Edit tour

Windows Analysis Report
BraveUpdateComRegisterShell64.exe

Overview

General Information

Sample name:	BraveUpdateComRegisterShell64.exe
Analysis ID:	1476976
MD5:	e5ceb2c8343d7015398f92377bf44ee6
SHA1:	a6dffc4c20830729f2bd13947864b07efe188958
SHA256:	c21808e42c600163889484750eb9a89dedcdcfb23cdf68d16e2f19378026de5d
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

BraveUpdateComRegisterShell64.exe (PID: 4952 cmdline: "C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe" MD5: E5CEB2C8343D7015398F92377BF44EE6)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• Compliance
• Spreading
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: BraveUpdateComRegisterShell64.exe

Static PE information: certificate valid

Source: BraveUpdateComRegisterShell64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BraveUpdateComRegisterShell64_unsigned.pdbT source: BraveUpdateComRegisterShell64.exe
Source:	Binary string: BraveUpdateComRegisterShell64_unsigned.pdb source: BraveUpdateComRegisterShell64.exe

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF2EE70 FindFirstFileExW,

0_2_00007FF6ADF2EE70

Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: BraveUpdateComRegisterShell64.exe	String found in binary or memory: http://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF248F8 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

0_2_00007FF6ADF248F8

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF248F8 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

0_2_00007FF6ADF248F8

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe	Code function: 0_2_00007FF6ADF2C810	0_2_00007FF6ADF2C810
Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe	Code function: 0_2_00007FF6ADF2EE70	0_2_00007FF6ADF2EE70
Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe	Code function: 0_2_00007FF6ADF2E684	0_2_00007FF6ADF2E684

Source: BraveUpdateComRegisterShell64.exe	Binary or memory string: OriginalFilename vs BraveUpdateComRegisterShell64.exe
Source: BraveUpdateComRegisterShell64.exe, 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegoopdate.dllJ vs BraveUpdateComRegisterShell64.exe
Source: BraveUpdateComRegisterShell64.exe	Binary or memory string: OriginalFilenamegoopdate.dllJ vs BraveUpdateComRegisterShell64.exe

Source: classification engine

Classification label: clean5.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF2126C LoadResource,LockResource,SizeofResource,

0_2_00007FF6ADF2126C

Source: BraveUpdateComRegisterShell64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Section loaded: kernel.appcore.dll

Jump to behavior

Source: BraveUpdateComRegisterShell64.exe

Static PE information: certificate valid

Source: BraveUpdateComRegisterShell64.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: BraveUpdateComRegisterShell64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: BraveUpdateComRegisterShell64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: BraveUpdateComRegisterShell64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: BraveUpdateComRegisterShell64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: BraveUpdateComRegisterShell64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: BraveUpdateComRegisterShell64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: BraveUpdateComRegisterShell64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: BraveUpdateComRegisterShell64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: BraveUpdateComRegisterShell64_unsigned.pdbT source: BraveUpdateComRegisterShell64.exe
Source:	Binary string: BraveUpdateComRegisterShell64_unsigned.pdb source: BraveUpdateComRegisterShell64.exe

Source: BraveUpdateComRegisterShell64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: BraveUpdateComRegisterShell64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: BraveUpdateComRegisterShell64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: BraveUpdateComRegisterShell64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: BraveUpdateComRegisterShell64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF23A78 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00007FF6ADF23A78

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF243E4 RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,

0_2_00007FF6ADF243E4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF2EE70 FindFirstFileExW,

0_2_00007FF6ADF2EE70

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF2AB78 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6ADF2AB78

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF24C54 InitializeCriticalSectionAndSpinCount,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6ADF24C54

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF23A78 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00007FF6ADF23A78

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF21480 GetProcessHeap,

0_2_00007FF6ADF21480

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe	Code function: 0_2_00007FF6ADF2AB78 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6ADF2AB78
Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe	Code function: 0_2_00007FF6ADF25778 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6ADF25778
Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe	Code function: 0_2_00007FF6ADF253BC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6ADF253BC
Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe	Code function: 0_2_00007FF6ADF25958 SetUnhandledExceptionFilter,	0_2_00007FF6ADF25958

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF33F40 cpuid

0_2_00007FF6ADF33F40

Source: C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe

Code function: 0_2_00007FF6ADF24034 GetSystemTimeAsFileTime,

0_2_00007FF6ADF24034

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BraveUpdateComRegisterShell64.exe	0%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1476976
Start date and time:	2024-07-19 20:39:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BraveUpdateComRegisterShell64.exe
Detection:	CLEAN
Classification:	clean5.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 13 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com
VT rate limit hit for: BraveUpdateComRegisterShell64.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.1928419739850655
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BraveUpdateComRegisterShell64.exe
File size:	174'104 bytes
MD5:	e5ceb2c8343d7015398f92377bf44ee6
SHA1:	a6dffc4c20830729f2bd13947864b07efe188958
SHA256:	c21808e42c600163889484750eb9a89dedcdcfb23cdf68d16e2f19378026de5d
SHA512:	3bee913916b11398f3593a9a2f8ae70fabce19ca45996789ac8ab899ab770290f40876df30ba1180ee797f876a540c835e47ca337929dee0b83ad27355f92314
SSDEEP:	3072:7urxDnvsKxxDo4WVSWW/VaO7QAiOWdj/8kyVwvgB+cB/J:7M2Kxxc4oIt97QAYgqoB+c
TLSH:	50045C1B73A430F9E1B78135C8924A16E7B2B8720B50E79F13A4477A1F33691DD2EB61
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........`..@3..@3..@3..C2..@3..E2>.@3[.C2..@3[.D2..@3[.E2..@3..I2..@3..D2..@3..A2..@3..A3..@3..E2..@3...3..@3...3..@3..B2..@3Rich..@

File Icon


Icon Hash:	2f232d67b7934633

Static PE Info

General

Entrypoint:	0x140004ffc
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66953BA6 [Mon Jul 15 15:09:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	4f32214340f08cb2ab89522936793048

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	28/05/2024 02:00:00 07/08/2027 01:59:59
Subject Chain	CN="Brave Software, Inc.", O="Brave Software, Inc.", L=San Francisco, S=California, C=US
Version:	3
Thumbprint MD5:	9556B0EC482251182975F452FB6EFFBC
Thumbprint SHA-1:	F8AC5F11DE7E26383B7A389FC19A2613835799D7
Thumbprint SHA-256:	605F451998D85EFB906F1D062B20DE8BE591F69588C68F0226CE8A64EF27213F
Serial:	0E982FDDF06E93E911065D037D4DD482

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F316C6EEB6Ch
dec eax
add esp, 28h
jmp 00007F316C6EE38Fh
int3
int3
jmp 00007F316C6EE83Ch
int3
int3
int3
dec eax
sub esp, 28h
call 00007F316C6EF1FCh
test eax, eax
je 00007F316C6EE533h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F316C6EE517h
dec eax
cmp ecx, eax
je 00007F316C6EE526h
xor eax, eax
dec eax
cmpxchg dword ptr [0001EEFCh], ecx
jne 00007F316C6EE500h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F316C6EE509h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F316C6EE519h
mov byte ptr [0001EEE5h], 00000001h
call 00007F316C6EEEE9h
call 00007F316C6EF748h
test al, al
jne 00007F316C6EE516h
xor al, al
jmp 00007F316C6EE526h
call 00007F316C6F616Bh
test al, al
jne 00007F316C6EE51Bh
xor ecx, ecx
call 00007F316C6EF758h
jmp 00007F316C6EE4FCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0001EEACh], 00000000h
mov ebx, ecx
jne 00007F316C6EE579h
cmp ecx, 01h
jnbe 00007F316C6EE57Ch
call 00007F316C6EF172h
test eax, eax
je 00007F316C6EE53Ah
test ebx, ebx
jne 00007F316C6EE536h
dec eax
lea ecx, dword ptr [0001EE96h]
call 00007F316C6F5F8Ah
test eax, eax
jne 00007F316C6EE522h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21b08	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x29000	0x3278	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x27000	0x16c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x28000	0x2818
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d000	0x87c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1fc90	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1fe80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1fb50	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16000	0x3d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14b20	0x14c00	8f79759b66ee949ce50a9da83b92d4fd	False	0.5619470067771084	DOS executable (COM)	6.450943592947004	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x16000	0xc808	0xca00	245ef1e29a383b9e3e7c8015c5afb4e7	False	0.40911200495049505	data	4.645329277044868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x23000	0x3260	0x1000	3993488bfaa4e46fa52568ae1b4d4ba6	False	0.150146484375	data	2.0416580595813913	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x27000	0x16c8	0x1800	5a29405f6a011e34a4bf83071d3ed8ba	False	0.45556640625	data	4.914221929139865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x29000	0x3278	0x3400	63d7d2e35db62f8217f337bb32a67182	False	0.3633563701923077	data	5.137004911463502	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d000	0x87c	0xa00	c099ebeae87087463e5468ccc019bcdb	False	0.503515625	data	5.096857809701152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x29800	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192, 16 important colors	English	United States	0.6317567567567568
RT_ICON	0x29928	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.5823699421965318
RT_ICON	0x29e90	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640, 16 important colors	English	United States	0.5120967741935484
RT_ICON	0x2a178	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5455776173285198
RT_ICON	0x2aa20	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.36341463414634145
RT_ICON	0x2b088	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.42350746268656714
RT_GROUP_ICON	0x2bf30	0x5a	data	English	United States	0.7333333333333333
RT_VERSION	0x2bf90	0x2e8	data	English	United States	0.4368279569892473
RT_MANIFEST	0x29220	0x5e0	XML 1.0 document, ASCII text	English	United States	0.425531914893617

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegOverridePredefKey, RegOpenKeyExW, RegQueryValueExW
KERNEL32.dll	FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetFileType, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, SetFilePointerEx, GetConsoleOutputCP, GetConsoleMode, WriteConsoleW, FindResourceW, SizeofResource, LockResource, LoadResource, GetProcAddress, GetModuleHandleW, FindResourceExW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, GetLastError, RaiseException, DecodePointer, GetCommandLineW, GetModuleHandleExW, GetModuleFileNameW, GetEnvironmentVariableW, CloseHandle, GetCurrentProcessId, VirtualQuery, LocalFree, SetLastError, FindNextFileW, GetCurrentProcess, FindClose, GetFileAttributesExW, LoadLibraryW, FreeLibrary, lstrcmpiW, GetTickCount, LoadLibraryExW, TerminateProcess, Sleep, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, WriteFile, CreateFileW, GetSystemTimeAsFileTime, FlushFileBuffers, GetPrivateProfileIntW, OutputDebugStringA, GetCurrentThreadId, OutputDebugStringW, TryEnterCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, ExitProcess, IsDebuggerPresent, GetStdHandle, GlobalAlloc, GlobalFree, GlobalLock, GlobalUnlock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, InitializeSListHead, GetStartupInfoW, InitializeCriticalSectionEx, EncodePointer, GetStringTypeW, GetCPInfo, RtlUnwindEx, RtlPcToFileHeader, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree
USER32.dll	wsprintfW, MessageBoxW, EmptyClipboard, CloseClipboard, OpenClipboard, SetClipboardData, CharLowerBuffW
SHLWAPI.dll	PathStripPathW, PathRemoveExtensionW, PathRemoveFileSpecW, PathAppendW
SHELL32.dll	CommandLineToArgvW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• BraveUpdateComRegisterShell64.exe

Click to jump to process

Memory Usage

• BraveUpdateComRegisterShell64.exe

Click to jump to process

Target ID:	0
Start time:	14:40:35
Start date:	19/07/2024
Path:	C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\BraveUpdateComRegisterShell64.exe"
Imagebase:	0x7ff6adf20000
File size:	174'104 bytes
MD5 hash:	E5CEB2C8343D7015398F92377BF44EE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	958
Total number of Limit Nodes:	15

Executed Functions

Function 00007FF6ADF243E4 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 151
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF6ADF2441E
RegQueryValueExW.ADVAPI32 ref: 00007FF6ADF24458
RegCloseKey.ADVAPI32 ref: 00007FF6ADF24464
GetPrivateProfileIntW.KERNEL32 ref: 00007FF6ADF244B8
GetPrivateProfileIntW.KERNEL32 ref: 00007FF6ADF244DC
GetPrivateProfileIntW.KERNEL32 ref: 00007FF6ADF244FD
GetPrivateProfileIntW.KERNEL32 ref: 00007FF6ADF24521
GetPrivateProfileIntW.KERNEL32 ref: 00007FF6ADF245AE

Strings

Software\BraveSoftware\UpdateDev\, xrefs: 00007FF6ADF2440E
AppendToFile, xrefs: 00007FF6ADF24506
EnableLogging, xrefs: 00007FF6ADF244AB
LoggingSettings, xrefs: 00007FF6ADF2449E
IsEnabledLogToFile, xrefs: 00007FF6ADF2444E
ShowTime, xrefs: 00007FF6ADF244C1
LogToOutputDebug, xrefs: 00007FF6ADF244E5
LoggingLevel, xrefs: 00007FF6ADF245A1

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: PrivateProfile$CloseOpenQueryValue
String ID: AppendToFile$EnableLogging$IsEnabledLogToFile$LogToOutputDebug$LoggingLevel$LoggingSettings$ShowTime$Software\BraveSoftware\UpdateDev\
API String ID: 2210674228-3529394150
Opcode ID: 115fbec1d4a42698948695d2c0836bc1593e8245ed45dae9de9fe17afa550ed2
Instruction ID: 6915a222b48a269f8c123527794680aa7d7b721d98ff4a5f14ad9e679b841577
Opcode Fuzzy Hash: 115fbec1d4a42698948695d2c0836bc1593e8245ed45dae9de9fe17afa550ed2
Instruction Fuzzy Hash: 7261D332A06A81D6EB148F39D8013AA7BA0FB14B9CF054135DE6C87796EF7CE559C701

Function 00007FF6ADF23A78 Relevance: 4.5, APIs: 3, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00007FF6ADF23A8D
GetProcAddress.KERNEL32 ref: 00007FF6ADF23AAA
FreeLibrary.KERNEL32 ref: 00007FF6ADF23ACA

Part of subcall function 00007FF6ADF23A28: GetLastError.KERNEL32 ref: 00007FF6ADF23A2E
Part of subcall function 00007FF6ADF23A28: RaiseException.KERNEL32 ref: 00007FF6ADF23A67

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Library$AddressErrorExceptionFreeLastLoadProcRaise
String ID:
API String ID: 386220097-0
Opcode ID: e9b386c73a78a2753a789b7da6d848ad456b64507265a1b698f1c5cfe5f101ad
Instruction ID: f6c1a1893b0b072eb88b6beac5163db320dd84a27061397e0cd3973192e93b16
Opcode Fuzzy Hash: e9b386c73a78a2753a789b7da6d848ad456b64507265a1b698f1c5cfe5f101ad
Instruction Fuzzy Hash: A8F06265B1A78282FA546B32784013A92D1EF98BC4F1D9478DD1E8B754FE3CD4414B01

Function 00007FF6ADF2D960 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00007FF6ADF2DADC
GetProcAddress.KERNEL32 ref: 00007FF6ADF2DAE8

Strings

ext-ms-, xrefs: 00007FF6ADF2DA39
api-ms-, xrefs: 00007FF6ADF2DA26

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 4dffe4d231ed8c7d2a292f77a832a0bf8b8bbaf6f2e61c44569a865c9983286b
Instruction ID: f8d18c8b63207c1c342c42f3be57e333c0112430c14650cfdab54069338b037a
Opcode Fuzzy Hash: 4dffe4d231ed8c7d2a292f77a832a0bf8b8bbaf6f2e61c44569a865c9983286b
Instruction Fuzzy Hash: DD419C22B1BB4281FA15DB36AD04AA76291FF49FA8F094135DD1DCB789FE3CE4458780

Function 00007FF6ADF24B48 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6ADF24B59
GetProcAddress.KERNEL32 ref: 00007FF6ADF24B69
GetCommandLineW.KERNEL32 ref: 00007FF6ADF24B7B

Strings

kernel32.dll, xrefs: 00007FF6ADF24B52
SetDefaultDllDirectories, xrefs: 00007FF6ADF24B62
user, xrefs: 00007FF6ADF24BA5
unregister, xrefs: 00007FF6ADF24BE9

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: AddressCommandHandleLineModuleProc
String ID: SetDefaultDllDirectories$kernel32.dll$unregister$user
API String ID: 147197560-815688805
Opcode ID: 9673f045043d755958723fdf7380b68598fef864f0be7e1b5a9f3d20e890e26f
Instruction ID: 1a8200f2086bc090b742ea20b79c858f67b1252e7303d5efb60b27bf24484d1b
Opcode Fuzzy Hash: 9673f045043d755958723fdf7380b68598fef864f0be7e1b5a9f3d20e890e26f
Instruction Fuzzy Hash: 6F315462B0AA8291DF10AB38D8811AB6760FF947B8F454331D57D872E6FE6CD649C740

Function 00007FF6ADF24A08 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF6ADF24A38
RegOverridePredefKey.ADVAPI32 ref: 00007FF6ADF24A4E
RegCloseKey.KERNELBASE ref: 00007FF6ADF24A74

Strings

Software\Classes, xrefs: 00007FF6ADF24A1C

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CloseOpenOverridePredef
String ID: Software\Classes
API String ID: 2630863477-1656466771
Opcode ID: 9ea64374da6e0c4303d51e988b69f4ff004675f91ca3130cc7a6adf9794beb3d
Instruction ID: 947b020949e8ae6e4068c80a56f582edf2aa08b08cde9797ccb69782e6a082cc
Opcode Fuzzy Hash: 9ea64374da6e0c4303d51e988b69f4ff004675f91ca3130cc7a6adf9794beb3d
Instruction Fuzzy Hash: 9BF0C861B1A64285EB104F39D88033753A0EF56BA0F540234DE7EC76E4EF1CD1449B14

Function 00007FF6ADF24070 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6ADF219C4: PathRemoveExtensionW.SHLWAPI(?,?,?,00007FF6ADF2408E,?,?,?,00007FF6ADF242BF,?,?,?,?,00007FF6ADF21031), ref: 00007FF6ADF21A20

Part of subcall function 00007FF6ADF21848: VirtualQuery.KERNEL32 ref: 00007FF6ADF2186F

lstrcmpiW.KERNELBASE(?,?,?,00007FF6ADF242BF,?,?,?,?,00007FF6ADF21031), ref: 00007FF6ADF240CC

Part of subcall function 00007FF6ADF23C54: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6ADF23D23

InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF6ADF21031), ref: 00007FF6ADF241A0

Strings

SystemDrive, xrefs: 00007FF6ADF241DB
BraveUpdate.ini, xrefs: 00007FF6ADF2422B

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CriticalExtensionInitializePathQueryRemoveSectionVirtual_invalid_parameter_noinfolstrcmpi
String ID: BraveUpdate.ini$SystemDrive
API String ID: 2459269748-4063966519
Opcode ID: 7280f7f356cddc769735e7ca56013052fe5d3c63b0074facccd19c59977d06ce
Instruction ID: edc968523c65299c9f8b745aff5f8fef3530acaf5339b1911d2ed425e2144b2c
Opcode Fuzzy Hash: 7280f7f356cddc769735e7ca56013052fe5d3c63b0074facccd19c59977d06ce
Instruction Fuzzy Hash: 7B716261B1AA8281EB40EB39D84126A73A0FF94BA8F444231EA6D877E5FF7CD545C740

Function 00007FF6ADF24158 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF6ADF21031), ref: 00007FF6ADF241A0

Part of subcall function 00007FF6ADF21480: GetProcessHeap.KERNEL32 ref: 00007FF6ADF214F6

Part of subcall function 00007FF6ADF2176C: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF6ADF241F1,?,?,?,?,00007FF6ADF21031), ref: 00007FF6ADF217AE
Part of subcall function 00007FF6ADF2176C: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF6ADF241F1,?,?,?,?,00007FF6ADF21031), ref: 00007FF6ADF217E6

Strings

SystemDrive, xrefs: 00007FF6ADF241DB
BraveUpdate.ini, xrefs: 00007FF6ADF2422B

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: EnvironmentVariable$CriticalHeapInitializeProcessSection
String ID: BraveUpdate.ini$SystemDrive
API String ID: 1233028853-4063966519
Opcode ID: 755f1d8a2797bbcac033f4c0ec56801420cd2e1db601a1ae310ba010263d5a37
Instruction ID: 6581d1804b43c28e437cd167e403e7a77c896b370a469811bcdd2ee01fa7dcbc
Opcode Fuzzy Hash: 755f1d8a2797bbcac033f4c0ec56801420cd2e1db601a1ae310ba010263d5a37
Instruction Fuzzy Hash: 56619672A1AB8681EB00EB39D84026A7360FF94B68F404231DA6D877E5FF7CE585C740

Function 00007FF6ADF2C4BC Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6ADF2C4B8), ref: 00007FF6ADF2C4CD
TerminateProcess.KERNEL32(?,?,?,00007FF6ADF2C4B8), ref: 00007FF6ADF2C4D8
ExitProcess.KERNEL32 ref: 00007FF6ADF2C4E7

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fdbe1b61821a241cb9ec34ce6ad41edc72dd69d74c0cd383d1ae615a2e05750e
Instruction ID: bd77c60aa89f1d1dfa1eefe8f9ccd7706fa5ba062ec5cb263885f0dcd83daf14
Opcode Fuzzy Hash: fdbe1b61821a241cb9ec34ce6ad41edc72dd69d74c0cd383d1ae615a2e05750e
Instruction Fuzzy Hash: 85D05E20B0A28242EA443F701C4503B0211DF48B08F011478C86F83393FE6CE4098311

Function 00007FF6ADF2268C Relevance: 3.2, APIs: 2, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CommandLineToArgvW.SHELL32 ref: 00007FF6ADF22712

Part of subcall function 00007FF6ADF21888: GetModuleFileNameW.KERNEL32(?,?,?,00007FF6ADF2198F,?,?,?,00007FF6ADF219E0,?,?,?,00007FF6ADF2408E,?,?,?,00007FF6ADF242BF), ref: 00007FF6ADF218FF

LocalFree.KERNEL32 ref: 00007FF6ADF22981

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ArgvCommandFileFreeLineLocalModuleName
String ID:
API String ID: 871553864-0
Opcode ID: 45d3d360cfb227a2d500fe3a0a5a521e918c09046c5a6df889b12db8793abc1f
Instruction ID: f227af8c8c6463767872fc7138d154f8d6676209713b3d4684e92e42eb1a87a5
Opcode Fuzzy Hash: 45d3d360cfb227a2d500fe3a0a5a521e918c09046c5a6df889b12db8793abc1f
Instruction Fuzzy Hash: 03A15462B06A8285EB109F79C8412AE37A1FB44BBCF444272DE2D977D5EF78D945C340

Function 00007FF6ADF24E88 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF6ADF24F1A
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6ADF24F6D

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: __scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 2313669860-0
Opcode ID: 90fa0aeceba7f8a57a1a5d445f671707dc3e9496c262bfa384fb06f56731b52f
Instruction ID: e0d9e3ca7fc120a3d55fae5cf04721597c6c038849b2972c05af17e0378537c2
Opcode Fuzzy Hash: 90fa0aeceba7f8a57a1a5d445f671707dc3e9496c262bfa384fb06f56731b52f
Instruction Fuzzy Hash: 16313A21E0F2C795FA14A775E4923BB1291DF9174CF8440B4E91DCB7D7FE6CA8088251

Function 00007FF6ADF2C3ED Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6ADF2C41B

Part of subcall function 00007FF6ADF2C514: GetModuleHandleExW.KERNEL32 ref: 00007FF6ADF2C539
Part of subcall function 00007FF6ADF2C514: GetProcAddress.KERNEL32 ref: 00007FF6ADF2C54F
Part of subcall function 00007FF6ADF2C514: FreeLibrary.KERNEL32 ref: 00007FF6ADF2C576

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: f71596c3fe5440afaf4607693b9743b433d484c0ab975f02fcaf0e33d3b2012c
Instruction ID: 520f912514902554be9432d71ce0d12933b45befc907b9e74b44694bba809c9b
Opcode Fuzzy Hash: f71596c3fe5440afaf4607693b9743b433d484c0ab975f02fcaf0e33d3b2012c
Instruction Fuzzy Hash: 6C217F32E06B8189EB248F74D4802BE37A0EB44B1CF144636D6AD87AC9EF78D645C780

Function 00007FF6ADF30430 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ADF3045B

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e905fc5fceb401ad07151be099cbafeae6e4b9a3ad716f9f878cd256808bb233
Instruction ID: 9f0bb9644cb22c115c554e27122a01aa6a28dbea8de5c973bace2a1b4c64d85f
Opcode Fuzzy Hash: e905fc5fceb401ad07151be099cbafeae6e4b9a3ad716f9f878cd256808bb233
Instruction Fuzzy Hash: 79118F7290AB8292F310DF24E45013BB2A4FF40744F560436E6ADCB7A6FE3CEA608741

Function 00007FF6ADF2DDFC Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6ADF2D79E,?,?,000066C9EB337148,00007FF6ADF2AFB9,?,?,?,?,00007FF6ADF2E5C6,?,?,00000000), ref: 00007FF6ADF2DE51

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b1b63093aae9d3b7e30adcc2f3cdec2fbdfdd9a3f432c5ecdb161dcd88c7edc6
Instruction ID: 9c67ce9e87609f83b89ee643159bcb91902570a004edf35bb89d396ecb2e2035
Opcode Fuzzy Hash: b1b63093aae9d3b7e30adcc2f3cdec2fbdfdd9a3f432c5ecdb161dcd88c7edc6
Instruction Fuzzy Hash: 1FF04450B0BB8741FE6467729C612B75284DFA9FA8F0844B0C90EC7782FE2CE4818290

Non-executed Functions

Function 00007FF6ADF248F8 Relevance: 13.5, APIs: 9, Instructions: 42clipboardmemorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF6ADF2490A
OpenClipboard.USER32 ref: 00007FF6ADF24914
EmptyClipboard.USER32 ref: 00007FF6ADF2491E
GlobalAlloc.KERNEL32 ref: 00007FF6ADF24935
GlobalLock.KERNEL32 ref: 00007FF6ADF24941
GlobalUnlock.KERNEL32 ref: 00007FF6ADF2495D
SetClipboardData.USER32 ref: 00007FF6ADF2496B
GlobalFree.KERNEL32 ref: 00007FF6ADF24979
CloseClipboard.USER32 ref: 00007FF6ADF2497F

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlocklstrlen
String ID:
API String ID: 2633044538-0
Opcode ID: 9a43b55c64501a910736edda568cdc33cd32edaf4aabff206ad069d84421e11a
Instruction ID: cf3bbc694db03ced777aa77ea70b1cb77e5a1bc6cb2953c2582d5153b7d48296
Opcode Fuzzy Hash: 9a43b55c64501a910736edda568cdc33cd32edaf4aabff206ad069d84421e11a
Instruction Fuzzy Hash: 8501ED20B0A74282EE445B71BD5813AA2A5EF59FD5F064038DD7E87769EE3CE4858301

Function 00007FF6ADF25778 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6ADF25794
RtlCaptureContext.KERNEL32 ref: 00007FF6ADF257C1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ADF257DB
RtlVirtualUnwind.KERNEL32 ref: 00007FF6ADF2581C
IsDebuggerPresent.KERNEL32 ref: 00007FF6ADF25870
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6ADF2588D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6ADF25898

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 06511b74fe360cd931a79cf0fabb72b087814192db87043e4613b3af030e8e1c
Instruction ID: 07c48e1d40f65101805c5ddf99da3d8af5c7a692d3e60f0ed0bfb5addbbfd32e
Opcode Fuzzy Hash: 06511b74fe360cd931a79cf0fabb72b087814192db87043e4613b3af030e8e1c
Instruction Fuzzy Hash: CA310F7660AB8186EB609F70E8403EE7364FB84748F45403ADA5E87B95EF7CD548C711

Function 00007FF6ADF2AB78 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6ADF2ABF1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ADF2AC09
RtlVirtualUnwind.KERNEL32 ref: 00007FF6ADF2AC44
IsDebuggerPresent.KERNEL32 ref: 00007FF6ADF2AC7D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6ADF2AC87
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6ADF2AC92

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ed3133f783eb8e67692d6a5c252bd68fc3a0721a93207d2db6aac162f13a1487
Instruction ID: 514b661f2db0b8d241bc93617be58d9f1d5a776c29b379c7fc3959fe8594e054
Opcode Fuzzy Hash: ed3133f783eb8e67692d6a5c252bd68fc3a0721a93207d2db6aac162f13a1487
Instruction Fuzzy Hash: B1315136619B8186DB60CF35E8402AE73A4FB88758F550136EEAD83BA5EF3CD555CB00

Function 00007FF6ADF24C54 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6ADF24CAC
GetLastError.KERNEL32 ref: 00007FF6ADF24CB5
IsDebuggerPresent.KERNEL32 ref: 00007FF6ADF24CCD
OutputDebugStringW.KERNEL32 ref: 00007FF6ADF24CDE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF6ADF24CD7

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: 49c14b1b32860f2e1bc63abaeb26070e92eb2973fee688e381e1c0a470115ab7
Instruction ID: a19a2086496f8a0598120b1d8e28d8153fb8e77e7449f0cc754b1b9a205d4bea
Opcode Fuzzy Hash: 49c14b1b32860f2e1bc63abaeb26070e92eb2973fee688e381e1c0a470115ab7
Instruction Fuzzy Hash: 63114C32A1AB8296E7149B36EA543BA72A0FF44349F454135CA6DC3A90FF7CE0B4C751

Function 00007FF6ADF2126C Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,00007FF6ADF21370,?,00000000,?,00007FF6ADF21C9C,?,?,?,00007FF6ADF23D87,?,?,?,00007FF6ADF2199A), ref: 00007FF6ADF21289
LockResource.KERNEL32(?,?,?,00007FF6ADF21370,?,00000000,?,00007FF6ADF21C9C,?,?,?,00007FF6ADF23D87,?,?,?,00007FF6ADF2199A), ref: 00007FF6ADF21297
SizeofResource.KERNEL32(?,?,?,00007FF6ADF21370,?,00000000,?,00007FF6ADF21C9C,?,?,?,00007FF6ADF23D87,?,?,?,00007FF6ADF2199A), ref: 00007FF6ADF212AB

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 1fede2ce2906f86a31a61fba20d832152c1d97c3416575450b93e1fd219656b2
Instruction ID: 4ce2b078aeca4775092773f794d641372c931020e3852b8374723eb1a3b990c5
Opcode Fuzzy Hash: 1fede2ce2906f86a31a61fba20d832152c1d97c3416575450b93e1fd219656b2
Instruction Fuzzy Hash: E6014052F1BA9281EE548BB1A80127B62B0EF55B99F1C4575EE6EC77D4FE3CE440C208

Function 00007FF6ADF2E684 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6ADF2E8D3
RaiseException.KERNEL32 ref: 00007FF6ADF2E8E4

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: bc35c87627de3dd1a88d5e2ee9e1bdafd81a91cfdea2f9c2ccb3cfd3e9e9d4e8
Instruction ID: 59ab77ad8e5860a049f480ece4255a8568348a9919e066c341474439d43fd135
Opcode Fuzzy Hash: bc35c87627de3dd1a88d5e2ee9e1bdafd81a91cfdea2f9c2ccb3cfd3e9e9d4e8
Instruction Fuzzy Hash: 05B15B77A01B888BE755CF29C44536D3BA4F784B4CF248862DAAD877A8DF39D451C700

Function 00007FF6ADF2EE70 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b628bf235ba62c4318178c3a6fb1bf1713f3a4221dc99724d883fdaa4d7d3d7
Instruction ID: fe96b2585debb09be88c05fc7b37a12a96223ce3e3d6bdfe5ce8d64c607a68c7
Opcode Fuzzy Hash: 2b628bf235ba62c4318178c3a6fb1bf1713f3a4221dc99724d883fdaa4d7d3d7
Instruction Fuzzy Hash: FC51E422B19BD145FB209B72E8405AF7BA5FB40BA8F144274EE5CA7A99EE3CD441C700

Function 00007FF6ADF24034 Relevance: 1.5, APIs: 1, Instructions: 13timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6ADF2404E

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: f734f005b1526a683768c733c4d1360d7d632e80defe270ee9b745185bc96e3c
Instruction ID: fa1355f8aa263c13e1ee123bfb69f88f2c8c2cb2fc28ff144024de30ef4a001c
Opcode Fuzzy Hash: f734f005b1526a683768c733c4d1360d7d632e80defe270ee9b745185bc96e3c
Instruction Fuzzy Hash: 6ED01721B3B68083DA44DB25E8C192A63A0FB98B00F442435E95E83714EE2CE4548B00

Function 00007FF6ADF21480 Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6ADF214F6

Part of subcall function 00007FF6ADF252C4: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF6ADF214ED), ref: 00007FF6ADF252D4

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: AcquireExclusiveHeapLockProcess
String ID:
API String ID: 3110430671-0
Opcode ID: 563414313ba3dc698448c7553972e571bf0be662365f026824de9af832a40d26
Instruction ID: 1820d615c53db98604b70a7cdaa6d8122a1231d298f8f4f73f92289c0799f845
Opcode Fuzzy Hash: 563414313ba3dc698448c7553972e571bf0be662365f026824de9af832a40d26
Instruction Fuzzy Hash: 6031DEB290AB8285EA10EB24EA8007B72A5FF50358F904276D95DC73A5FF7CE549C700

Function 00007FF6ADF2C810 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f5abb58053170308caf8deff877c568e4f86768839c398a7dc1e5ae99fa21225
Instruction ID: 1482516fd59141ae084dc218c0a6ec0d9d7bc78d13548bd9dd9b712f97048726
Opcode Fuzzy Hash: f5abb58053170308caf8deff877c568e4f86768839c398a7dc1e5ae99fa21225
Instruction Fuzzy Hash: BF41F672725A9582EF04CF7AD91416AB3A1FB58FC8B099132EE0DD7B58EE3CD1428300

Function 00007FF6ADF33F40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5e43534e802707465050957e70bf5399529dc387e3b7888007180ac056cad1
Instruction ID: 49b51a49143ae9801a9b7902c0f83442d77fce6c6fcd6b5ed49620b61779bff8
Opcode Fuzzy Hash: cc5e43534e802707465050957e70bf5399529dc387e3b7888007180ac056cad1
Instruction Fuzzy Hash: EBF018B17196958ADB94DF39A54363A77E1E748384F908079D58DC3B14DA3CD4518F04

Function 00007FF6ADF25958 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b244d199b6e5d09cf7c74b2f3a9d532b7e4e212249ba900b5f540db00fc453e
Instruction ID: 838780e15832f4ba38ef706a03ced3103ef61ccae12ff2d1d2c3c9e3d23944a4
Opcode Fuzzy Hash: 6b244d199b6e5d09cf7c74b2f3a9d532b7e4e212249ba900b5f540db00fc453e
Instruction Fuzzy Hash: 93A0022190FC52D0EA048B20EC500327370EB50328F460171C83DD3570BF3CE484C721

Function 00007FF6ADF27E48 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6ADF27EA5

Part of subcall function 00007FF6ADF2A208: __GetUnwindTryBlock.LIBCMT ref: 00007FF6ADF2A24B
Part of subcall function 00007FF6ADF2A208: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6ADF2A270

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6ADF27F7D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6ADF281CB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6ADF282D8

Strings

csm, xrefs: 00007FF6ADF27FA0
csm, xrefs: 00007FF6ADF27F26
csm, xrefs: 00007FF6ADF27EBF

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: e1397d26fa57e5e414b193f862f38c9e0ade75eaf9f6893e13a59a89775c5cc8
Instruction ID: 032702c2f009adf346f778683fb28343f1e18a63c7cb9938e8881f64bc8523ca
Opcode Fuzzy Hash: e1397d26fa57e5e414b193f862f38c9e0ade75eaf9f6893e13a59a89775c5cc8
Instruction Fuzzy Hash: C5D18D72A0ABC18AEB209B75D4413AE77A0FB5579CF100175EE4D97B9AEF38E580C740

Function 00007FF6ADF2A650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6ADF2A902,?,?,?,00007FF6ADF274B8,?,?,?,00007FF6ADF262A9), ref: 00007FF6ADF2A6D5
GetLastError.KERNEL32(?,?,?,00007FF6ADF2A902,?,?,?,00007FF6ADF274B8,?,?,?,00007FF6ADF262A9), ref: 00007FF6ADF2A6E3
LoadLibraryExW.KERNEL32(?,?,?,00007FF6ADF2A902,?,?,?,00007FF6ADF274B8,?,?,?,00007FF6ADF262A9), ref: 00007FF6ADF2A70D
FreeLibrary.KERNEL32(?,?,?,00007FF6ADF2A902,?,?,?,00007FF6ADF274B8,?,?,?,00007FF6ADF262A9), ref: 00007FF6ADF2A77B
GetProcAddress.KERNEL32(?,?,?,00007FF6ADF2A902,?,?,?,00007FF6ADF274B8,?,?,?,00007FF6ADF262A9), ref: 00007FF6ADF2A787

Strings

api-ms-, xrefs: 00007FF6ADF2A6F5

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 56b790adfa4111009ad537f86afe25c9ec553e99bf880a7c06dc79edd5a15f8e
Instruction ID: d05ff309319c1c7219dbe7d0fc4ea28da0feb29b1641f6b2097747824cfa08cb
Opcode Fuzzy Hash: 56b790adfa4111009ad537f86afe25c9ec553e99bf880a7c06dc79edd5a15f8e
Instruction Fuzzy Hash: BE31C221B1BA8291EE12DB26B80057673A4FF48BA8F5A0176DD2D87785FF3CE5458305

Function 00007FF6ADF247E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00007FF6ADF2488F
MessageBoxW.USER32 ref: 00007FF6ADF248D2
ExitProcess.KERNEL32 ref: 00007FF6ADF248F0

Strings

base\logging.cc, xrefs: 00007FF6ADF24866
Exception, xrefs: 00007FF6ADF248C4
Exception %x in %s %s %u%hs:%d, xrefs: 00007FF6ADF24871

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ExitMessageProcesswsprintf
String ID: Exception$Exception %x in %s %s %u%hs:%d$base\logging.cc
API String ID: 1070390611-1730742759
Opcode ID: 3bf2240787664950a3e01168afc44e1317150f748665854e7e78e545325cb5bb
Instruction ID: 4ab1b5c73410909997008e5f930fd8e6dacbf7b9a9cd3cc24979bc14b3e5bcc6
Opcode Fuzzy Hash: 3bf2240787664950a3e01168afc44e1317150f748665854e7e78e545325cb5bb
Instruction Fuzzy Hash: 4631BE32A19AC681E710DB35E44026BB3A0FF94B68F554236E96D837E4EF7CD545CB40

Function 00007FF6ADF2D5C4 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6ADF2D5D3
FlsGetValue.KERNEL32 ref: 00007FF6ADF2D5E8
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D609
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D636
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D647
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D658
SetLastError.KERNEL32 ref: 00007FF6ADF2D673

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f6e33aa8023605974a1217e6d339928d80800c309880df1cffbb9ba71b1bcd58
Instruction ID: 16c2f2c3419d9dd1d3818fdd760eabfc791fc76f51e8a483a8d56933b7f1168d
Opcode Fuzzy Hash: f6e33aa8023605974a1217e6d339928d80800c309880df1cffbb9ba71b1bcd58
Instruction Fuzzy Hash: F3218E20E0B7C242FA5863715E6513B6282EF44FB8F140774E93E87AD6FE2CB4014681

Function 00007FF6ADF34300 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6ADF34331
GetLastError.KERNEL32 ref: 00007FF6ADF3433D
CloseHandle.KERNEL32 ref: 00007FF6ADF34355
CreateFileW.KERNEL32 ref: 00007FF6ADF34380
WriteConsoleW.KERNEL32 ref: 00007FF6ADF3439F

Strings

CONOUT$, xrefs: 00007FF6ADF34361

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c039ff364faea56357dfef4cc99fd1765a74bd1cee96fe228580939cdd107833
Instruction ID: 6bdae393cadde3e74a883e2a5aa6d7c592fb4650057f26d30e06eac69186da66
Opcode Fuzzy Hash: c039ff364faea56357dfef4cc99fd1765a74bd1cee96fe228580939cdd107833
Instruction Fuzzy Hash: 23119021B29B8182E7508B62E94432AB6A0FB88FE4F054234EE7EC7794EF7CD4448741

Function 00007FF6ADF28318 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 319COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6ADF284B6
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6ADF287DF

Strings

csm, xrefs: 00007FF6ADF284DD
csm, xrefs: 00007FF6ADF283FD
csm, xrefs: 00007FF6ADF2845F

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 05bbd918d9eb401b641d0de1b075adf657755be5447ac02583787240f03097ab
Instruction ID: 3b15e6a7b4b00eacf0cffd8cd89fea8a80047182a90a8fd7ab7d496d3468df32
Opcode Fuzzy Hash: 05bbd918d9eb401b641d0de1b075adf657755be5447ac02583787240f03097ab
Instruction Fuzzy Hash: 37E19E7290A6C28AEB209F75D8813EE7BA0FB4475CF145176DE8D87696EF38E581C700

Function 00007FF6ADF2D73C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000066C9EB337148,00007FF6ADF2AFB9,?,?,?,?,00007FF6ADF2E5C6,?,?,00000000,00007FF6ADF2B633,?,?,?), ref: 00007FF6ADF2D74B
FlsSetValue.KERNEL32(?,?,000066C9EB337148,00007FF6ADF2AFB9,?,?,?,?,00007FF6ADF2E5C6,?,?,00000000,00007FF6ADF2B633,?,?,?), ref: 00007FF6ADF2D781
FlsSetValue.KERNEL32(?,?,000066C9EB337148,00007FF6ADF2AFB9,?,?,?,?,00007FF6ADF2E5C6,?,?,00000000,00007FF6ADF2B633,?,?,?), ref: 00007FF6ADF2D7AE
FlsSetValue.KERNEL32(?,?,000066C9EB337148,00007FF6ADF2AFB9,?,?,?,?,00007FF6ADF2E5C6,?,?,00000000,00007FF6ADF2B633,?,?,?), ref: 00007FF6ADF2D7BF
FlsSetValue.KERNEL32(?,?,000066C9EB337148,00007FF6ADF2AFB9,?,?,?,?,00007FF6ADF2E5C6,?,?,00000000,00007FF6ADF2B633,?,?,?), ref: 00007FF6ADF2D7D0
SetLastError.KERNEL32(?,?,000066C9EB337148,00007FF6ADF2AFB9,?,?,?,?,00007FF6ADF2E5C6,?,?,00000000,00007FF6ADF2B633,?,?,?), ref: 00007FF6ADF2D7EB

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8a924690bce9fdd111f9bb3401fd416453b66af72d43d5ddcd9c16dbcd8df4f0
Instruction ID: 47a68d1ba66e247fd2fd3407d8844819f6a8a1f119016014468e712a43bf376f
Opcode Fuzzy Hash: 8a924690bce9fdd111f9bb3401fd416453b66af72d43d5ddcd9c16dbcd8df4f0
Instruction Fuzzy Hash: C9114D24E0F78242FA5867716E6513B6292DF44FB8F144774E83EC76D6FE2CB4028681

Function 00007FF6ADF2C514 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6ADF2C539
GetProcAddress.KERNEL32 ref: 00007FF6ADF2C54F
FreeLibrary.KERNEL32 ref: 00007FF6ADF2C576

Strings

mscoree.dll, xrefs: 00007FF6ADF2C530
CorExitProcess, xrefs: 00007FF6ADF2C548

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e30779ec795631c203037f7c8339e00691c419557dcb5048ec1b316f4552f117
Instruction ID: 6bd55ee4b969a6cfeae75c5112a3422adca184b4316956d1549a89e3c6ab5d69
Opcode Fuzzy Hash: e30779ec795631c203037f7c8339e00691c419557dcb5048ec1b316f4552f117
Instruction Fuzzy Hash: DFF06265A0AB4291EA148B34E85537BA320EF49B65F550635CA7EC76F4EF3CD088C711

Function 00007FF6ADF27718 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF6ADF2783B
__AdjustPointer.LIBCMT ref: 00007FF6ADF27886

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1bf3bc4ad53d99018378158cf405500ceadc08bb50907adabc42e4c04bc8c28e
Instruction ID: eb9e7aece3312cdc0d1865aec2c5b5a21dd164f5c15c1cae67bd090e0adc8be9
Opcode Fuzzy Hash: 1bf3bc4ad53d99018378158cf405500ceadc08bb50907adabc42e4c04bc8c28e
Instruction Fuzzy Hash: 7AB1CFB2A0FBC281EA658B35948067B6290EF44B9CF1984B6DE4D87795FF3CE841C301

Function 00007FF6ADF33D58 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6ADF33D80
_set_statfp.LIBCMT ref: 00007FF6ADF33D9B
_set_statfp.LIBCMT ref: 00007FF6ADF33DB7
_set_statfp.LIBCMT ref: 00007FF6ADF33DF3

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 6678863bc1662e34b4404f8bd50b92320c7bc59b1194ecab7f8a9474a1aa5830
Instruction ID: c545f08e27a2ae0a631b94dc20c27cfbc6ab10289f8c599d6191e41c85f99722
Opcode Fuzzy Hash: 6678863bc1662e34b4404f8bd50b92320c7bc59b1194ecab7f8a9474a1aa5830
Instruction Fuzzy Hash: 2811E322F5EA8B01F7549138D45237B95C0FF55374F1A2634ED7E8B3DAEE2EA8414202

Function 00007FF6ADF2D804 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6ADF2AB07,?,?,00000000,00007FF6ADF2ADA2,?,?,?,?,?,00007FF6ADF2AD2E), ref: 00007FF6ADF2D823
FlsSetValue.KERNEL32(?,?,?,00007FF6ADF2AB07,?,?,00000000,00007FF6ADF2ADA2,?,?,?,?,?,00007FF6ADF2AD2E), ref: 00007FF6ADF2D842
FlsSetValue.KERNEL32(?,?,?,00007FF6ADF2AB07,?,?,00000000,00007FF6ADF2ADA2,?,?,?,?,?,00007FF6ADF2AD2E), ref: 00007FF6ADF2D86A
FlsSetValue.KERNEL32(?,?,?,00007FF6ADF2AB07,?,?,00000000,00007FF6ADF2ADA2,?,?,?,?,?,00007FF6ADF2AD2E), ref: 00007FF6ADF2D87B
FlsSetValue.KERNEL32(?,?,?,00007FF6ADF2AB07,?,?,00000000,00007FF6ADF2ADA2,?,?,?,?,?,00007FF6ADF2AD2E), ref: 00007FF6ADF2D88C

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1e32f2c5f5ae5de83df26ddc8a2638748a9463e4c658ab7940fe64ae99ac88c2
Instruction ID: d93b4a39bc5a53c0e8fa20bd256b381ca09da73f6c66c760eba09bbf24759f73
Opcode Fuzzy Hash: 1e32f2c5f5ae5de83df26ddc8a2638748a9463e4c658ab7940fe64ae99ac88c2
Instruction Fuzzy Hash: 45114F60E0B3C241FA5867755E611BB2191EF85BB8F5C87B4E83D876D6FE2CF4418281

Function 00007FF6ADF2D698 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6ADF2D6A9
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D6C8
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D6F0
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D701
FlsSetValue.KERNEL32 ref: 00007FF6ADF2D712

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a23ab7ede3433fb07216e1e677d2b9d936622034e04effeeb0c77d0087477cf5
Instruction ID: 3ab8f9e0a712a801977037676f960b271019bc8aa47afcbbbd1c383fc501b0a4
Opcode Fuzzy Hash: a23ab7ede3433fb07216e1e677d2b9d936622034e04effeeb0c77d0087477cf5
Instruction Fuzzy Hash: B9111864E0B78705FA58A2B55C6617B2181CF45B7CF5807B4D93E8B2D2FE2CB4028681

Function 00007FF6ADF24768 Relevance: 7.5, APIs: 5, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FF6ADF24780
GetTickCount.KERNEL32 ref: 00007FF6ADF2478A
Sleep.KERNEL32 ref: 00007FF6ADF24794
TryEnterCriticalSection.KERNEL32 ref: 00007FF6ADF2479D
GetTickCount.KERNEL32 ref: 00007FF6ADF247A7

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CountCriticalEnterSectionTick$Sleep
String ID:
API String ID: 1544504822-0
Opcode ID: 5cf277748db217da2b457035f22cbb9722ae791f86d79aa18adc612ff8ede84a
Instruction ID: c336c9608e0b306aa3e41b84baec1564bfbff0b0ce524d4f2a61969147ba3498
Opcode Fuzzy Hash: 5cf277748db217da2b457035f22cbb9722ae791f86d79aa18adc612ff8ede84a
Instruction Fuzzy Hash: 84F09031A0AA8292EB509F31BD4403FA3A0EF59F84F114074DA3EC3655EF6CE4858201

Function 00007FF6ADF28A8C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6ADF28AFC
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6ADF28B47

Strings

RCC, xrefs: 00007FF6ADF28B18
MOC, xrefs: 00007FF6ADF28B10

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: b770a33f19432dfb883f7dd34f837ec9993f1f526b1bf5a3ef4edaa48a7dc520
Instruction ID: 8e1a37d74350e4a98eb3bcc2a5c94d5b4a965306774697076f6eb738a77d07c9
Opcode Fuzzy Hash: b770a33f19432dfb883f7dd34f837ec9993f1f526b1bf5a3ef4edaa48a7dc520
Instruction Fuzzy Hash: E9917E73A0AB918AEB50CB75D8802EE7BB0FB44788F14416AEA4D97B55EF3CD195C700

Function 00007FF6ADF26060 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6ADF2608B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6ADF26122
RtlUnwindEx.KERNEL32 ref: 00007FF6ADF2617C

Strings

csm, xrefs: 00007FF6ADF26109

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 95400a70ffba255910a8eba6251ef1d1a76c203fa19fe6ec779101a849a1473e
Instruction ID: 0c55dae469a72086a324c7d78998b6461355fd64cd5ba1a3247b9cf0497a7483
Opcode Fuzzy Hash: 95400a70ffba255910a8eba6251ef1d1a76c203fa19fe6ec779101a849a1473e
Instruction Fuzzy Hash: 9C51A331B1A6829AEB14CF25D84467A73A1EB64B8CF118175DE6D83789FF7CE841C700

Function 00007FF6ADF2900C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6ADF29034
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6ADF2911C

Strings

csm, xrefs: 00007FF6ADF2916E
csm, xrefs: 00007FF6ADF29056

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: bf219186f680495e691f6d2a2d115e07fa60f977b01424d17790efaca19a03eb
Instruction ID: c62cf49d4fa4664c03066301e57d56f8ec91d40534fa20a6a8b118473c7f3b5b
Opcode Fuzzy Hash: bf219186f680495e691f6d2a2d115e07fa60f977b01424d17790efaca19a03eb
Instruction Fuzzy Hash: C651B032A492C286EB748B32944526A76B0FB59B98F1841B5DE9CC3BC5DF3CE461CB01

Function 00007FF6ADF2881C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6ADF2887B
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6ADF288C7

Strings

RCC, xrefs: 00007FF6ADF28897
MOC, xrefs: 00007FF6ADF2888F

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8289e69907f3bf529c01b0df9455cddab0e14875c13545cf760911e82707e5d8
Instruction ID: 9129716b43ec5f0655935dc9c38a1258716ff9679a10176f3b9880882bffde3c
Opcode Fuzzy Hash: 8289e69907f3bf529c01b0df9455cddab0e14875c13545cf760911e82707e5d8
Instruction Fuzzy Hash: 5261B232909BC586DB608B25E4403EBBBA0FB85B98F044235EB9C47B55EF3CD194CB00

Function 00007FF6ADF3266C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6ADF326EB
WriteFile.KERNEL32 ref: 00007FF6ADF329B3
WriteFile.KERNEL32 ref: 00007FF6ADF329F9
GetLastError.KERNEL32 ref: 00007FF6ADF32AAF

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0f9a222ce5cde8de3c720e2b16ac4d6c457a586d2efdf849933d49e3810a4a87
Instruction ID: ab332aae2ea379647cd3e22cdc05436fa9ee6c14350d0a546af465a189c4bb3f
Opcode Fuzzy Hash: 0f9a222ce5cde8de3c720e2b16ac4d6c457a586d2efdf849933d49e3810a4a87
Instruction Fuzzy Hash: 27D10632B1AA819AEB11CF75D8402AD77B1FB54B98B054235CF6DDBB99EE38D406C340

Function 00007FF6ADF32F94 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF6ADF32F7F), ref: 00007FF6ADF330B0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF6ADF32F7F), ref: 00007FF6ADF3313B

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a8a520f721b93a4319f37ac694fe2f258c72ea617a0ee2ff615a45705dd5a7be
Instruction ID: 11dc0c0a751928cb9a9bc1de0f63efce810bf1e19e71c13efb647ed7078f69c6
Opcode Fuzzy Hash: a8a520f721b93a4319f37ac694fe2f258c72ea617a0ee2ff615a45705dd5a7be
Instruction Fuzzy Hash: 2491F362F0969295F750DF7998802BEABE0FB01B88F155139DE2E97685EF3CD481C702

Function 00007FF6ADF24D30 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF6ADF21328,?,00000000,?,00007FF6ADF21C9C,?,?,?,00007FF6ADF23D87,?,?,?,00007FF6ADF2199A), ref: 00007FF6ADF24D4E
LeaveCriticalSection.KERNEL32(?,?,?,00007FF6ADF21328,?,00000000,?,00007FF6ADF21C9C,?,?,?,00007FF6ADF23D87,?,?,?,00007FF6ADF2199A), ref: 00007FF6ADF24D6C
_set_fmode.LIBCMT ref: 00007FF6ADF24DBB
_RTC_Initialize.LIBCMT ref: 00007FF6ADF24DDC

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave_set_fmode
String ID:
API String ID: 2803588085-0
Opcode ID: 319e829813a59827e7a967cf8d9271d800474e4b2e09c73e0c3742706994a173
Instruction ID: c5ba614161f99cabf20ae929cdd424605ee7d93c7dc41df511f41ba6c6b4a33e
Opcode Fuzzy Hash: 319e829813a59827e7a967cf8d9271d800474e4b2e09c73e0c3742706994a173
Instruction Fuzzy Hash: 5F314B20E5E6C782FA2477B1A8461BF52A0EF94758F8404B0EA0DC7BD7FE6CF8454612

Function 00007FF6ADF2565C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6ADF25688
GetCurrentThreadId.KERNEL32 ref: 00007FF6ADF25696
GetCurrentProcessId.KERNEL32 ref: 00007FF6ADF256A2
QueryPerformanceCounter.KERNEL32 ref: 00007FF6ADF256B2

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 28b2221adaf7ab3c9ddc0ea3f2ab86addf46026c1b07f177c2c295a23517d33c
Instruction ID: 49e49900d44c9f680bdcc02d6f293076adea0a0939ff71a00f301d7abc938ef0
Opcode Fuzzy Hash: 28b2221adaf7ab3c9ddc0ea3f2ab86addf46026c1b07f177c2c295a23517d33c
Instruction Fuzzy Hash: 8D111822B65B018AEB008B74E8542AA73A4FB19B58F450E35EE6D877A4EF7CD1948340

Function 00007FF6ADF29244 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6ADF2926E

Strings

csm, xrefs: 00007FF6ADF29293
csm, xrefs: 00007FF6ADF29402

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: b3d48a40b1774b01cd38955d26c3fd24897af4efe411d6b9e78751d6f8a38cbc
Instruction ID: 61276872adb29702f1991c7b10b1bc7e353857ff3f36d187f1cf8323b00de477
Opcode Fuzzy Hash: b3d48a40b1774b01cd38955d26c3fd24897af4efe411d6b9e78751d6f8a38cbc
Instruction Fuzzy Hash: 85719D7290A6C186DB608B35D4607BA7BB0FB05B8DF149171DE8C87B89EF2CE590C741

Function 00007FF6ADF298DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6ADF29986
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6ADF299AF

Strings

csm, xrefs: 00007FF6ADF29AAF

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 1f24b57c7a8d8824615166ef61e841d6581ee2d9aaaae3d972262b6119ac11ca
Instruction ID: d22493e42fa6c149895ecc0eee8892ea89a20ec52d639bd5902fac860ec9a720
Opcode Fuzzy Hash: 1f24b57c7a8d8824615166ef61e841d6581ee2d9aaaae3d972262b6119ac11ca
Instruction Fuzzy Hash: 5A512D7261A78187E624AB26E44026F77B4FB88B98F141175EF8D87B55EF38E491CB00

Function 00007FF6ADF32D04 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6ADF32E1B
GetLastError.KERNEL32 ref: 00007FF6ADF32E3D

Strings

U, xrefs: 00007FF6ADF32DC7

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 473395880f556805712db762a63d956a48fc9498859e52d7557dfa538f7aa7d1
Instruction ID: d3707bf671c459570a47fb4669aa2f2f20e746e8bac85804c994a61dffbdd20e
Opcode Fuzzy Hash: 473395880f556805712db762a63d956a48fc9498859e52d7557dfa538f7aa7d1
Instruction Fuzzy Hash: 6141C362B1AA8191DB209F35E4443AAA7A0FB98B84F454131EE5DC7798EF3CD541C741

Function 00007FF6ADF271E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6ADF25FBE), ref: 00007FF6ADF27234
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6ADF25FBE), ref: 00007FF6ADF27275

Strings

csm, xrefs: 00007FF6ADF27262

Memory Dump Source

Source File: 00000000.00000002.2121362492.00007FF6ADF21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6ADF20000, based on PE: true

Associated: 00000000.00000002.2121345719.00007FF6ADF20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121380042.00007FF6ADF36000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121395375.00007FF6ADF43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121411446.00007FF6ADF47000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6adf20000_BraveUpdateComRegisterShell64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f044d429b39af39a8b648e1ce86139056c78b3059d88f327f90d768c7320bfa9
Instruction ID: 806e4faba497b981aa8b1da22d4990adebe5ee78548eb671f16bcf1785507b0f
Opcode Fuzzy Hash: f044d429b39af39a8b648e1ce86139056c78b3059d88f327f90d768c7320bfa9
Instruction Fuzzy Hash: 57113072619B8182EB618F25F84026AB7E4FB88B98F584270EF9D47758EF3CD5518B00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BraveUpdateComRegisterShell64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: BraveUpdateComRegisterShell64.exePID: 4952, Parent PID: 4004

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Section Activities

Sections loaded by Windows

Sections loaded by Program

Registry Activities

Windows Analysis Report
BraveUpdateComRegisterShell64.exe

Function 00007FF6ADF243E4 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 151
registryCOMMON

Function 00007FF6ADF23A78 Relevance: 4.5, APIs: 3, Instructions: 33
libraryloaderCOMMON

Function 00007FF6ADF2D960 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Function 00007FF6ADF24B48 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 67
libraryloaderCOMMON

Function 00007FF6ADF24A08 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
registryCOMMON

Function 00007FF6ADF24070 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 157
stringCOMMON

Function 00007FF6ADF24158 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 146
COMMON

Function 00007FF6ADF2C4BC Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF6ADF2268C Relevance: 3.2, APIs: 2, Instructions: 237
COMMON

Function 00007FF6ADF24E88 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Function 00007FF6ADF2C3ED Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00007FF6ADF30430 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FF6ADF2DDFC Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE