6e042ff1e088e2979cd64b01e687c5eba6ce59a0
Instruction Fuzzy Hash: 01910435B010158FCB08CB78DA9165ABBE3AFF520471AC826C946DB765DE38ED07CB51

Function 04D23110 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#$y, xrefs: 04D232E7

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 5c50ffd4fa84bddbae40fa4ca62dc5598fa0ffc914f1b80bd3ad51f46c29a4f2
Instruction ID: bdaa315ea15d2a636afa41a95b7934ef2ff6ba91433d155b5965600808e08312
Opcode Fuzzy Hash: 5c50ffd4fa84bddbae40fa4ca62dc5598fa0ffc914f1b80bd3ad51f46c29a4f2
Instruction Fuzzy Hash: 8881E435B000198FC708CB7DD99161ABAE7BFF4648719C826D946EB364EE38ED02CB51

Function 04D20C52 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83365d94e2f5e09664fc6a569ec6fac2aa7eedda3a93ba879894cf523cd2bca0
Instruction ID: 846e13927cef71f6d957402258e2eaa999baad5674156d58eb9adc66ccdb04b9
Opcode Fuzzy Hash: 83365d94e2f5e09664fc6a569ec6fac2aa7eedda3a93ba879894cf523cd2bca0
Instruction Fuzzy Hash: 7C410A327151158FC31DEB34DBA52293BA7FBF031CB15C465D68B872A2DD38ED02A685

Function 04D20C90 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e58619a4ed205c51180f6faa0be4f9767747a8f1a00ca798c22956172669890
Instruction ID: 7becc47d98e0333d3d8da9a24a4e4cc557ea6e9eb0542447f721ebf26f3cd2a6
Opcode Fuzzy Hash: 8e58619a4ed205c51180f6faa0be4f9767747a8f1a00ca798c22956172669890
Instruction Fuzzy Hash: DD3108317151268FC31CEB34D7A51293BA7BBF031C725C465DA8B872A2DD38ED02A6C6

Function 04D22A5E Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

#PP, xrefs: 04D22A5E

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID: #PP
API String ID: 0-565894853
Opcode ID: fe50aa5c3d33deae6b7842f0089763f5e089ffd4f0856f8cd27d0aea695c3fe7
Instruction ID: 9aa0cef4b9673aaec8dc99e7ba51385b5e742426d4acda115d4b52faf4187f12
Opcode Fuzzy Hash: fe50aa5c3d33deae6b7842f0089763f5e089ffd4f0856f8cd27d0aea695c3fe7
Instruction Fuzzy Hash: 7BF0EC74E002498FCB08DFA4D99495DBBB6FFA4304F10856590559B354EB38A946CF91

Function 04D23528 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e4227f4ecbc1ff850b0ceccdde679d49170035b83293e17ef5abfa8d1f6c0b
Instruction ID: 9cbe64e8669ba13acabe1556d896c81962ab1ad114b7ebf7ed7c04969562c7da
Opcode Fuzzy Hash: 11e4227f4ecbc1ff850b0ceccdde679d49170035b83293e17ef5abfa8d1f6c0b
Instruction Fuzzy Hash: 23516F74B001068FCB48DF79C994A6EBBF2FFC8714B648469E90ADB365DA34ED018B51

Function 04D23527 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39489cc6ff892206f11719e604e711d01d8ea08e300424850435968b1378d7f3
Instruction ID: d7f322809d2a4201e98337b7c4901c1a38bd74cd49980b8bbe4013ee49e2045d
Opcode Fuzzy Hash: 39489cc6ff892206f11719e604e711d01d8ea08e300424850435968b1378d7f3
Instruction Fuzzy Hash: A0516174B001058FCB48DF69C594A6EBBF2FFC8714B248069D90ADB365DA34ED01CB50

Function 04D23757 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b95ac6aabf1786c870ce2d3e1a9e15464fe6bcb8b80c317ee5d7db469953d16
Instruction ID: 9335c6d52aa66e17e08ce58ddc19ed2c3c5b035e340903db9606bb8e97ea61a3
Opcode Fuzzy Hash: 0b95ac6aabf1786c870ce2d3e1a9e15464fe6bcb8b80c317ee5d7db469953d16
Instruction Fuzzy Hash: E011B479B441264FD708CA79DD9052AB7EBBBE9314305C426D959CB364EA38DD028750

Function 04D2296E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ad88b22959b3e32649ab2c08dd9c6f76d934008cd89d29f86227c38ea16738
Instruction ID: 2f7b633d4963b6d060b029e056136cef5859ed4c2117fcbd860f80c1852f9a0b
Opcode Fuzzy Hash: 88ad88b22959b3e32649ab2c08dd9c6f76d934008cd89d29f86227c38ea16738
Instruction Fuzzy Hash: 5D218174F001098FCF18DFB9D894A6DBBF2AF98304B109569D00AEB355DB34A905CF41

Function 04CBD01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2093989839.0000000004CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cbd000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd40f0385dd15b0b2f1ccfb929ca9bcd2901f0ea630905917440fe6f9106f0d
Instruction ID: 240f3835e4fc5b7ca16d90a0f08fffd89b4b88f2ad4fc82d493faa009fae9c16
Opcode Fuzzy Hash: 8cd40f0385dd15b0b2f1ccfb929ca9bcd2901f0ea630905917440fe6f9106f0d
Instruction Fuzzy Hash: 301156B0604B409FDB10DF28F9C0B26BBA6EB44304F248A7DD48A4B241D33AE447C6A2

Function 04D233B9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36804f04e6aea3b6112009b8becd0bec1671178dad0d75b2eaa7c01ae329da56
Instruction ID: d7418038ce5e525b6ddc7ec754ed51d6a5059364c2798cfa762e8e272c7069bb
Opcode Fuzzy Hash: 36804f04e6aea3b6112009b8becd0bec1671178dad0d75b2eaa7c01ae329da56
Instruction Fuzzy Hash: B211D376F000198FDB18CAB5D96572EB6A7AFE4208F158829C406D7250DE3CED42CB81

Function 04CA3005 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2093949055.0000000004CA3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4ca3000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad750841807dd6303ee3a838f5fcc01090087d6fa26d19645f251d79ee4af6a
Instruction ID: d169a56813dfe35eba2c97ca8f926fa57d49dd0337eec8cde314ca64b2eb51d7
Opcode Fuzzy Hash: 5ad750841807dd6303ee3a838f5fcc01090087d6fa26d19645f251d79ee4af6a
Instruction Fuzzy Hash: A81160715097C49FE712CF15D894B52BFB4EB46614F08C49BD9898B263C2699809CB61

Function 04CBD005 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2093989839.0000000004CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cbd000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28cceea1251390142fff00fba913c68e90264c9e04b0c419e61a9d060e54d753
Instruction ID: 433947f201215971a78de085ef0f14d259f225ac87b26a7ddb408c1594dba8c1
Opcode Fuzzy Hash: 28cceea1251390142fff00fba913c68e90264c9e04b0c419e61a9d060e54d753
Instruction Fuzzy Hash: AB11A7715097C08FDB13DF24E584755BF71FB42214F2885EBC4898B193C33A954AC762

Function 04CA301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2093949055.0000000004CA3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4ca3000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c993a7fbe37bf9664b7dfe70583d24664775d29a076ec826d5514e9d2d6b65d
Instruction ID: f668603d40f47f3a6c502d4d50ac4b164df3faf2cf29065640bbcea04e7081a3
Opcode Fuzzy Hash: 9c993a7fbe37bf9664b7dfe70583d24664775d29a076ec826d5514e9d2d6b65d
Instruction Fuzzy Hash: C011A071504685DEE710CF5AD984B66FBA8EB44724F04C86AED494B262D37CA804CBB1

Function 04D22CB3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd755ca3480c80b3c2637654744d6f8356d2447a8d2ee4c01b491d24dbee27b1
Instruction ID: 1606230f96e9b683484f0fa6faf67d170f0ff71d999d7ff02385b9e5324d0c3d
Opcode Fuzzy Hash: fd755ca3480c80b3c2637654744d6f8356d2447a8d2ee4c01b491d24dbee27b1
Instruction Fuzzy Hash: CDF03C34A50219CFCF18DFA4D894A9DB7B2FF98304F1089A5D48A9B354EB389D01CF91

Function 04D22C3E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce442f7c3c54f8c04ea66832d770ec507e60156e4ffb8594759c8a76e5cd5ab9
Instruction ID: 8f55689a68be9378dcdd2ab8835e5cf22d11cddb8905c9ab08c0e94d70e0d004
Opcode Fuzzy Hash: ce442f7c3c54f8c04ea66832d770ec507e60156e4ffb8594759c8a76e5cd5ab9
Instruction Fuzzy Hash: C3F03C30A002098FCB08DFB5D994A5DB7B2FF94304F204568D0469B354DB349E01CB81

Function 04D229E3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20307c98f3bb15f881cf094deec57596e89d1880e0becc8412017d86e13b2d9e
Instruction ID: 2deed1313d1d5c8e3fe3639f6dadee3a6cda6ed3f3eecf44d1aef533d8fac909
Opcode Fuzzy Hash: 20307c98f3bb15f881cf094deec57596e89d1880e0becc8412017d86e13b2d9e
Instruction Fuzzy Hash: A2F04F34E10109CFCB18DFB4D994A5DBBB2FF98308F1098A590499B354EB38AD02CF91

Function 04D22DA3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c47aaf83dfacfc86ad9fe108a1765804016079947ea5d7bafe333bb0fbfaf0
Instruction ID: dc2369b6252dd544dd34e2dbac2b0a58d684d146c8ba683866b30c2518ac63eb
Opcode Fuzzy Hash: 40c47aaf83dfacfc86ad9fe108a1765804016079947ea5d7bafe333bb0fbfaf0
Instruction Fuzzy Hash: E0F0FF74A00209CFCB08DFB4E89495DBBB2FF94308F108969D5469B354EB34A941CF91

Function 04D22D2E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf4d49fcd3398378d5c5e56871a11202982baa6edbfcfe746124b0ac8ccb748
Instruction ID: 9d5121b11d227a4c71e88c3f442af532953ce7f7769b1f6633d072c399062e55
Opcode Fuzzy Hash: 2cf4d49fcd3398378d5c5e56871a11202982baa6edbfcfe746124b0ac8ccb748
Instruction Fuzzy Hash: 85F0FF74A002098FCB48DFB4E89495DBBB6FF94304F1189A9D0499B364EB349D41CB81

Function 04D22AD3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69b93fb9a1a6a461f0111adb3a2ed07ddce2ca373dbf71de38428c55851b174
Instruction ID: 1e66fe1dbd61bd197b6a713eab2069b33259d61d457989f7dac7d2c06835e1a0
Opcode Fuzzy Hash: a69b93fb9a1a6a461f0111adb3a2ed07ddce2ca373dbf71de38428c55851b174
Instruction Fuzzy Hash: 77F03C74B002098FCB08DFB4D994A5DB7B2FFA4308F1044A4914A9B359EB78AD02CF81

Function 04D22E8D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb8abed9ae9d5a14aa8a1981f33c191d27b55c327e911d0f0908f1bf59b8873
Instruction ID: b331083cb5cd971b87cd78b8cd35bf0acd23de665d36bc1fdebacb0bcc457244
Opcode Fuzzy Hash: deb8abed9ae9d5a14aa8a1981f33c191d27b55c327e911d0f0908f1bf59b8873
Instruction Fuzzy Hash: 3CF04F34A511198FCB18DFB4D894A5DB7B2FF94308F1085A8D04A9B3A5EB38AD42CF80

Function 04D22E18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbc0d108f629bf7db6811cb3b893cc99dbdcd394a0f04e27433d960259e36fb
Instruction ID: 05e690a02b73e9a7dbdcb81890d5fc4bb47e8f3d87f8da9eb83bf2db47f0edb6
Opcode Fuzzy Hash: 2fbc0d108f629bf7db6811cb3b893cc99dbdcd394a0f04e27433d960259e36fb
Instruction Fuzzy Hash: BBF0FF74A00209CFDB18DFB4E894A5DBBB2FF94304F214968D0499B365EB34A982CF90

Function 04D22BC3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60f68a54ad9c6d2b83bd976614fc1f2e24035308efa817dd5f791ee76cdf342
Instruction ID: fbe1af5da447ce7974f648099732f24cc6fd0dde206eebe18bb423de76d4404f
Opcode Fuzzy Hash: a60f68a54ad9c6d2b83bd976614fc1f2e24035308efa817dd5f791ee76cdf342
Instruction Fuzzy Hash: 41F04474A002098FCB18DF74D894A5DBBB2FF99304F118495D489AB354DF349D41CF91

Function 04D22FF2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e77a90b8a739099909bed6186307634edd44d7d0a551ea4182704a9be16f052
Instruction ID: 468d5ffe80a5955cec0425c43fbc1ea8693258469d67f1c661fdff8ca575209b
Opcode Fuzzy Hash: 0e77a90b8a739099909bed6186307634edd44d7d0a551ea4182704a9be16f052
Instruction Fuzzy Hash: 47F0EC74E402098FCB08DFB4D894A9DBBB2FF99314F108565D44AAB364EB38DD42CB90

Function 04D22B4E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c656d9a2ea7db80efcfaea7bde43c43188aa9d4a01b705735d97aeb03c47cf9d
Instruction ID: 53aace14efc4a27b384a433ca78b98dabd2663c3ce602efb90e819504912ae9d
Opcode Fuzzy Hash: c656d9a2ea7db80efcfaea7bde43c43188aa9d4a01b705735d97aeb03c47cf9d
Instruction Fuzzy Hash: 71F0E774B40209CFCB18DFA4D89495DB7B6FFA5304B1089A9D44A9B364EB38AD46CF81

Function 04D22F7D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3113a936602531830175c4041fa941f041f19f1f3bb836964574351d58cac8ed
Instruction ID: 849bf52c63a4e893751cfcd6df83f28c540448c08effc105b1d345ab1f4ebc32
Opcode Fuzzy Hash: 3113a936602531830175c4041fa941f041f19f1f3bb836964574351d58cac8ed
Instruction Fuzzy Hash: C4F0FF74E4020A8FCB08DFA4D89495DBBB2FFD4304B118565D44A9B365DB389D02CF90

Function 04D22F08 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525a6aa0ea57a91417828812dacf0c02ae229dc534b65e7263c1c12ffbdcf207
Instruction ID: a3855ee78ff38f42ce3ceb42c37cf249adb094a0ee839deee8ad22a56a75f25b
Opcode Fuzzy Hash: 525a6aa0ea57a91417828812dacf0c02ae229dc534b65e7263c1c12ffbdcf207
Instruction Fuzzy Hash: C8F0FF74E402199FCB58DFB4E89495DB7B2FF94304B108569D0469B365EF389D42CF81

Function 04D21F19 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2094109023.0000000004D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4d20000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1d441b1f9d38ce90d286fe84b612948ce70dc69ba4b402c292953a86392ac
Instruction ID: e5052ff8ece8f206dc31056964603f8f34dba0a7c44dd42ccaa0339b7aedb232
Opcode Fuzzy Hash: aeb1d441b1f9d38ce90d286fe84b612948ce70dc69ba4b402c292953a86392ac
Instruction Fuzzy Hash: A4E03970A441099FCB58DFB4E8A4A5D77B7EBF4344F01C965808A9B250EE389D85CB81

Analysis Process: rundll32.exePID: 1628, Parent PID: 1472COMMON

Executed Functions

Function 047E30D0 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

#$y, xrefs: 047E3307

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 0a80a4757f727772700acc322ba8cafd4d6cf3c92a732bfb390b9e8aa14f3619
Instruction ID: 2d4f77f3010fa388fae172fd0e99583094eb62e0e586366034505392e6a796c5
Opcode Fuzzy Hash: 0a80a4757f727772700acc322ba8cafd4d6cf3c92a732bfb390b9e8aa14f3619
Instruction Fuzzy Hash: 0FA11331B101049FC718CB7AD99566ABBE3AFD9204719CA2AD806DB364EE35EC03CB51

Function 047E30FF Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

#$y, xrefs: 047E3307

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 2c4296758394aa84db5709375f4090e48cb51a37b21ad67287655492eb43d5ee
Instruction ID: c20c4e486437ac178da6fbdbafa9d52d33cf1cfaedc0ec8995e8cb7cae773fb6
Opcode Fuzzy Hash: 2c4296758394aa84db5709375f4090e48cb51a37b21ad67287655492eb43d5ee
Instruction Fuzzy Hash: 4491F635B101049FC708CA7ADC95A6ABBE7AFD9304715C62AD806DB364EE35EC03CB51

Function 047E3130 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#$y, xrefs: 047E3307

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 80c993bffafe0fbc538e7fd389d9c55d22547e8c105ebff13af1b56c2a07cc89
Instruction ID: 079226a5454197c650322584bc5c904e4c0d319baa12e43832b3b3ca45a81f46
Opcode Fuzzy Hash: 80c993bffafe0fbc538e7fd389d9c55d22547e8c105ebff13af1b56c2a07cc89
Instruction Fuzzy Hash: BD81D235B201058FC708CA7AD895A6EBBE7AFD8744715C62AD806DB364EE35EC03CB51

Function 047E0C53 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2414aacca799eab70f720b88b8c12b10709ce4a32d05482e51ab5308de30ef42
Instruction ID: 40de3e88a4e9d43c6f849859ba8cb8d6bfaac9945486519a4a3184c0a01e7f00
Opcode Fuzzy Hash: 2414aacca799eab70f720b88b8c12b10709ce4a32d05482e51ab5308de30ef42
Instruction Fuzzy Hash: F8410635B251A18FC30C9772E99E1797BA7BF94304715D92699078B3B2ED34AD03C782

Function 047E0C90 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51483fc6c1140ffefb05d9268b70e5e33c3280afebf0c6d8e4c065636899b063
Instruction ID: 756a944d0da74bec2ef5d5c3fc2a16c96dad2b32e43b1563dcfd183a7d8866a7
Opcode Fuzzy Hash: 51483fc6c1140ffefb05d9268b70e5e33c3280afebf0c6d8e4c065636899b063
Instruction Fuzzy Hash: 77412835B301618FC30CA776E58E2797AA7BFE4714714D9259A078B3B2DD34AC03C686

Function 047E2A7E Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

#PP, xrefs: 047E2A7E

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID: #PP
API String ID: 0-565894853
Opcode ID: 25251cc03815167a2714720182ef2f3fcd755b311e4048c03ddbe9d85ae051aa
Instruction ID: 773742d69815efbfd0733229536c3a5a6b7cd5fb312130ffb65d2ba237497956
Opcode Fuzzy Hash: 25251cc03815167a2714720182ef2f3fcd755b311e4048c03ddbe9d85ae051aa
Instruction Fuzzy Hash: 7EF03C34E102498FCB04DFA5D498A5DBBB2FF84304B00956590469F315DB34A843CF81

Function 047E3538 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dca279f8a848b4c7527402fa4bd5c3587375421001699a0ce050acea7d0ebc6
Instruction ID: cc15bd40666b171158b3e32fbddb9c37c282bd4f48a715bf1fadee6c120d41c2
Opcode Fuzzy Hash: 6dca279f8a848b4c7527402fa4bd5c3587375421001699a0ce050acea7d0ebc6
Instruction Fuzzy Hash: 23517D74B101058FCB48DF69C894A6EBBF2FF8C714B258569E90ADB365DA30AD06CB50

Function 047E3548 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db7d27f762fe0c6bb9c4b75a77e2c3777bb3196a4fe78a3c759121281e47bd8
Instruction ID: f8404ab887a6aa1286cd687078f515854cf877cdcc02439abddc5eb8299716c7
Opcode Fuzzy Hash: 5db7d27f762fe0c6bb9c4b75a77e2c3777bb3196a4fe78a3c759121281e47bd8
Instruction Fuzzy Hash: B8517E74B101058FCB48DF69C894A6EBBF6FF8C714B648569E90ADB365DA30EC02CB50

Function 047E3768 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7070a4d901eedfaaa81f8928ac07578a47b4eb38837702214b347946833048b
Instruction ID: 8d16146d5eb2a126e7e85c07ff91e90ba6edb32a6b08f9d0e8ed6f26d3875ab4
Opcode Fuzzy Hash: e7070a4d901eedfaaa81f8928ac07578a47b4eb38837702214b347946833048b
Instruction Fuzzy Hash: DD21F239B181165FD308CA7ADCD5A7A7BEBEBC9310306C626E405CB355EE34AC038751

Function 047E298E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ead7166d5e4323570b3ee9b9fd474b8697a56195693e6a63a8f59d459ad3476
Instruction ID: c42713e24afaee9880e4f621fc208ea0f42e3dd6ed8f5272041870a192222aac
Opcode Fuzzy Hash: 7ead7166d5e4323570b3ee9b9fd474b8697a56195693e6a63a8f59d459ad3476
Instruction Fuzzy Hash: 54214F74F102098FCF58DFA9D895A6DBBF2AF8C304B109569D00AEB355DA34A906CB41

Function 0467D01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2152167650.000000000467D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0467D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_467d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7e0ab298045b8b2c6f90159ce6b44abad5ebadec54630d69347c25c39fded5
Instruction ID: 570e4d218886d18908449bb078d6bfb44a26f835581607de5858baa6ee6e2a04
Opcode Fuzzy Hash: ae7e0ab298045b8b2c6f90159ce6b44abad5ebadec54630d69347c25c39fded5
Instruction Fuzzy Hash: BE11E2B16443449FDB24EF28E984B26BFA9FF94314F208E6DD5494B341E33AE447C662

Function 047E33D9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19faebbf882c8335443e3ec63d0c47343b51beac186bcc00596358e6503af28a
Instruction ID: ec62498fdfae6b3f9c1f45cc8f7d71f1742800abd495247b89b158caf4657751
Opcode Fuzzy Hash: 19faebbf882c8335443e3ec63d0c47343b51beac186bcc00596358e6503af28a
Instruction Fuzzy Hash: 8211B175B101058FDB149AB6D865B7DBBE3ABD8208F15892AC40A9B790DE38DC43CB81

Function 04663006 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2151464476.0000000004663000.00000040.00000800.00020000.00000000.sdmp, Offset: 04663000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4663000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0892e72c7beb5131b84ec5410a178198247004c7f35b28206c17f7a8df534366
Instruction ID: b6402efa973eba43a65591db7c225fb1640af2c10ff9093cf8c75f283a452b29
Opcode Fuzzy Hash: 0892e72c7beb5131b84ec5410a178198247004c7f35b28206c17f7a8df534366
Instruction Fuzzy Hash: 5E118F711097C09FE712CF15D980B12BFB4EB46614F08849BE9898F3A3D379A849CB72

Function 0466301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2151464476.0000000004663000.00000040.00000800.00020000.00000000.sdmp, Offset: 04663000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4663000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f08a953181bd3f4e07a9926b516610951b2f4739c348a6b45843b4a1599a1b
Instruction ID: 04c110f900b7ab6a47e94a2d829a82de4b5c467008c7240c971b8e0b9e55a1d0
Opcode Fuzzy Hash: 93f08a953181bd3f4e07a9926b516610951b2f4739c348a6b45843b4a1599a1b
Instruction Fuzzy Hash: F411C271104644DFD710CF1AD984B26FBE8EB94B20F04C82AED4A4B352E37DA849CBB1

Function 0467D006 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2152167650.000000000467D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0467D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_467d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e0b1106d5e64b4113c68aec9ca795dd73084d9d4491a51d0ce6a2b3de8b383
Instruction ID: 865cade7a7fd8dfe96615c4010842d1fa57e42fc5bb826ad9451cf96a202023c
Opcode Fuzzy Hash: e4e0b1106d5e64b4113c68aec9ca795dd73084d9d4491a51d0ce6a2b3de8b383
Instruction Fuzzy Hash: D111A3715093C08FDB13DF24D584715BF71FF52214F288AEAC4898B293D33A944AC762

Function 047E2C5E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e9f0a9615b075d0f8ce20545c8e7aaf150d8c53fadbafeeaea9692a386cb78
Instruction ID: 12bc415a25282fbd5652c23a93452a4fd448c88149420521303d67176cb0d299
Opcode Fuzzy Hash: f1e9f0a9615b075d0f8ce20545c8e7aaf150d8c53fadbafeeaea9692a386cb78
Instruction Fuzzy Hash: 2DF0EC74E102099FCB04DFB5E998A5DBBB2FF94304F115669D046AB355DB349D02CB81

Function 047E3012 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2294b5de3fb87ad06adafe225adaa827a9b7e9a860d64187a55654b6c0892f68
Instruction ID: 7f2636201f74168bd4d4fb1f42528c3899c21c10b9b0d5b6e3a476e80867e906
Opcode Fuzzy Hash: 2294b5de3fb87ad06adafe225adaa827a9b7e9a860d64187a55654b6c0892f68
Instruction Fuzzy Hash: FAF03C34E102098FCB04DFB4D494A9DBBB2FF88304F009565D00AAB364DB349842CB50

Function 047E2CD3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993f276d9112974eb4c69df9f971562af5f7ca8e17572146ac0f1934028d5c7d
Instruction ID: 3e48ef18cafd6ca9cc8d8e80d80fafa8d83412bef833d2cb57b17a2d1788d51a
Opcode Fuzzy Hash: 993f276d9112974eb4c69df9f971562af5f7ca8e17572146ac0f1934028d5c7d
Instruction Fuzzy Hash: A9F01D34A202198FCF04DF65D898A5DB7B2FF88304F009995D1469B354DB349D02CF91

Function 047E2D4E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 102b4e8d9b90ace465ed62d6750e96c8ce85c869bcf5e4bd9f063672fe624e3b
Instruction ID: 999abda44f6f1cebca8ee66be2beb21f9c9d514d94b16abd0290ca24a6351b87
Opcode Fuzzy Hash: 102b4e8d9b90ace465ed62d6750e96c8ce85c869bcf5e4bd9f063672fe624e3b
Instruction Fuzzy Hash: E2F0FF74A103098FCF44DFB4E89895DBBB6FF88304B1199A9D00A9B364EB349C42CB41

Function 047E2DC3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8600ebd08963feb2473d7bb31e635b4f2c699c616e38fa1e07c6a664445abaac
Instruction ID: f275e5859dd8e8be8c8e8ec6fc5eda8cb2c084302e00f3b4024ef4b802162da9
Opcode Fuzzy Hash: 8600ebd08963feb2473d7bb31e635b4f2c699c616e38fa1e07c6a664445abaac
Instruction Fuzzy Hash: 4BF0FF74E10209CFCB04DFB4E89995DBBB2FF84308B109969D1069B354EB34A942CF81

Function 047E2E38 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b4d1e17bd2f885d116e95b4d575166d0c27574811c127d98e0e468a682cd65
Instruction ID: e7ff392b202e3e2fe72f9d33bfc9c8389c2c5d5ff1f907942bb278c2fe0c48ee
Opcode Fuzzy Hash: 05b4d1e17bd2f885d116e95b4d575166d0c27574811c127d98e0e468a682cd65
Instruction Fuzzy Hash: 83F0FF74A10209CFDB14DFB4E895A5DBBB2FF84304F119AA9D04A9B355DB34A842CF80

Function 047E2A03 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee68249247c80a2244749214bc2a95c911565fea99506c512f624eabb7340fb8
Instruction ID: 64ebcf720647d79a9b86b3ca79e97e13c675cf714d9eb03ef16b0a71a46b9024
Opcode Fuzzy Hash: ee68249247c80a2244749214bc2a95c911565fea99506c512f624eabb7340fb8
Instruction Fuzzy Hash: BDF0FF74E202098FCF14DFB4D995A5DBBB2FF98308F1099A5914A9B355EB34AD02CF41

Function 047E2AF3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cc57b3c5662d395b95860f98893cd6e2a6614f3ef687e06d635d0ece821a0b
Instruction ID: 7c3a7766da82e3a9a16c1c50edfd9c7c90d83054c138dcf5ac10b75f07678a00
Opcode Fuzzy Hash: 43cc57b3c5662d395b95860f98893cd6e2a6614f3ef687e06d635d0ece821a0b
Instruction Fuzzy Hash: F8F03C74B102098FCB04DFB4D999A5DBBB2FF84308F0055A5914A9F359DB74AD02CF81

Function 047E2EAD Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fe9ac91aec83af54de96a930609806183405da1d8615430771a37e84cbf0c1
Instruction ID: 646ed265ad52bde835d46ee94ff1483924521b245ebf86fc0745eb94f0ddf4e3
Opcode Fuzzy Hash: e8fe9ac91aec83af54de96a930609806183405da1d8615430771a37e84cbf0c1
Instruction Fuzzy Hash: 85F04434E212098FCB14DF74D895A5DB7B2FF84304F0095A5D0099B355DB349D02CF40

Function 047E2B6E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3431fa8a2c85a3a7e6bf767c723109b0860f4c2ce32441d1369400a323f499e
Instruction ID: c92b12d92bb6dd75806bf702eacaffbe41357a7cfa37c38af32f21789deb91a3
Opcode Fuzzy Hash: b3431fa8a2c85a3a7e6bf767c723109b0860f4c2ce32441d1369400a323f499e
Instruction Fuzzy Hash: 4AF01934A103098FCB44DFA4D89995DBBB6FF85304B0099A5900A9B354DA349C02CB81

Function 047E2F28 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d805e02c209d6e625ab1f06f20d7c32f9e2636750fb899476822f4767e6ae4
Instruction ID: 7f9141bb323f417b83a2852c885b84532d0eb76a67dca9d86a82c500ebfe06bb
Opcode Fuzzy Hash: c3d805e02c209d6e625ab1f06f20d7c32f9e2636750fb899476822f4767e6ae4
Instruction Fuzzy Hash: 28F0EC74E102099FCB48DFB4E89995DBBB2FF94304B109569D0469B365EF349942CF40

Function 047E2BE3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2009ef2cce95f7dc78a500fb1ea5d8d93321faaa82ef41dce312b65086151b7
Instruction ID: 6ce316674e04189480c8b3523182afad4f9b61e79a89e34404b1ffb7e7d68048
Opcode Fuzzy Hash: d2009ef2cce95f7dc78a500fb1ea5d8d93321faaa82ef41dce312b65086151b7
Instruction Fuzzy Hash: 50F04F74A102098FCB44DF74D898A9DBBB2FF88308F1195A6D04AAB354DF34AD42CF81

Function 047E2F9D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e030b7a5482340d3a1c645dcf7f9a4563628bf7e3a082fc1700856d6b7decad3
Instruction ID: a0c461fbae4d72f556ecaa6cd0e85bb5bfa3c204064311ad10eee0957ade961c
Opcode Fuzzy Hash: e030b7a5482340d3a1c645dcf7f9a4563628bf7e3a082fc1700856d6b7decad3
Instruction Fuzzy Hash: 09F0FF74E1020A8FCF44DFA5D89895DBBB2FF88304B119565D40A9B365DA349D03CF80

Function 047E1F39 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2154397740.00000000047E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_47e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81b0fb39aa067310d290cdb4b8b43be09119d01305dcd63e5eff70749cfabe1
Instruction ID: 3fff4bf4fd5bf1ec5167bc3a881cd939fd79f1a36ceb02423904625a72b2e942
Opcode Fuzzy Hash: e81b0fb39aa067310d290cdb4b8b43be09119d01305dcd63e5eff70749cfabe1
Instruction Fuzzy Hash: E2E0A070A242018FCF08DF71E89565E7BB6EF94340F009965800A87350EE349887CB81

Analysis Process: rundll32.exePID: 7060, Parent PID: 1472COMMON

Executed Functions

Function 006B3120 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#$y, xrefs: 006B32F7

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 482039ca073c3eab94538525392e488de1eef1be8cbadf774b09528c1877f2d2
Instruction ID: 5a6e39e8e14275239753d5746937fbedb4dbc2175fb35332cbf8c5019356802f
Opcode Fuzzy Hash: 482039ca073c3eab94538525392e488de1eef1be8cbadf774b09528c1877f2d2
Instruction Fuzzy Hash: 4A811375F110258FC708CB78EC9666ABAE7AFD8310729C52AD406DB3A4DE34DD42CB60

Function 006B0BC1 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f6165d2421cabcd5273482a58f80edb0d18228b20e78dd1ee0a01330ed64d9
Instruction ID: c7b0e9bc7d5d6ee29d39cfb2dd3dc16fa6c9922fbbb0950dea0533f3459bc623
Opcode Fuzzy Hash: a9f6165d2421cabcd5273482a58f80edb0d18228b20e78dd1ee0a01330ed64d9
Instruction Fuzzy Hash: BE514572B151608FD30D9738E9A90A63F67EFE131432581A6D8428B1B7CF388C47C7A6

Function 006B0C90 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c727f8bbd0655dca88e364c10cf7cdf1b51bf01d89f5516a3083316bb81889f9
Instruction ID: abfd7b856a7432d9dc71a24d883d9425e24c6c4ae2c32b570921feb1bcbb88a2
Opcode Fuzzy Hash: c727f8bbd0655dca88e364c10cf7cdf1b51bf01d89f5516a3083316bb81889f9
Instruction Fuzzy Hash: D731D376B10011CFD34CA734E98A16A3E97BFE0314775D5259847872E6CF389C428796

Function 006B2A6E Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

#PP, xrefs: 006B2A6E

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID: #PP
API String ID: 0-565894853
Opcode ID: 2f278b8d2ba82cfed6ef2afd699fb6167d4936c0fe781ddb837ec8a1c6123d7f
Instruction ID: ac4ab0592f926515fd61fba3307e0b1ebefdd7989cce87f37e2bde0e88894a11
Opcode Fuzzy Hash: 2f278b8d2ba82cfed6ef2afd699fb6167d4936c0fe781ddb837ec8a1c6123d7f
Instruction Fuzzy Hash: 9AF03774E002498FCB04DFA4E898A9DBBB6FF94304B10896894469F358DB34A846CF91

Function 006B3528 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546cfc35211a8fe4e3a9dc21fc52a320a73ac4227193b07995ff1e8349bddf5e
Instruction ID: 3f395d44bde991c9a7844a448e50dd0f471904439875ff94dfff361e360557aa
Opcode Fuzzy Hash: 546cfc35211a8fe4e3a9dc21fc52a320a73ac4227193b07995ff1e8349bddf5e
Instruction Fuzzy Hash: D6515D74B001158FCB48DFA9D895AAEBBF3FF88710B648069E506DB3A5DA30DD05CB61

Function 006B3538 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a0b165a7a4282767c89f610ad7da81d92fea4160bffe8ef958db2e2809785c
Instruction ID: 7f11a5033e7db39affeb88e9560f82c1372642bf6a0c10903ad1e0d44edeca4d
Opcode Fuzzy Hash: 86a0b165a7a4282767c89f610ad7da81d92fea4160bffe8ef958db2e2809785c
Instruction Fuzzy Hash: 92517C74B001158FCB48DFA9D895AAEBBF3FF88710B648469E506DB3A5DA30DD06CB50

Function 006B297E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd69c3ebb119ea3c9963f93cfb29496714a865651a311af6bf37223fce54b78
Instruction ID: c29720b028e0abe35cfefff890c7fdb1bbb560d7e5f85a63ab521db0e955ccf6
Opcode Fuzzy Hash: 2cd69c3ebb119ea3c9963f93cfb29496714a865651a311af6bf37223fce54b78
Instruction Fuzzy Hash: 76218E74F0020A8FCF58DFA9D8A4A6DBBF2AF98310B109569C00AEB395DB349945CF51

Function 0063D01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2147016207.000000000063D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0063D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_63d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2703b7f4220e5b7703a1c3ac81db31d1363ca1246aa29a25efedce06b709340f
Instruction ID: ac4a28036cb02d53cfbbdce303a1d4327a749c0e31da5366f932fd6ce6d793d0
Opcode Fuzzy Hash: 2703b7f4220e5b7703a1c3ac81db31d1363ca1246aa29a25efedce06b709340f
Instruction Fuzzy Hash: AB1126B09443449FDB18DF24E984B26BBA6EB54B04F208A6DD5094B341C33AD847C6A2

Function 006B33C9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a41ff47132cd93b6dfc2c0eee6e33f96ff2ccb0fa9be04210abd7f2b6b8712
Instruction ID: 3566aab0170e3de3598bccb0254c89f50741f634987bd5299e9ef7c44520eb94
Opcode Fuzzy Hash: 81a41ff47132cd93b6dfc2c0eee6e33f96ff2ccb0fa9be04210abd7f2b6b8712
Instruction Fuzzy Hash: 2B1196B5F00025CFDB149B74EC5676E7AE3AFD4648F198825C0069B7A0DE38DD82CB51

Function 00623006 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2145243620.0000000000623000.00000040.00000800.00020000.00000000.sdmp, Offset: 00623000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_623000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4381f996648134862b1a0667c943fb32e73df48afd033347b43258659b63aeda
Instruction ID: f20a11994f5b1361db1d3865f336deda1151fcf2f3d60803776e6f6fe40fb0aa
Opcode Fuzzy Hash: 4381f996648134862b1a0667c943fb32e73df48afd033347b43258659b63aeda
Instruction Fuzzy Hash: 99115E711087C09FD712CB15D880B62BFB4EB46710F09849AD9898F762C37C9805CB72

Function 0062301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2145243620.0000000000623000.00000040.00000800.00020000.00000000.sdmp, Offset: 00623000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_623000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071b603e46029c717c4aff404797c2f98e932de823c13bd23fc19bcd8370c3fa
Instruction ID: bf45f5769a65ca69a57c3fbc9f014f1f920f4e7475111bd590cc6be8011f6dbb
Opcode Fuzzy Hash: 071b603e46029c717c4aff404797c2f98e932de823c13bd23fc19bcd8370c3fa
Instruction Fuzzy Hash: 9F110271104B50DED710CF09E980F66FBE8EB44B20F14C82AEA494B302C37C9805CBB2

Function 0063D018 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2147016207.000000000063D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0063D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_63d000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf38ae397bdc74a015bfb43cc1f46acfaac3eba8ba4415a8f29e01cb0ff179b
Instruction ID: fb29e94388df554050a65eeb703fff8398c018ae26198166177d56ea5e6bd26b
Opcode Fuzzy Hash: ebf38ae397bdc74a015bfb43cc1f46acfaac3eba8ba4415a8f29e01cb0ff179b
Instruction Fuzzy Hash: 660122B1804780CFDB15DF24E5C4B15BFA2FB50714F208AA9D8494B342C33AD84BCBA2

Function 006B2C4E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe6ab9f0b033bd475134a3f7172051560f2b51a7b51f7d58a47f368944f5845
Instruction ID: e9f6fd5e06c5965d6b10d0085f2901dda88706af3b1a109b9504998bda8335f7
Opcode Fuzzy Hash: ffe6ab9f0b033bd475134a3f7172051560f2b51a7b51f7d58a47f368944f5845
Instruction Fuzzy Hash: 6EF03C74E01209CFCB04DFB5E998A5DBBB2FF94304F204968D0069B354DB349D41CB91

Function 006B3002 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee64625dbd009411802d0dc27cc46cefb013ffae85a9c45892e124774d009ff
Instruction ID: 7306fb655b5914911f82aeebfbf4d61f2fbf6ef52989aa549fb7f465ee30e2c3
Opcode Fuzzy Hash: bee64625dbd009411802d0dc27cc46cefb013ffae85a9c45892e124774d009ff
Instruction Fuzzy Hash: 03F0EC78E002058FCB44DFB4E498A9DBBB2FF99304F108965D40AAB364DB349C42CB90

Function 006B2CC3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24cbf2ebbeb087fe6cb588b78780b0cd597d70f5edceffc0cd650b03b9ac48f0
Instruction ID: 8d829bb17136ee42fed4acef9e8c2ed53b56dcdb3fb13a4ebe4022b51bad79c2
Opcode Fuzzy Hash: 24cbf2ebbeb087fe6cb588b78780b0cd597d70f5edceffc0cd650b03b9ac48f0
Instruction Fuzzy Hash: 54F01974E10215CFCB04DFA4E898A9DBBB2FF98304F1089A5D44A9B254DB349D41CFA1

Function 006B3093 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffc07d6c5f1efe5a9a8911e3682de9a79f8462a4f3cae4019658d39c1b1feb1
Instruction ID: e0405434d57e73145d30694cb52c1542e0e547b973b48d6987f8e73d4dd1bf78
Opcode Fuzzy Hash: 7ffc07d6c5f1efe5a9a8911e3682de9a79f8462a4f3cae4019658d39c1b1feb1
Instruction Fuzzy Hash: CFF06275E10205CFCB04DFA8E58568DBBB6FF68310F108655C006AB264D7349941CB60

Function 006B2D3E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc277a1deb7e74f8862d0e78059ac6a054f0b31f3d25d0fbc763ee826f10562a
Instruction ID: 895768131134977bbc4f60f18f08febd6dec4adbeef3312890252c18a5adfa71
Opcode Fuzzy Hash: bc277a1deb7e74f8862d0e78059ac6a054f0b31f3d25d0fbc763ee826f10562a
Instruction Fuzzy Hash: DAF0FF74E10309DFCB44DFB4E89895DBBB6FF98304B118969D0099B364DB349C41DB91

Function 006B29F3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0adbf7c4e5b6a43e90a5e4894b80973277cb17767642059ca2cfd80f6d796e6e
Instruction ID: a3ea87880a3a645b37b2fa55eb1a0366a6d8ae4eda18693967cc2def2e6dacab
Opcode Fuzzy Hash: 0adbf7c4e5b6a43e90a5e4894b80973277cb17767642059ca2cfd80f6d796e6e
Instruction Fuzzy Hash: 07F0FF74E11109CFCB14DFB4E999A5DBBB2FF98304F1088A594499B354DB34AD42CF91

Function 006B2DB3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8768fa9ada44012fea7db41af38f558fe82413a3db5ee802487cffec9a26eb40
Instruction ID: 3f8770af3be87516c47a006785d2efe0adc4e08db7ccc95ea1dc7766cc76cf81
Opcode Fuzzy Hash: 8768fa9ada44012fea7db41af38f558fe82413a3db5ee802487cffec9a26eb40
Instruction Fuzzy Hash: 0BF0FF74E10205CFCB04DFB4E89999DBBB2FF94304B108969D4069B354EB349945CF91

Function 006B2E28 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7042abae9962293a244d86bf7a20dec1fb7f63b379bfa6f4ffa5c893d099d2
Instruction ID: 2552b258a3961c882260cf5c4546652d1dad8b65b83523dd61e1cb7f21f58d36
Opcode Fuzzy Hash: ed7042abae9962293a244d86bf7a20dec1fb7f63b379bfa6f4ffa5c893d099d2
Instruction Fuzzy Hash: FAF0FF74E01209CFDB14DFB4E898A9DBBB2FF94304F114968D009AB395DB34A842CF90

Function 006B2AE3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294f3509f106331a20e386d9b7927718a1fcfaf448f13b148379cb1e8a11434e
Instruction ID: f733ab1bc62121e7719f0a8e50145ce45990c4ec269c797c67e396265cb79fce
Opcode Fuzzy Hash: 294f3509f106331a20e386d9b7927718a1fcfaf448f13b148379cb1e8a11434e
Instruction Fuzzy Hash: 7DF01974A012498FCB04DFA4E998A9DBBB2FF84308F0049A4900A9B259DB749D42CB91

Function 006B2E9D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f070d54d3c4307cd5724f07aa234f5b9f891ff94ca0bc445b2e0d899d48ac827
Instruction ID: e24265b7e978ac670d972180c4ef8c848060f6ff82d6bd55ba4101019dcca0d9
Opcode Fuzzy Hash: f070d54d3c4307cd5724f07aa234f5b9f891ff94ca0bc445b2e0d899d48ac827
Instruction Fuzzy Hash: 35F04F74E112158FCB14DFB4E899A5DBBB2FF98308F0089A8D4099B394DB349D42CF90

Function 006B2B5E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292d33a18de3bfa8611ffa7a63f6a543cba9f3501e635001227235fa82590090
Instruction ID: f36283ad0799960075fbfe4227a172e07ebd0a455bdc099dff702479d289dbae
Opcode Fuzzy Hash: 292d33a18de3bfa8611ffa7a63f6a543cba9f3501e635001227235fa82590090
Instruction Fuzzy Hash: 0FF01474E00209CFCB44DFA4E89899DBBB6FF95304B108969940A9B3A4DB349C46CB81

Function 006B2F18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc732936b512c382b340f4195b93dae4d1fcc0cacde040a18098beb838edbcc
Instruction ID: bd94151fea4507bce2b5c52741c8ce94b6273c6794668d9e16bdf02f2c5c8283
Opcode Fuzzy Hash: 6cc732936b512c382b340f4195b93dae4d1fcc0cacde040a18098beb838edbcc
Instruction Fuzzy Hash: 1DF03C74E01205DFCB48DFB4E89895DBBB2FF94304B108968D0059B3A5DF349842CF80

Function 006B2BD3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d6287ac9ae889baef7a22f1a577390a5c9c0060bc387a777c511fb2a84db4e
Instruction ID: cc2f65a94f98ddfefb409a06fd80ff3d1eae9562348c5e21dd768bb3d63cf84f
Opcode Fuzzy Hash: a7d6287ac9ae889baef7a22f1a577390a5c9c0060bc387a777c511fb2a84db4e
Instruction Fuzzy Hash: 21F01974E002058FCB44DF64E898A9DBBB2FF99304F1188A5D44AAB254DE349D42CF91

Function 006B2F8D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437c3663dc55efeb773d9fb51a76e04e3c8bf98dc4a64c433faee5f184b6d2bc
Instruction ID: 32f7e4ea59a82143a088da7f6c2cbf0acf4d1e204989ba0ea874e218bde68f1c
Opcode Fuzzy Hash: 437c3663dc55efeb773d9fb51a76e04e3c8bf98dc4a64c433faee5f184b6d2bc
Instruction Fuzzy Hash: 12F0FF74E0120ACFCB04DFA4E89895DBBB2FF94304B118965D40A9B364DB389D42CF90

Function 006B1F29 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2148379961.00000000006B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5593fcbb7265d08b4142ad66cc216c1e4e6207aba0be301e9dfda696fee2c13
Instruction ID: 48ca61170fc64b8ff7b7c77d8a4cc630e3f41261c3f9912250ce49b26419c83a
Opcode Fuzzy Hash: a5593fcbb7265d08b4142ad66cc216c1e4e6207aba0be301e9dfda696fee2c13
Instruction Fuzzy Hash: E8E0A070A151019FCB48DF74E8A96597BB7EFA0340F008864900A8B290DE345885CBA1

Analysis Process: rundll32.exePID: 1576, Parent PID: 1472COMMON

Executed Functions

Function 009430B1 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

#$y, xrefs: 009432E7

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: f57fe692abdc91b08467b81dd5c405c53266804771a6641a4676345cb293ae85
Instruction ID: a7c478054c01fc0bfbff602f5e371017fbc1fd21b8187d3cdd69fc89cee33192
Opcode Fuzzy Hash: f57fe692abdc91b08467b81dd5c405c53266804771a6641a4676345cb293ae85
Instruction Fuzzy Hash: 09A13735B240058FC708DB78DCA2A6ABFE3AFD9604719C92AD406DB7A5DE34DD42CB41

Function 00943110 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#$y, xrefs: 009432E7

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 6982f81fe8f1a0375023afeb59bc5c9c799181a7645b516cd4dd30ea9cf7a162
Instruction ID: 091f5fdbd88e51418d07c46dd309332725a626373cd42af1d3ae993f72004c2d
Opcode Fuzzy Hash: 6982f81fe8f1a0375023afeb59bc5c9c799181a7645b516cd4dd30ea9cf7a162
Instruction Fuzzy Hash: 37810636B200099FC708DB79DCA2A2ABBE7AFD8744725C926D406DB764DE34DD42CB41

Function 00940C58 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cd5fbe8fa8d9f682a3643ed89ca9858a37ae86f238bdef7461b92b05ed392f
Instruction ID: 15f8548f3dfa0dd13b013a9568d2f7e92c2cd2fb6cc2c14387912384864d2c42
Opcode Fuzzy Hash: 57cd5fbe8fa8d9f682a3643ed89ca9858a37ae86f238bdef7461b92b05ed392f
Instruction Fuzzy Hash: 61410635B24106CFD30C9734D9E6A293B97FBE0715725DB25A647872A2CD389C42CB86

Function 00940C27 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93627945325c78e1a532854d09ab7136576dc6cfdc10aa3ebf3ae36d28f9b18
Instruction ID: ca5ef8b956294431cb5fcf64826b86606534449f60fed51626d557908df2c22b
Opcode Fuzzy Hash: a93627945325c78e1a532854d09ab7136576dc6cfdc10aa3ebf3ae36d28f9b18
Instruction Fuzzy Hash: D7414836724106CFD30C9730D9E6A293B97FFE0716725DB25A687872A2CD389C42CB46

Function 00940C90 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a041fd32fafa5a66e0cd37536225c341035f2ce6bb866d5430d7b0f8f99301
Instruction ID: 71f287b19c687219ce1c1c27476104e958e44330f3f54a72cfe402ac70b6cbad
Opcode Fuzzy Hash: 12a041fd32fafa5a66e0cd37536225c341035f2ce6bb866d5430d7b0f8f99301
Instruction Fuzzy Hash: 3031E835724006CFD30CA774D9E6A293BD7BFE0716725DB25A64B872A2CD389C41CB86

Function 00940C4A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0b7fb8810e539da89b284582fb11b78cda54eaa9e42ee1d73fedd4eeecb952
Instruction ID: 0c25de83f2100476bcbfdca9db8a2343854493e9d3c5320401ebb87a286b9703
Opcode Fuzzy Hash: 5d0b7fb8810e539da89b284582fb11b78cda54eaa9e42ee1d73fedd4eeecb952
Instruction Fuzzy Hash: 96313B36B24002CFD30C9734D9E6A293BD3BBE0716725DB259647872A2CD389C41DB45

Function 00942A5E Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

#PP, xrefs: 00942A5E

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID: #PP
API String ID: 0-565894853
Opcode ID: 0a3a12374e8beacfb2a0df6d3bc8d0236db3a317427c016ab8ad0fce3170c90d
Instruction ID: ae185fd548d444910581bd1d2dd7f395ab04136d60dfdbc398621712d8b33971
Opcode Fuzzy Hash: 0a3a12374e8beacfb2a0df6d3bc8d0236db3a317427c016ab8ad0fce3170c90d
Instruction Fuzzy Hash: 5AF0E774F002498FDB04DFA4D8A4A9DBBB2FF94304B11996990569F358DB38A846CF81

Function 00943518 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b24eff49ff40b7ba3a892a6b1163c5b1488e6f793af4912d86d624b2c9ba54
Instruction ID: e967c1877daf492aa3a8056280b3634c6403baf533c0a5e55bfe7480deefa0a2
Opcode Fuzzy Hash: a5b24eff49ff40b7ba3a892a6b1163c5b1488e6f793af4912d86d624b2c9ba54
Instruction Fuzzy Hash: FA516B74B101058FCB08DFA9C895A6EBBF2FF89710B2484A9E50ADB365DA349D02CB51

Function 00943528 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b4191fbbc6c035108cc390b5a5ecf886e8a7f9c05a48fe9a3967c2446b77e2
Instruction ID: 04303c5791ea620598e428943915802311ea0ae772db30efde6aef6a4ad7dd79
Opcode Fuzzy Hash: 71b4191fbbc6c035108cc390b5a5ecf886e8a7f9c05a48fe9a3967c2446b77e2
Instruction Fuzzy Hash: CD516974B101058FCB08DFA9C895A6EBBF2FF88710B64C569E50ADB3A5CA349D02CB51

Function 00943749 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c64685b822874e1542f3c7877ce4ccc98ff02f65e5bc05fd55d5ee5fc2d3ab4
Instruction ID: 4422fc184c5eb4ab7628e7f7732ae8aba369d9a9f91ad574a681e85809fa8cdc
Opcode Fuzzy Hash: 6c64685b822874e1542f3c7877ce4ccc98ff02f65e5bc05fd55d5ee5fc2d3ab4
Instruction Fuzzy Hash: 3921297AB141459FE304CB79DCA196BBBEBABC6310715C426E409CB365DF349E01C711

Function 0094296E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d83bb939ac34980f14b3423a8fdcc12d10acc79d23f8229fe5e5cf451c17e2
Instruction ID: 264a5876e4281971d9636d6fbd98ed69d5ea2069e0a1950260a511f14d423b5f
Opcode Fuzzy Hash: 26d83bb939ac34980f14b3423a8fdcc12d10acc79d23f8229fe5e5cf451c17e2
Instruction Fuzzy Hash: 69217F74F001098FDF18DFA9D8A4A6DBBF2AF88300B109569D00AEB355DF349945CF41

Function 008AD01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2148687552.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7e979b1290d7f23ab835e5eea289565b0a958a457ec08347d8db0aff0c53b9
Instruction ID: a76e9322d1aa6b37a6dfe6dcf7e64c7a981ae908114217062ab6978644c48f50
Opcode Fuzzy Hash: fa7e979b1290d7f23ab835e5eea289565b0a958a457ec08347d8db0aff0c53b9
Instruction Fuzzy Hash: BF1156B0504B449FEB10DF24D984B26BF94FB45308F208A6DD50ACBE41C33AD847C662

Function 009433B9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a074cd6ede46cfe32fc599d1c7c89a538437c8a4963aed8bd66db114b7c3a1d
Instruction ID: 5d3f0101b244161b04e2d77d1699bdd41aad8960572a1fcf671f61a26e15b06f
Opcode Fuzzy Hash: 2a074cd6ede46cfe32fc599d1c7c89a538437c8a4963aed8bd66db114b7c3a1d
Instruction Fuzzy Hash: C711D376B100098FDB149B74DC66B6EBAE7ABD4708F15C929D006976A0DE38DE42CB41

Function 008AD006 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2148687552.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8ad000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473a5acaf559757690a2b45004560291521442cd04e4f7c3f3dc1f5750a3de16
Instruction ID: dbcb26068217593d52946ef9b5a5fafaa1075f1d8bb2cc2c292215dc770ec671
Opcode Fuzzy Hash: 473a5acaf559757690a2b45004560291521442cd04e4f7c3f3dc1f5750a3de16
Instruction Fuzzy Hash: CC1193714087C08FDB13DF24D984715BF70FB56214F1585EAC585CBA93C33A984AC762

Function 0088301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2147972092.0000000000883000.00000040.00000800.00020000.00000000.sdmp, Offset: 00883000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_883000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a3b3918a4ec199087a825a08d7655cbb0a578ba46c8c0364a54aa0cf70182a
Instruction ID: 448f4c4d0db51fe23c802d5e59f010769245615732a698580c80ea68e5a85084
Opcode Fuzzy Hash: 95a3b3918a4ec199087a825a08d7655cbb0a578ba46c8c0364a54aa0cf70182a
Instruction Fuzzy Hash: 61110271104A44DEE710DF0AC980B22FBE8FB44B24F14C82AE9098B302C37C9804CBB1

Function 00943069 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac044301f89c5e3844275a490b663c44197c164e3dc20cdbddb8984828587b4
Instruction ID: 2ced51d101fcd6aac968f56a4645027380f0366f21044c24a07efac5dbd552c8
Opcode Fuzzy Hash: dac044301f89c5e3844275a490b663c44197c164e3dc20cdbddb8984828587b4
Instruction Fuzzy Hash: 17118635F102498FCB04DFA4E49599DBFB1FF58300F608A6AD0469F325DB349942CB91

Function 00883018 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2147972092.0000000000883000.00000040.00000800.00020000.00000000.sdmp, Offset: 00883000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_883000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2bc428aa3cd4d46811aa97dc3144cf432d210bca880b6cc484fdac55dc16cb
Instruction ID: e97c3539e7f45a8d66a7dbe77888002ebffd318a93073d9e4d8f6e83dc5579c1
Opcode Fuzzy Hash: 2f2bc428aa3cd4d46811aa97dc3144cf432d210bca880b6cc484fdac55dc16cb
Instruction Fuzzy Hash: 91019675104680DFE715CF0AD984B62FBE8FB84B20F14C85EE9498B752C3799845CBB1

Function 00942CB3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9801b507fb104d36c624530c6bc66d092204755f173832a041e74bcc910f32e6
Instruction ID: d64c168d32fcae30f76712ba2d3304724d1715110dbc4cdd6efd598ce2a83c98
Opcode Fuzzy Hash: 9801b507fb104d36c624530c6bc66d092204755f173832a041e74bcc910f32e6
Instruction Fuzzy Hash: D3F03C74A10219CFDF04DFA4D894A9DBBB2FF88304F1089A5D04A9B364DB389D41CF91

Function 00942C3E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4569d8ab276785431e5ef9a3381160d861d6c51dfd2e745b3db6e078f0e7a116
Instruction ID: 2565006455bd4bc6d22984dd86483da251a306e90cf6306b86f7268ecfb086e9
Opcode Fuzzy Hash: 4569d8ab276785431e5ef9a3381160d861d6c51dfd2e745b3db6e078f0e7a116
Instruction Fuzzy Hash: F3F03774A002098FDB04DFB5E994A5DBBB2FF94304F218A699006AB364DB34AD42CB81

Function 00942DA3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa377de910f6090aae95fd10d9a88c39eddac7ac094e68f9052e0643c577431
Instruction ID: f462eb7bb5ab58154ceb4e75a0a6003351ac7675d437cba326737ed32b665003
Opcode Fuzzy Hash: afa377de910f6090aae95fd10d9a88c39eddac7ac094e68f9052e0643c577431
Instruction Fuzzy Hash: B7F0F974A10209CFDB04DFB4E89599DBBB2FF84308B119A69D00A9B754EF34A941CF81

Function 009429E3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a44744b3837221c404f5b552052fee1c9701a309625d56b056ed6795458133
Instruction ID: 6c56817a3054a30ab96f8a2ce44e78e2ed0c71aaf059045c1880e37b2b6f539b
Opcode Fuzzy Hash: 91a44744b3837221c404f5b552052fee1c9701a309625d56b056ed6795458133
Instruction Fuzzy Hash: 3FF03C74A101098FDB14DFB4D995A5DBBB2FF88308F1099A590099B314DF34AD42CF41

Function 00942D2E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a2b6ae263406e97ed783ef731cf9c835b8d23f8d949b729a7188e9af51a968
Instruction ID: 9dfcf1e1b032f7f8a087b330cf520d5ed5981783bb4d1b124872cd0e22355bcc
Opcode Fuzzy Hash: a8a2b6ae263406e97ed783ef731cf9c835b8d23f8d949b729a7188e9af51a968
Instruction Fuzzy Hash: 9DF0FF74A102098FCB44DFB4E89495DBBB6FF84304B118969D0099F364DF349C41CB81

Function 00942E8D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e90b23ba5b60db4e98abf5089a47604bc0e22ec26d7f5dd1eb9ebf8f49153a
Instruction ID: 265741c652f80b4dcae9e5e4760976f799c2a63ff70f964d93e345eda3d91c35
Opcode Fuzzy Hash: 77e90b23ba5b60db4e98abf5089a47604bc0e22ec26d7f5dd1eb9ebf8f49153a
Instruction Fuzzy Hash: 4AF04F74A111098FDB14DFB4D895A5DBBB2FF84308F108AA9E0099B355DB349D42CF81

Function 00942AD3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbbe25c101551041682973a1069d8dfda865b7eff5ea9be6138a24bd35689e7b
Instruction ID: 3d10452b94f9a51829623d2f1ba5f588e3156e731e6766fec8ee295e168d13f7
Opcode Fuzzy Hash: fbbe25c101551041682973a1069d8dfda865b7eff5ea9be6138a24bd35689e7b
Instruction Fuzzy Hash: 82F04974B002098FDB04DFB4D994A9DBBB2FF84308F1189A5910A9F368DB74AD42CF81

Function 00942E18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 102ece68576d2aeba7c2a92fc591b1188521c2f005ff57e9812550eed08d4ceb
Instruction ID: a8ecafa34c8d65e01b33106696362487f43d124c5dfbdecdefae2f8369b97b17
Opcode Fuzzy Hash: 102ece68576d2aeba7c2a92fc591b1188521c2f005ff57e9812550eed08d4ceb
Instruction Fuzzy Hash: 90F01274A00209CFDB14DFB4E894A5DBBB2FF84304F214A69D0099B355DB34AC82CF81

Function 00942BC3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6b9a1e3280260df132fc371f72d31562deebccd2a92afa6c588310f6565179
Instruction ID: e697f5ae8bee4b3991ba65e03d0e4ffa82af92a61f4c5b5112eea3533978d975
Opcode Fuzzy Hash: 2e6b9a1e3280260df132fc371f72d31562deebccd2a92afa6c588310f6565179
Instruction Fuzzy Hash: 24F03174A002098FDB04DF64D894A5DBBB2FF88304F519595D049AB354DF349D41CF41

Function 00942FF2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cb7df8c73809e7ea9883c3d88ad206054ccf5cd68e42afe24e6a52abb81d03
Instruction ID: be0301e407aa4d2b1e028b37bb9d6a40a861f06c6a71049f87f834a8b230c93e
Opcode Fuzzy Hash: d4cb7df8c73809e7ea9883c3d88ad206054ccf5cd68e42afe24e6a52abb81d03
Instruction Fuzzy Hash: 47F0FF74E102098FDB04DFB4D894A9DBBB1FF99304F518965D40AAB364DB389C42CF51

Function 00942F08 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea59a2ad8431c575da1601b1ebfacddc439e65624c795b1f5f7c3321d43844c
Instruction ID: d36b21b7433a142664988f3c48a73ba931c81cca93a2f3465f98e4896708d33b
Opcode Fuzzy Hash: bea59a2ad8431c575da1601b1ebfacddc439e65624c795b1f5f7c3321d43844c
Instruction Fuzzy Hash: 84F0EC74A002099FDB48DFB4E89495DBBB1FF94304B118969D0459B365DF349942CF41

Function 00942B4E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a2dc23c45cd99d067ae2247685531d76f9a7465db6cee6c04e49fe8186eeb6
Instruction ID: ff6ee234a7e2a9d607803d6c999cfebf57d64998a5354e69124473c2ac5cf7b2
Opcode Fuzzy Hash: 99a2dc23c45cd99d067ae2247685531d76f9a7465db6cee6c04e49fe8186eeb6
Instruction Fuzzy Hash: 78F03774B00209CFCB04DFA4D89495DBBB6FF85304B1089A9900A9B364DB349C42CF81

Function 00942F7D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697c76471f7a99dda9e433fec9a2177c0b2947c33511eb8771426f6c3677bf2f
Instruction ID: 0de6aaeb332f75b01d0f545ecf53bbde3586e7121cbbf552a5e5a9b09eb0d1bd
Opcode Fuzzy Hash: 697c76471f7a99dda9e433fec9a2177c0b2947c33511eb8771426f6c3677bf2f
Instruction Fuzzy Hash: 2FF0FF74E0020A8FDB04DFA4D89495DBBB2FF84304B119965D40A9B365DB389D42CF81

Function 00941F19 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2149934764.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_940000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e18b29f252448944a9066e645f5986798f7da7469bcc18a88996a89c65b47f
Instruction ID: 5082887277a53622879ad5a6634be34e210de699d9340be389136ab70781cafc
Opcode Fuzzy Hash: 32e18b29f252448944a9066e645f5986798f7da7469bcc18a88996a89c65b47f
Instruction Fuzzy Hash: 4FE06D70B242098FDB54DF74E8A5A9E7BF6FF94344F019A75900A9B360EE3858C5CB81

Analysis Process: rundll32.exePID: 3292, Parent PID: 1472COMMON

Executed Functions

Function 037430B1 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

#$y, xrefs: 037432E7

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: a4a76f7e1b832b82299d9a523ef827168207ef3897950718ecf8e5ed87d7ae00
Instruction ID: 9a2398464f62bb13c64088ef0263a1257256d7781dbdf036b22ed1d85cb38284
Opcode Fuzzy Hash: a4a76f7e1b832b82299d9a523ef827168207ef3897950718ecf8e5ed87d7ae00
Instruction Fuzzy Hash: 5CA1F37AB000058FD718DB78D99166ABBE3AFE460471DC92AC50ADB765DF38EC12CB40

Function 03743110 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

#$y, xrefs: 037432E7

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID: #$y
API String ID: 0-3378893297
Opcode ID: 363b039fa1fadc09e226c9ae7f59ac2a5e1352c576a5d6ec053f28c15e91f1ed
Instruction ID: 605ccd9df39fdeb00da43206a1f4672319ecb612f52d5c73708a4d57ca8a7826
Opcode Fuzzy Hash: 363b039fa1fadc09e226c9ae7f59ac2a5e1352c576a5d6ec053f28c15e91f1ed
Instruction Fuzzy Hash: 4C81C536B000058FD70CDB7DD89166ABAE7AFE8644719D926C50ADB764DF38EC02CB51

Function 03740C52 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2118bf3c113962a2d71899db30772b98aa0f9a4aeb1f94672edb17807d1a1a85
Instruction ID: c02818e5f1605220dd342cf23da28cb956b9e4f099f61cf6d54928a5518fb982
Opcode Fuzzy Hash: 2118bf3c113962a2d71899db30772b98aa0f9a4aeb1f94672edb17807d1a1a85
Instruction Fuzzy Hash: D841F632B54041CFC30CE734DD95A79BBD7BBF0714728D965960B9B2A1CF28AD12CA42

Function 03740C90 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d391d069ae88f0f973009bdaad356132aa751010c6c744992fdb0e4d97545d
Instruction ID: 677c12b7655327361f8d5cebbb1c1a69974fcc93ed07e47cb124ab26c53e92ab
Opcode Fuzzy Hash: 10d391d069ae88f0f973009bdaad356132aa751010c6c744992fdb0e4d97545d
Instruction Fuzzy Hash: EC31C332B54011CFC34CEB74D995A79B797BBF0709724D965970B9B2A0CF38AD12CA42

Function 03742A5E Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

#PP, xrefs: 03742A5E

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID: #PP
API String ID: 0-565894853
Opcode ID: 933f4006ca109082fa02ac908badb75fd6ea9334da582f176a66e65dcb6af545
Instruction ID: 25cee194e6a2d009d001bf6373de48518af1099abc4db6beaa8c7fd583bb8fe5
Opcode Fuzzy Hash: 933f4006ca109082fa02ac908badb75fd6ea9334da582f176a66e65dcb6af545
Instruction Fuzzy Hash: E8F0F974E002498FCB08DFA4D894A9DBBB6FFA4304F109969D0569F359DB38A947CF81

Function 03743518 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0dd97cfcdcab4783160f6219d4a9a4fb178f71d6c45809c23463c266c0f518
Instruction ID: 50424c2805c82ebb82211031d6524d755c571ea53a950e7198c36b029374e2ab
Opcode Fuzzy Hash: 0c0dd97cfcdcab4783160f6219d4a9a4fb178f71d6c45809c23463c266c0f518
Instruction Fuzzy Hash: 78516E78B001058FCB48DF69D994AAEBBF2FF88710B648469E50ADB365CB34AD01CB51

Function 03743528 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b365624287c86f755a65197c16ef1780000065a7abfa408f70f8e5b724b5bf
Instruction ID: 93a539b06398f0d31b62ef90ac4c8d12be850bcf554e918f43d1e4fccbb3873a
Opcode Fuzzy Hash: 34b365624287c86f755a65197c16ef1780000065a7abfa408f70f8e5b724b5bf
Instruction Fuzzy Hash: E8516F78B001058FCB48DF69D994AAEBBF2FF88710B648469E50ADB365CB34ED01CB51

Function 0374374A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9afe335fce65225b0f3a942fc2d360c89e43b0027e097e0be1a6b0e811a7db86
Instruction ID: bc875274eb67d4cb2c8d560311439b7f44916d0fc36d38e841f797e36daddd0c
Opcode Fuzzy Hash: 9afe335fce65225b0f3a942fc2d360c89e43b0027e097e0be1a6b0e811a7db86
Instruction Fuzzy Hash: 9E21267AB441518FE308CA79DDD05BBB7ABBBD5210309C53AD509CB364DB34AD01CB51

Function 0374296E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1f02dd1cc8dadc55850203083985f20b0e8069a8165659420f8eb2a34f5cae
Instruction ID: f528a7dbaab789b8ca6ce7c9df993f4dc5d60131265fe5dfcc5ca85fdf94ba12
Opcode Fuzzy Hash: 5f1f02dd1cc8dadc55850203083985f20b0e8069a8165659420f8eb2a34f5cae
Instruction Fuzzy Hash: 12215174F001098FCF58DFA9D894A6DBBF2AF98300B10D969C00AEB355DB34A905CF41

Function 034FD01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2152062103.00000000034FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_34fd000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802c2ecb566b4eed912f2a8a52933d60f0106e379b450dddaf1c27c35a9f18ea
Instruction ID: 16204508a1f296c576f2599fe7ed87c8df886c656677aedad5368c6bd1200b84
Opcode Fuzzy Hash: 802c2ecb566b4eed912f2a8a52933d60f0106e379b450dddaf1c27c35a9f18ea
Instruction Fuzzy Hash: A71126B19443449FDB14DF24D984B26BB98EB45308F288A7ED6094F349C33AD447C666

Function 037433B9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f88dde90d4aadb403f2fe3fd0320b636a15f1fa5b14807d4e603f826557ddd
Instruction ID: 7d23eb53f1895f4d49862b691b02c52e1120ec975730f3b0f1cc843c71979f69
Opcode Fuzzy Hash: b3f88dde90d4aadb403f2fe3fd0320b636a15f1fa5b14807d4e603f826557ddd
Instruction Fuzzy Hash: 3B11967AF000058FEB18DA75D86577DB6A7ABD4648F19C925C00A97650DF38DD42CB41

Function 034D3005 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2151123306.00000000034D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_34d3000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c90435250eede92e7e63882e91940fbcc58f722f04751967902acea2d08ef8
Instruction ID: a223bd880aba40606cee74079a6fb03777809b2f96c03ae787c534d756834a5d
Opcode Fuzzy Hash: 20c90435250eede92e7e63882e91940fbcc58f722f04751967902acea2d08ef8
Instruction Fuzzy Hash: 941160751097C09FD712CF15D990B52BFB8EB46620F0884DBE9898F653C27C9809CB72

Function 034D301C Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2151123306.00000000034D3000.00000040.00000800.00020000.00000000.sdmp, Offset: 034D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_34d3000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720af88023698d7257389ae1ba5f765fdc0b54c9a8f75ba4263128adda65047f
Instruction ID: 7b0753e55884791dbbb0fd10812a868938199498a1fbcc6a3384bf32067328e1
Opcode Fuzzy Hash: 720af88023698d7257389ae1ba5f765fdc0b54c9a8f75ba4263128adda65047f
Instruction Fuzzy Hash: AA11A075504644DED711CF19E984B27FBE8EB44720F04C86AE9894F356C37C9805CBB2

Function 034FD006 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2152062103.00000000034FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 034FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_34fd000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7b8b14bd3fcd8cb9f883254f26c896d330d1454bdb251d5cb360d89c276dc0
Instruction ID: f105c0c502eb629f4dd8c7ae0f2b08ebd34f044a1134a8e663d5050f13700819
Opcode Fuzzy Hash: 6b7b8b14bd3fcd8cb9f883254f26c896d330d1454bdb251d5cb360d89c276dc0
Instruction Fuzzy Hash: A811B2719093C08FD712DF24D584715BF70EB46208F2886EBC5898F297C33A944AC762

Function 03742F7D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713f5bdc1ddb04c9eb11a6f7cb446a35dc279fd452a1f9375e4edd754be7cc87
Instruction ID: bbdd78ef2feaf4d9d22689b90122fc83b4bc819bbc3ffae7dfdddfac839cf0fe
Opcode Fuzzy Hash: 713f5bdc1ddb04c9eb11a6f7cb446a35dc279fd452a1f9375e4edd754be7cc87
Instruction Fuzzy Hash: 47F0FF74E4020A8FCB08DFA4D89499DB7B2FF94304B11D965D40A9B365DB38AD02CF80

Function 03742B4E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f4df91e2868d9f03574720d480abdcee0bab975fd6e85a0225474d3c084926
Instruction ID: 9f733160c5fc8b9b49b62258f10dc570031391bcbef754f0a1c43968dd30bb81
Opcode Fuzzy Hash: d0f4df91e2868d9f03574720d480abdcee0bab975fd6e85a0225474d3c084926
Instruction Fuzzy Hash: BDF03C30E40209CFCB08DFA4D89499DB7B6FF95304B1089A5D0099B354DB389D02CF80

Function 03742F08 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed90675c435efa14280d116389456e5a87ee1f0e9194ed8fee52a031f9bb88e
Instruction ID: e700769de550e798303c92d7b758ac73857ae368475bce0f55c7629eb471d400
Opcode Fuzzy Hash: 8ed90675c435efa14280d116389456e5a87ee1f0e9194ed8fee52a031f9bb88e
Instruction Fuzzy Hash: 6FF0EC74E402099FDB48DFB4E89499DB7B2FF94304B108969D0459B365EF38AD42CF40

Function 03742FF2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30c1d41835acf723795723abf65e4056bdb0bf7e0269366c769f9a93f2c53f1
Instruction ID: b7843cd8d840b509ff46d23051c9d3a81dbb53e99d7f917c4a246ac735402eda
Opcode Fuzzy Hash: f30c1d41835acf723795723abf65e4056bdb0bf7e0269366c769f9a93f2c53f1
Instruction Fuzzy Hash: 73F0FF74E402098FCB08DFB4D894A9DBBB2FF99304F108965D40AAB364DB38AD42CF50

Function 03742BC3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbd9a13f7778c0b607a135c8949df5bf706e6ca89d93c9414fc48f910d291b7
Instruction ID: 44d7a2342ba6fe40ee8dcbdc3e142b634ed15747af870f7206bc57f0920aae90
Opcode Fuzzy Hash: 2dbd9a13f7778c0b607a135c8949df5bf706e6ca89d93c9414fc48f910d291b7
Instruction Fuzzy Hash: 51F03174A002058FCB48DF64D894A9DB7B2FF99304F11D595D049AB354DF34AD41DF41

Function 03742E18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f08664079bbaed676ce421a48cce7642e59468f7ffc4f3faa71487e2640eb0f
Instruction ID: 803fec004ab2e27737e6846205b2898749444a246e26e39a46d035679eccd2df
Opcode Fuzzy Hash: 7f08664079bbaed676ce421a48cce7642e59468f7ffc4f3faa71487e2640eb0f
Instruction Fuzzy Hash: 66F0FF74A00209CFDB18DFB4E894A9DBBB2FF94304F218969D0099B355DB38A942CF80

Function 03742AD3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d516ae0259475bbc8d1e768da81252af67c647571fb19a4f062e57678ff8d063
Instruction ID: ac8b2bf67784f1a8b9f21330906beab75dc77b1f2b4b17d6587233cab8ae8be5
Opcode Fuzzy Hash: d516ae0259475bbc8d1e768da81252af67c647571fb19a4f062e57678ff8d063
Instruction Fuzzy Hash: 3BF03C74A402098FCB08DFB4D994A9DB7B2FF94308F1089A5910A9B359DB78AD02CF80

Function 03742E8D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61cd148692cc59c269f08e7df70ce0f5f2d9b3ba636b2fd5ab5a0e21be23cc91
Instruction ID: 19647d268968bb4462c1f18898955439fe4562537b4dac839c9abbf3cb7d5e37
Opcode Fuzzy Hash: 61cd148692cc59c269f08e7df70ce0f5f2d9b3ba636b2fd5ab5a0e21be23cc91
Instruction Fuzzy Hash: E9F04F34E511098FCB18DFB4D894A9DB7B2FF94304F1089A9D0099B395DB38AD02CF80

Function 03742D2E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b4913635bc0c99db5f98fa7e006d630861ebd98abc425728923d1ab5610da3
Instruction ID: 71ded75e3b90b92a3cdb2521662a557813e163022fb38d361df1a05d295898bd
Opcode Fuzzy Hash: 60b4913635bc0c99db5f98fa7e006d630861ebd98abc425728923d1ab5610da3
Instruction Fuzzy Hash: 23F0FF74A002099FCB48DFB4E89499DBBB6FF94304B118969D0099B364EB389D41DB41

Function 037429E3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9f7f07c08fefacf5ca7d469ac141605a02e3737eeb9308bcfe3687f19c2f12
Instruction ID: f491f6ca256e036f64915d33d8bc194d4de16028f04f27913f9218ab7d8277b0
Opcode Fuzzy Hash: ee9f7f07c08fefacf5ca7d469ac141605a02e3737eeb9308bcfe3687f19c2f12
Instruction Fuzzy Hash: C1F0EC74E501098FCB18DFB4D994A9DBBB2FF98304F1099A590499B355EB38AD02DF41

Function 03742DA3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0ee0577a04ea521791e08b7f5e6cfcd2803d5d02e1b489982f92dcebea5cfb
Instruction ID: d27c7dd8288928cfc82b299ae86c63c77aa734b379b1c2be8155138dcb176282
Opcode Fuzzy Hash: bb0ee0577a04ea521791e08b7f5e6cfcd2803d5d02e1b489982f92dcebea5cfb
Instruction Fuzzy Hash: B0F0FF74E00209CFCB08DFB4E89499DBBB2FF94304B109969D1069B754EB38A941CF81

Function 03742C3E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8b22c0667d202b9af93246914c2038e6b3e51a59e56f54d217a8f1d49320d2
Instruction ID: b915ec6705669ca7c685f045093c73a44d40713d4b201a2853fbb4ba5c6d37d8
Opcode Fuzzy Hash: 1a8b22c0667d202b9af93246914c2038e6b3e51a59e56f54d217a8f1d49320d2
Instruction Fuzzy Hash: 85F03C30E002099FCB08DFB5D994A9DB7B2FF94304F208969D006AB365DB38AE01CB81

Function 03742CB3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb193f662941866456bbe11018f97a76d64f9f8541fdb6d47c8d49e15fe12b8
Instruction ID: f9d771d619c9591c4f8ef6486372f72d5df96d4684ab6704027423864d32aaac
Opcode Fuzzy Hash: edb193f662941866456bbe11018f97a76d64f9f8541fdb6d47c8d49e15fe12b8
Instruction Fuzzy Hash: 7FF01934A502198FCB08DFA4D894A9DB7B2FF98204F1089A5D04AAB264EB389D01CF91

Function 03741F19 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2155330255.0000000003740000.00000040.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3740000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75858c12f351c5fb79b66ebd8ca495ec1791935f623d1898a54ba76e68acfd53
Instruction ID: 783c2fbd1598e6ca375cbff5bb9982a2df7ae604162b8e1b7e9acf1ad19fd6aa
Opcode Fuzzy Hash: 75858c12f351c5fb79b66ebd8ca495ec1791935f623d1898a54ba76e68acfd53
Instruction Fuzzy Hash: 30E03970A442058FCB58EF74E8A4AA977B7EFA4344F11D965800A9B254EE386985CB81

Source: unknown	TCP traffic detected without corresponding DNS query: 20.0.152.185
Source: unknown	TCP traffic detected without corresponding DNS query: 20.0.152.185
Source: unknown	TCP traffic detected without corresponding DNS query: 20.0.152.185
Source: unknown	TCP traffic detected without corresponding DNS query: 20.0.152.185
Source: unknown	TCP traffic detected without corresponding DNS query: 20.0.152.185
Source: unknown	TCP traffic detected without corresponding DNS query: 20.0.152.185
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aleluia.exe.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
aleluia.exe.dll