Edit tour

Windows Analysis Report
8TuwlFKxC5.dll

Overview

General Information

Sample name:	8TuwlFKxC5.dll renamed because original name is a hash value
Original sample name:	da6d952b6509ce400e9ea2098ba796f9.dll
Analysis ID:	1541899
MD5:	da6d952b6509ce400e9ea2098ba796f9
SHA1:	cce66c35c8e3028f296b7793cd4dbb0a9baafe19
SHA256:	ad9513cf9a7f6a59bc7ed9a2bea44ec5e4bb655d18384336c0c124bfa2140286
Tags:	32dllexetrojan
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Sigma detected: Potential WinAPI Calls Via CommandLine

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5688 cmdline: loaddll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5908 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4592 cmdline: rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1520 cmdline: rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 432 cmdline: rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,NtUnloadDllMemoryAndExitThread MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4564 cmdline: rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",FreeLibraryMemoryAndExitThread MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5356 cmdline: rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",NtUnloadDllMemoryAndExitThread MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potential WinAPI Calls Via CommandLine

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread, CommandLine: rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: loaddll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll", ParentImage: C:\Windows\System32\loaddll32.exe, ParentProcessId: 5688, ParentProcessName: loaddll32.exe, ProcessCommandLine: rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread, ProcessId: 1520, ProcessName: rundll32.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 8TuwlFKxC5.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: 8TuwlFKxC5.dll

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0C7B84 CryptStringToBinaryA,CryptStringToBinaryA,

3_2_6E0C7B84

Source: 8TuwlFKxC5.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: 8TuwlFKxC5.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0B4DD0 NtUnloadDllMemoryAndExitThread,

3_2_6E0B4DD0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0CFE8F	3_2_6E0CFE8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0CDED6	3_2_6E0CDED6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0D67FE	3_2_6E0D67FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0CA2C0	3_2_6E0CA2C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0D6350	3_2_6E0D6350
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0C811F	3_2_6E0C811F

Source: 8TuwlFKxC5.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal64.winDLL@14/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03

Source: 8TuwlFKxC5.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread

Source: 8TuwlFKxC5.dll

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,NtUnloadDllMemoryAndExitThread
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",FreeLibraryMemoryAndExitThread
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",NtUnloadDllMemoryAndExitThread
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,NtUnloadDllMemoryAndExitThread	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",FreeLibraryMemoryAndExitThread	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",NtUnloadDllMemoryAndExitThread	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: 8TuwlFKxC5.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 8TuwlFKxC5.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 8TuwlFKxC5.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 8TuwlFKxC5.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 8TuwlFKxC5.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 8TuwlFKxC5.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 8TuwlFKxC5.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: 8TuwlFKxC5.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 8TuwlFKxC5.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8TuwlFKxC5.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8TuwlFKxC5.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8TuwlFKxC5.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8TuwlFKxC5.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0C7868 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6E0C7868

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0C9A06 push ecx; ret		3_2_6E0C9A19
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0C8BC5 push ecx; ret		3_2_6E0C8BD8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0C811F std::_Xinvalid_argument,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6E0C811F

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-14078

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 7.6 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0C9841 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_6E0C9841

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0C7868 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6E0C7868

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0D05B1 mov eax, dword ptr fs:[00000030h]

3_2_6E0D05B1

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0D375D GetProcessHeap,

3_2_6E0D375D

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0C9841 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E0C9841
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0C9609 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6E0C9609
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E0D1283 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E0D1283

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0C9A1B cpuid

3_2_6E0C9A1B

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E0C9764 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_6E0C9764

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8TuwlFKxC5.dll	68%	ReversingLabs	Win32.Trojan.Generic
8TuwlFKxC5.dll	100%	Avira	TR/AVI.Agent.uwasx

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541899
Start date and time:	2024-10-25 09:47:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8TuwlFKxC5.dll renamed because original name is a hash value
Original Sample Name:	da6d952b6509ce400e9ea2098ba796f9.dll
Detection:	MAL
Classification:	mal64.winDLL@14/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 8TuwlFKxC5.dll

Simulations

Behavior and APIs

Time	Type	Description
03:48:13	API Interceptor	1x Sleep call for process: loaddll32.exe modified

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8631787601033265
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8TuwlFKxC5.dll
File size:	241'664 bytes
MD5:	da6d952b6509ce400e9ea2098ba796f9
SHA1:	cce66c35c8e3028f296b7793cd4dbb0a9baafe19
SHA256:	ad9513cf9a7f6a59bc7ed9a2bea44ec5e4bb655d18384336c0c124bfa2140286
SHA512:	6ea810c92b126d68796eacd69f9abccfad40aa73dda3e94a2fea1079925c65f2aa29df8a6cb88c2627f3446f0ffe78619471960fd9f1ec05d1607e397dfd9e68
SSDEEP:	3072:LMVZ7NHajTpjxoY7doVFNEYUHsSpg1Wpw4BU2r4aKZXew4L27U7GitjxKYF5PXxD:o7NHajjoiw7EbHsSZm2rzqXeGYXF5P
TLSH:	40347CD27A6381F3D26E4B3500ADC53B5A38A63617A5CAEBD3D05C3D7E217C16630E1A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.37cw]dcw]dcw]d...dmw]d...d.w]d...dzw]d...dbw]d..^etw]d...djw]dcw\d.w]d..Xe.w]d..Yetw]dcw]dgw]d..Yebw]d..Xeaw]d..]ebw]d...dbw]

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10018fa2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6715ED2B [Mon Oct 21 05:56:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	294349e3872fd2e2a711c642739f8d71

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F7E10707A57h
call 00007F7E10708209h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F7E10707906h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
push ebx
push esi
push edi
push 00000000h
push 00000FA0h
push 10039538h
call 00007F7E1070A326h
add esp, 0Ch
push 1002C2CCh
call dword ptr [1002B040h]
mov esi, eax
test esi, esi
je 00007F7E10707AE2h
push 1002C50Ch
push esi
call dword ptr [1002B01Ch]
push 1002C55Ch
push esi
mov ebx, eax
call dword ptr [1002B01Ch]
push 1002C540h
push esi
mov edi, eax
call dword ptr [1002B01Ch]
mov esi, eax
test ebx, ebx
je 00007F7E10707A89h
test edi, edi
je 00007F7E10707A85h
test esi, esi
je 00007F7E10707A81h
and dword ptr [10039554h], 00000000h
mov ecx, ebx
push 10039550h
call 00007F7E10707CAEh
call ebx
push edi
call 00007F7E10707CDDh
push esi
mov dword ptr [10039558h], eax
call 00007F7E10707CD2h
pop ecx
pop ecx
mov dword ptr [1003955Ch], eax
jmp 00007F7E10707A68h
xor eax, eax
push eax
push eax
push 00000001h
push eax
call dword ptr [1002B078h]
mov dword ptr [10039554h], eax

Rich Headers

Programming Language:

[ C ] VS2015 build 23026
[C++] VS2015 build 23026
[EXP] VS2015 build 23026
[RES] VS2015 build 23026
[LNK] VS2015 build 23026

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x34290	0x85	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34318	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x288	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d000	0x33ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x330c0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x33154	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x330f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x160	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2972f	0x29800	84621c9831745af74595ad40aa5deecd	False	0.5457454819277109	data	6.774633127237972	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x9afa	0x9c00	628165d1fdabc39adcf9ed10dfca9449	False	0.5496544471153846	data	5.794625899194168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x5020	0x3e00	d5adb8b8e4881d883bccc5bb90cf1df3	False	0.48481602822580644	data	7.0631628978847365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3b000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c000	0x288	0x400	a808368e771c27a25a8bf59b0125efb5	False	0.3330078125	data	3.852800632054433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d000	0x33ec	0x3400	d11266207a6f19993524d9a707ee573f	False	0.5196063701923077	data	6.43692802092624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x3c060	0x224	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (488), with CRLF line terminators	English	United States	0.531021897810219

Imports

DLL	Import
USER32.dll	wsprintfW
CRYPT32.dll	CryptStringToBinaryA
KERNEL32.dll	IsDebuggerPresent, GetCurrentProcess, FreeLibrary, GetProcAddress, LoadLibraryW, VirtualProtect, CreateFileW, GetFileSize, ReadFile, CloseHandle, SetLastError, GetLastError, GetModuleHandleW, GetModuleHandleA, GetNativeSystemInfo, VirtualAlloc, LoadLibraryA, VirtualFree, GetThreadLocale, lstrlenW, QueryPerformanceCounter, WaitForSingleObjectEx, Sleep, GetCurrentThread, GetCurrentThreadId, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, EnterCriticalSection, LeaveCriticalSection, SetEvent, ResetEvent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, GetStartupInfoW, EncodePointer, GetThreadTimes, GetModuleFileNameW, LoadLibraryExW, InterlockedFlushSList, DeleteCriticalSection, RtlUnwind, RaiseException, VirtualQuery, MultiByteToWideChar, GetModuleHandleExW, HeapAlloc, HeapFree, ExitProcess, WideCharToMultiByte, GetACP, GetStdHandle, GetFileType, GetStringTypeW, LCMapStringW, GetProcessHeap, IsValidCodePage, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetCommandLineA, GetCommandLineW, FlushFileBuffers, WriteFile, GetConsoleCP, GetConsoleMode, SetStdHandle, SetFilePointerEx, HeapSize, HeapReAlloc, WriteConsoleW, DecodePointer
ADVAPI32.dll	SystemFunction036

Exports

Name	Ordinal	Address
FreeLibraryMemoryAndExitThread	1	0x10004dd0
NtUnloadDllMemoryAndExitThread	2	0x10004dd0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	03:48:01
Start date:	25/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll"
Imagebase:	0x450000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:48:01
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:48:01
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:48:01
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,FreeLibraryMemoryAndExitThread
Imagebase:	0x4c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:48:01
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",#1
Imagebase:	0x4c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:48:04
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\8TuwlFKxC5.dll,NtUnloadDllMemoryAndExitThread
Imagebase:	0x4c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:48:13
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",FreeLibraryMemoryAndExitThread
Imagebase:	0x4c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:48:13
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\8TuwlFKxC5.dll",NtUnloadDllMemoryAndExitThread
Imagebase:	0x4c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.8%
Total number of Nodes:	280
Total number of Limit Nodes:	3

Executed Functions

Function 6E0C7868 Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 234
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E0C7422: LoadLibraryW.KERNEL32(?,00000001,00000000,?), ref: 6E0C74FC
Part of subcall function 6E0C7422: LoadLibraryW.KERNEL32(?), ref: 6E0C750A
Part of subcall function 6E0C7422: GetProcAddress.KERNEL32(00000000,?), ref: 6E0C752F
Part of subcall function 6E0C7422: GetProcAddress.KERNEL32(00000000,?), ref: 6E0C753C
Part of subcall function 6E0C7422: GetProcAddress.KERNEL32(00000000,00000047), ref: 6E0C7546

LoadLibraryW.KERNEL32(?,00000001,00000000,?), ref: 6E0C794F
LoadLibraryW.KERNEL32(?), ref: 6E0C7957
GetProcAddress.KERNEL32(00000000,?), ref: 6E0C7A3A
GetProcAddress.KERNEL32(00000000,?), ref: 6E0C7A49
GetProcAddress.KERNEL32(00000000,?), ref: 6E0C7A58
GetProcAddress.KERNEL32(00000000,?), ref: 6E0C7A67
GetProcAddress.KERNEL32(00000000,00006150), ref: 6E0C7A73
GetProcAddress.KERNEL32(00000000,?), ref: 6E0C7A82

Strings

hApp, xrefs: 6E0C7A22
cW, xrefs: 6E0C7A10
ndW, xrefs: 6E0C7A2C
F, xrefs: 6E0C79CC
W, xrefs: 6E0C79E4
v, xrefs: 6E0C79C5
l, xrefs: 6E0C79D0
rary, xrefs: 6E0C79ED
ExW, xrefs: 6E0C79D7
Call, xrefs: 6E0C79F7
Pa, xrefs: 6E0C7A19
M, xrefs: 6E0C79C1
s, xrefs: 6E0C7A01

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Call$ExW$F$M$Pa$W$cW$hApp$l$ndW$rary$s$v
API String ID: 2238633743-375626469
Opcode ID: b11894b946d4b8df0d918e5c068b50fc11e195bf83a08cd542d2faa70f41a7fb
Instruction ID: 33c4898e0ced88da877b9d860a144077e1ce67010db8885d8d452ad9b5aa95b3
Opcode Fuzzy Hash: b11894b946d4b8df0d918e5c068b50fc11e195bf83a08cd542d2faa70f41a7fb
Instruction Fuzzy Hash: 9D914F21D1439CD9EB10CBF4D941BEEB7B4FF69700F14555AD508EB2A1E7710A84CB2A

Function 6E0C7422 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 182
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00000001,00000000,?), ref: 6E0C74FC
LoadLibraryW.KERNEL32(?), ref: 6E0C750A
GetProcAddress.KERNEL32(00000000,?), ref: 6E0C752F
GetProcAddress.KERNEL32(00000000,?), ref: 6E0C753C
GetProcAddress.KERNEL32(00000000,00000047), ref: 6E0C7546
FreeLibrary.KERNEL32(00000000), ref: 6E0C7673

Part of subcall function 6E0C73DE: __Thrd_sleep.LIBCPMT ref: 6E0C740A

FreeLibrary.KERNEL32(?), ref: 6E0C765F
FreeLibrary.KERNEL32(00000000), ref: 6E0C7662
FreeLibrary.KERNEL32(00000000), ref: 6E0C7678
FreeLibrary.KERNEL32(00000000), ref: 6E0C767F

Strings

t, xrefs: 6E0C74D6
G, xrefs: 6E0C74E0
qu, xrefs: 6E0C74BB
kCou, xrefs: 6E0C74EE
F, xrefs: 6E0C74B1
Coun, xrefs: 6E0C74CF
ncy, xrefs: 6E0C74C4
nt64, xrefs: 6E0C74F5
tTic, xrefs: 6E0C74E7

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: Library$Free$AddressProc$Load$Thrd_sleep
String ID: Coun$F$G$kCou$ncy$nt64$qu$t$tTic
API String ID: 1212583105-1930867906
Opcode ID: f85ba3001b2bd65f7da76d70dd6fb89fd86b00f3d7f0fefd5e23a8e658c37761
Instruction ID: 239dde13c1ae74b6d8b06c7b980e311a2aae466a1e65d45eee3265dba49d6045
Opcode Fuzzy Hash: f85ba3001b2bd65f7da76d70dd6fb89fd86b00f3d7f0fefd5e23a8e658c37761
Instruction Fuzzy Hash: 21715C32D0475D9ADF21CBF8C850BEEBBB8BF19740F14429AD908B7281DB705A85CB65

Function 6E0C7694 Relevance: 9.2, APIs: 6, Instructions: 157
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000078,0000002E,00000065), ref: 6E0C77B4
PathRemoveFileSpecW.SHLWAPI(?), ref: 6E0C77CA
PathAppendW.SHLWAPI(?,6E0C7B33), ref: 6E0C77EF
PathFileExistsW.KERNELBASE(?), ref: 6E0C7800
PathAppendW.SHLWAPI(?,6E0C7B33), ref: 6E0C782E
MoveFileExW.KERNELBASE(?,?,00000001), ref: 6E0C7848

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: FilePath$Append$ExistsModuleMoveNameRemoveSpec
String ID:
API String ID: 4096670196-0
Opcode ID: 18ab0ebed11ef29c13fe3585c2b6c5ee8ec23853d4daa33f1eb0f442242213c6
Instruction ID: 0d46eefbc1467e6bec7933c05d279257bf8df29065f15380ed236e19b691a8e6
Opcode Fuzzy Hash: 18ab0ebed11ef29c13fe3585c2b6c5ee8ec23853d4daa33f1eb0f442242213c6
Instruction Fuzzy Hash: 4B517D31A54349A9EF50CBE0DC55FEE73B8EF44B00F14046AE608E71D0E7718A84CBAA

Function 6E0C8E6F Relevance: 9.1, APIs: 6, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6E0C8E99
dllmain_crt_dispatch.LIBCMT ref: 6E0C8EB0
dllmain_crt_dispatch.LIBCMT ref: 6E0C8EF5
dllmain_raw.LIBCMT ref: 6E0C8EFF
dllmain_crt_dispatch.LIBCMT ref: 6E0C8F26
dllmain_raw.LIBCMT ref: 6E0C8F39

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: dllmain_crt_dispatchdllmain_raw
String ID:
API String ID: 1382799047-0
Opcode ID: 4e33bcde253d02d99fa69706b5b726d293647bcbb509677aeb3d0e14e132f894
Instruction ID: a4a6cf737aedc35e23864c4d2a9bcd246bf7ea08079c775a11a941f587af1db5
Opcode Fuzzy Hash: 4e33bcde253d02d99fa69706b5b726d293647bcbb509677aeb3d0e14e132f894
Instruction Fuzzy Hash: 9E216572D01726ABCB519EE5CC40B9F2ABEAF49F94F050A04F92537155C734E4128BB6

Function 6E0C7D52 Relevance: 7.7, APIs: 5, Instructions: 168
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6E0C7D59
CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,0000007C,6E0C7CF2,6E0C7B4D), ref: 6E0C7E39
GetFileSize.KERNEL32(00000000,00000000), ref: 6E0C7E59
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 6E0C7E88

Part of subcall function 6E0C7B84: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 6E0C7BB2

CloseHandle.KERNEL32(00000000), ref: 6E0C7F26

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: File$BinaryCloseCreateCryptH_prolog3_HandleReadSizeString
String ID:
API String ID: 2259240775-0
Opcode ID: 4dca4a58d187d528a72b4497f9634358d15a1bf25fe1cd41220c50eae475da19
Instruction ID: b536c8ef70e41cdc47c990eab797b34b6aed343b4d3f0073b04a15ed91398536
Opcode Fuzzy Hash: 4dca4a58d187d528a72b4497f9634358d15a1bf25fe1cd41220c50eae475da19
Instruction Fuzzy Hash: C8516D71E14348A9EB10CBE0DC95BEEB778FF58B50F20141AE618BF291E7714945CB1A

Function 6E0C73DE Relevance: 1.5, APIs: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Thrd_sleep.LIBCPMT ref: 6E0C740A

Part of subcall function 6E0C80AC: _xtime_get.LIBCPMT ref: 6E0C80C6
Part of subcall function 6E0C80AC: __Xtime_diff_to_millis2.LIBCPMT ref: 6E0C80D2
Part of subcall function 6E0C80AC: Sleep.KERNELBASE(00000000,00000000,?,?,6E0C7595,00000000,?,?,?,?,?,?,?,?,6E0C7595,?), ref: 6E0C80DA
Part of subcall function 6E0C80AC: _xtime_get.LIBCPMT ref: 6E0C80E6

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: _xtime_get$SleepThrd_sleepXtime_diff_to_millis2
String ID:
API String ID: 2593056502-0
Opcode ID: 4fe4e47c75a0d496fc6161e6e501925529c79d19b9e917d15181f9bf7c1aaf77
Instruction ID: 650b2ec61dc0c164a1a322b9fbced7cb9c23d3c1025d34104c634a062aaae1ad
Opcode Fuzzy Hash: 4fe4e47c75a0d496fc6161e6e501925529c79d19b9e917d15181f9bf7c1aaf77
Instruction Fuzzy Hash: 0BE0ED72A0010CAB8B00DEE8C9409DFB3BC9F8A600B100566E908AB100EA32AB0587F6

Function 6E0C15F0 Relevance: 1.5, APIs: 1, Instructions: 28
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E0BED70: GetModuleHandleA.KERNEL32(63E27454), ref: 6E0BEE5C
Part of subcall function 6E0BED70: GetProcAddress.KERNEL32(00000000,?), ref: 6E0BEE67

RtlExitUserThread.NTDLL(?,239215D8,?,?,6E0B4DE4,?,?), ref: 6E0C1620

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: AddressExitHandleModuleProcThreadUser
String ID:
API String ID: 3902016533-0
Opcode ID: 339ba303f30e119319516b9611d48b8d6952ee3ba5963e7e0ff39becb53ac70f
Instruction ID: 936997d5a0148324f7b109bd8be60c15da875f28a2dc00287d2b9021f4686bbc
Opcode Fuzzy Hash: 339ba303f30e119319516b9611d48b8d6952ee3ba5963e7e0ff39becb53ac70f
Instruction Fuzzy Hash: 17D0A737411C006FC9059B50DC509EE332EAEC7A2830C892CD41113342C7717C07CB55

Non-executed Functions

Function 6E0C811F Relevance: 147.2, APIs: 42, Strings: 42, Instructions: 223
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6E0C813D
GetModuleHandleW.KERNEL32(kernel32.dll,?,invalid random_device value), ref: 6E0C8149
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6E0C8157
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6E0C816E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6E0C8185
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6E0C819C
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 6E0C81B3
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 6E0C81CA
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 6E0C81E1
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 6E0C81F8
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 6E0C820F
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 6E0C8226
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 6E0C823D
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 6E0C8254
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 6E0C826B
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 6E0C8282
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 6E0C8299
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 6E0C82B0
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 6E0C82C7
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 6E0C82DE
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 6E0C82F5

Strings

CloseThreadpoolWork, xrefs: 6E0C8488
SubmitThreadpoolWork, xrefs: 6E0C8471
CloseThreadpoolWait, xrefs: 6E0C82A5
InitOnceExecuteOnce, xrefs: 6E0C81BF
CreateThreadpoolWait, xrefs: 6E0C8277
WakeAllConditionVariable, xrefs: 6E0C83B9
FlsSetValue, xrefs: 6E0C8191
InitializeCriticalSectionEx, xrefs: 6E0C81A8
GetCurrentPackageId, xrefs: 6E0C8318
SetFileInformationByHandle, xrefs: 6E0C835D
FlsAlloc, xrefs: 6E0C8151
CreateThreadpoolWork, xrefs: 6E0C845A
WakeConditionVariable, xrefs: 6E0C83A2
CreateSemaphoreW, xrefs: 6E0C81ED
CreateThreadpoolTimer, xrefs: 6E0C821B
WaitForThreadpoolTimerCallbacks, xrefs: 6E0C8249
GetCurrentProcessorNumber, xrefs: 6E0C82EA
AcquireSRWLockExclusive, xrefs: 6E0C83FE
FlsFree, xrefs: 6E0C8163
SetThreadpoolTimer, xrefs: 6E0C8232
SleepConditionVariableSRW, xrefs: 6E0C8443
FlushProcessWriteBuffers, xrefs: 6E0C82BC
CompareStringEx, xrefs: 6E0C849F
GetFileInformationByHandleEx, xrefs: 6E0C8346
invalid random_device value, xrefs: 6E0C8138
CloseThreadpoolTimer, xrefs: 6E0C8260
FreeLibraryWhenCallbackReturns, xrefs: 6E0C82D3
CreateSemaphoreExW, xrefs: 6E0C8204
LCMapStringEx, xrefs: 6E0C84CD
InitializeConditionVariable, xrefs: 6E0C838B
kernel32.dll, xrefs: 6E0C8144
SleepConditionVariableCS, xrefs: 6E0C83D0
GetSystemTimePreciseAsFileTime, xrefs: 6E0C8374
GetLocaleInfoEx, xrefs: 6E0C84B6
FlsGetValue, xrefs: 6E0C817A
CreateSymbolicLinkW, xrefs: 6E0C8301
CreateEventExW, xrefs: 6E0C81D6
InitializeSRWLock, xrefs: 6E0C83E7
SetThreadpoolWait, xrefs: 6E0C828E
GetTickCount64, xrefs: 6E0C832F
TryAcquireSRWLockExclusive, xrefs: 6E0C8415
ReleaseSRWLockExclusive, xrefs: 6E0C842C

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModuleXinvalid_argumentstd::_
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$invalid random_device value$kernel32.dll
API String ID: 2259925219-2420364413
Opcode ID: b7c60226f008dcdec1b93a89cf632d28482de3986c242fcf00eacf79a74e8641
Instruction ID: 9ead944497700957758594015c244becc56b4278d565d50a316fd12b2b85046f
Opcode Fuzzy Hash: b7c60226f008dcdec1b93a89cf632d28482de3986c242fcf00eacf79a74e8641
Instruction Fuzzy Hash: B9912E71821B44EBCF24DFF8CA88A477BE8EB5F701781446AE619DE208DB749404DF60

Function 6E0D67FE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6E0D6944

Strings

1#SNAN, xrefs: 6E0D7B43
1#QNAN, xrefs: 6E0D7B4A
1#IND, xrefs: 6E0D7B3C
1#INF, xrefs: 6E0D7B51

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 0da99d7a049e6a97f09435ced001b1c2d772291f6e959a024ec9fb69ac2a7051
Instruction ID: 91c0053f369e8075e3496001a834afe4dd80c5a8b854b9206dfeafb1e8c9bf3c
Opcode Fuzzy Hash: 0da99d7a049e6a97f09435ced001b1c2d772291f6e959a024ec9fb69ac2a7051
Instruction Fuzzy Hash: 8EC27A71E186298FDB65CEA8DC407DAB3F9EB44354F1445EAD80DE7280E774AE898F40

Function 6E0D6350 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

kyn, xrefs: 6E0D67B8, 6E0D65A2, 6E0D6431
kyn, xrefs: 6E0D636D, 6E0D6518, 6E0D673C, 6E0D66D6, 6E0D6566, 6E0D64F4

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID:
String ID: kyn$kyn
API String ID: 0-1156257421
Opcode ID: a7e908e60855b0d3f0200f10504a8927068f362ae4f47767e58ebdef8eafd6f7
Instruction ID: f4dc5c50f7062f2c8d6be219fdb04c4e8cd2533ea0aa7acc440c0afcdef18d92
Opcode Fuzzy Hash: a7e908e60855b0d3f0200f10504a8927068f362ae4f47767e58ebdef8eafd6f7
Instruction Fuzzy Hash: 42023A71E102199FDB14CFA9D89079DBBF1FF88324F25826AD919E7384D731AA45CB80

Function 6E0D1283 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6E0D137B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6E0D1385
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 6E0D1392

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 781f8f4520bde96fc9230ec3e2d2772cbaeaa555b5ca5f4934fe8d26a06dc188
Instruction ID: 7df2100a9b499ad6b03b31d1a6edf689621cac59cdc19c4a29f1cc3f73e91d55
Opcode Fuzzy Hash: 781f8f4520bde96fc9230ec3e2d2772cbaeaa555b5ca5f4934fe8d26a06dc188
Instruction Fuzzy Hash: 4331B17490132D9BCB61DF68D9887CDBBB8EF08750F5046EAE81CA7250EB709B858F45

Function 6E0D05B1 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6E0D0587,?,6E0E3DC8,0000000C,6E0D06BA,00000000,00000000,00000001,6E0C8E32,6E0E3BB0,0000000C,6E0C8CDB,?), ref: 6E0D05D2
TerminateProcess.KERNEL32(00000000,?,6E0D0587,?,6E0E3DC8,0000000C,6E0D06BA,00000000,00000000,00000001,6E0C8E32,6E0E3BB0,0000000C,6E0C8CDB,?), ref: 6E0D05D9
ExitProcess.KERNEL32 ref: 6E0D05EB

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1b68e8c2c224d6e28a6d42c0da229ca254a98d66d1f2da56f8e89e0c8f1154b8
Instruction ID: f97dc46d071d0efc5af49dfaa7b22506011b15f1126f233e1c3273eb262d0b70
Opcode Fuzzy Hash: 1b68e8c2c224d6e28a6d42c0da229ca254a98d66d1f2da56f8e89e0c8f1154b8
Instruction Fuzzy Hash: 27E09231004708ABCF216F95C908B893F6AEB45795B004418FD199B129EB35DD4ADF90

Function 6E0C9A1B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,?), ref: 6E0C9A34

Strings

, xrefs: 6E0C9B98

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 00bbe9ed00853e4265bca539e4cdc2b6148e7e209487d933b50766d0f58f8a32
Instruction ID: 7ecd911da1ecfb7b121d02a589db345225b8bae6c6082daeca8a5b9e9fa583fa
Opcode Fuzzy Hash: 00bbe9ed00853e4265bca539e4cdc2b6148e7e209487d933b50766d0f58f8a32
Instruction Fuzzy Hash: 4F51AEB19046099FEF54CFA9C69179EBBF4FB08B58F50816AD415E7290D3749900CFA2

Function 6E0C7B84 Relevance: 3.1, APIs: 2, Instructions: 62encryptionCOMMONLIBRARYCODE

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 6E0C7BB2
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 6E0C7BDC

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 6825193c209c3f3cf2ef04c751665f573b030284c6cbf1a4cd6b817422e7a69a
Instruction ID: abf9c1082e137d0ef84684b5335a9b5282686f6b1919feecf2a907c49e83c46e
Opcode Fuzzy Hash: 6825193c209c3f3cf2ef04c751665f573b030284c6cbf1a4cd6b817422e7a69a
Instruction Fuzzy Hash: C1115E75A10209BFEB048FA5CC41FEEB7BCEF85B10F14416DF90597280EB70AA418B61

Function 6E0CFE8F Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6E0CFE8A,?,?,00000008,?,?,6E0D870C,00000000), ref: 6E0D00BC

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d5f94386f033acd77f75db8c2051e6417eacd17c985a65fdcc6bb752d358d101
Instruction ID: c74bf9e24ee82236def06cdfe63d1ab923360976445057b3729827bd9f37e8cf
Opcode Fuzzy Hash: d5f94386f033acd77f75db8c2051e6417eacd17c985a65fdcc6bb752d358d101
Instruction Fuzzy Hash: 34B1AC31210709DFD744CFA8C496B587BE1FF4A3A4F258658E8A9CF2A1D335E986CB41

Function 6E0D375D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6E0D375D

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2b4597fe270a401b0c292767e4e0a1926e50dbd895ec6933982a73409e0681ec
Instruction ID: 2b153a7c5f4eac09ceac887990470422bce7554f9e4d187014b7d18bae49871c
Opcode Fuzzy Hash: 2b4597fe270a401b0c292767e4e0a1926e50dbd895ec6933982a73409e0681ec
Instruction Fuzzy Hash: 73A00174605A018B9B889E3686492897BA9AA97A91B9580A9A805D5294EA2484909F01

Function 6E0CDED6 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a05dae78a5152ec8d78dd15b1625567afc8fd2e822a10da507b29b69898596
Instruction ID: 94028d2700d3c2734886284bfef75092c3d657cc818e5c1a2d75a68f54241f14
Opcode Fuzzy Hash: f8a05dae78a5152ec8d78dd15b1625567afc8fd2e822a10da507b29b69898596
Instruction Fuzzy Hash: 95619F316D06066ADA6049E448627FE33D8FF0AF8CF500819E956EB2D0D735E9838B97

Function 6E0B4DD0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: db2c3dc1b94d624184f4172ee39d6c45529e8b6447585cfb2bc89e0087804046
Instruction ID: 33bfefc8082089631afb9ba86fe94f8b087c0159ae20c4d5aab2216b7e89f1f3
Opcode Fuzzy Hash: db2c3dc1b94d624184f4172ee39d6c45529e8b6447585cfb2bc89e0087804046
Instruction Fuzzy Hash: 2EB01231005120BFC5051FD0CC04ACF77ADAE4D254F14CC04B354230208775AC024797

Function 6E0CBDD9 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 270
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6E0CBEDD
_GetRangeOfTrysToCheck.LIBVCRUNTIME ref: 6E0CBF58
___TypeMatch.LIBVCRUNTIME ref: 6E0CBFD6
IsInExceptionSpec.LIBVCRUNTIME ref: 6E0CC089
FindHandlerForForeignException.LIBVCRUNTIME ref: 6E0CC0D8
__CxxThrowException@8.LIBVCRUNTIME ref: 6E0CC112
_UnwindNestedFrames.LIBCMT ref: 6E0CC11A
___FrameUnwindToState.LIBVCRUNTIME ref: 6E0CC126
CallUnexpected.LIBVCRUNTIME ref: 6E0CC131

Strings

csm, xrefs: 6E0CBE1A
csm, xrefs: 6E0CBE87
csm, xrefs: 6E0CBF0C

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: Exception$SpecUnwind$CallCheckException@8FindForeignFrameFramesHandlerMatchNestedRangeStateThrowTrysTypeUnexpected
String ID: csm$csm$csm
API String ID: 3606550248-393685449
Opcode ID: 8db7f056149c4404a4da803b7a9230e898917e22ec6e6e0a2ff319b62570e63b
Instruction ID: 1ce8b02fc86a759c458c5211163ddd90627555d8d044b9d90cc45a969600d420
Opcode Fuzzy Hash: 8db7f056149c4404a4da803b7a9230e898917e22ec6e6e0a2ff319b62570e63b
Instruction Fuzzy Hash: 6BB16A718002099FCF20CFD5C880B9EB7B9BF08B58F104959E9556B654C775E986CFA3

Function 6E0D5929 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 6E0D596D

Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5C5A
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5C6C
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5C7E
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5C90
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5CA2
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5CB4
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5CC6
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5CD8
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5CEA
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5CFC
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5D0E
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5D20
Part of subcall function 6E0D5C3D: _free.LIBCMT ref: 6E0D5D32

_free.LIBCMT ref: 6E0D5962

Part of subcall function 6E0CFA74: HeapFree.KERNEL32(00000000,00000000,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA8A
Part of subcall function 6E0CFA74: GetLastError.KERNEL32(7692A396,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA9C

_free.LIBCMT ref: 6E0D5984
_free.LIBCMT ref: 6E0D5999
_free.LIBCMT ref: 6E0D59A4
_free.LIBCMT ref: 6E0D59C6
_free.LIBCMT ref: 6E0D59D9
_free.LIBCMT ref: 6E0D59E7
_free.LIBCMT ref: 6E0D59F2
_free.LIBCMT ref: 6E0D5A2A
_free.LIBCMT ref: 6E0D5A31
_free.LIBCMT ref: 6E0D5A4E
_free.LIBCMT ref: 6E0D5A66

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: bd14e6a1da0aa6c221ce10952b458f9ce1c6024ea2291ac2c9e9bc387445c7db
Instruction ID: 6366c5ff124c82068234e48fdd4e6852384d910fa688477b96feae845f0950e4
Opcode Fuzzy Hash: bd14e6a1da0aa6c221ce10952b458f9ce1c6024ea2291ac2c9e9bc387445c7db
Instruction Fuzzy Hash: 4A318175504702DFEB509AF9D840F9AF3EDEF007A4F24591AE859D7150DF30A944CB22

Function 6E0D17D3 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6E0D17E7

Part of subcall function 6E0CFA74: HeapFree.KERNEL32(00000000,00000000,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA8A
Part of subcall function 6E0CFA74: GetLastError.KERNEL32(7692A396,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA9C

_free.LIBCMT ref: 6E0D17F3
_free.LIBCMT ref: 6E0D17FE
_free.LIBCMT ref: 6E0D1809
_free.LIBCMT ref: 6E0D1814
_free.LIBCMT ref: 6E0D181F
_free.LIBCMT ref: 6E0D182A
_free.LIBCMT ref: 6E0D1835
_free.LIBCMT ref: 6E0D1840
_free.LIBCMT ref: 6E0D184E

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7bec22e636af1981bb4cd3a32fcb309242d2c315e6605cfe627a96795f15c704
Instruction ID: e811518735b32aefcd66e97722e04783dd3493cf926b40b2f29eea6e996f2a41
Opcode Fuzzy Hash: 7bec22e636af1981bb4cd3a32fcb309242d2c315e6605cfe627a96795f15c704
Instruction Fuzzy Hash: D311A4B6100548EFCF01EF94C840EDD7BADEF05694B2956A2B9088F231DB31EB54DB82

Function 6E0D44D0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,6E0D4C45,?,00000000,?,00000000,00000000), ref: 6E0D4512
__fassign.LIBCMT ref: 6E0D458D
__fassign.LIBCMT ref: 6E0D45A8
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 6E0D45CE
WriteFile.KERNEL32(?,?,00000000,ELn,00000000,?,?,?,?,?,?,?,?,?,6E0D4C45,?), ref: 6E0D45ED
WriteFile.KERNEL32(?,?,00000001,ELn,00000000,?,?,?,?,?,?,?,?,?,6E0D4C45,?), ref: 6E0D4626

Strings

ELn, xrefs: 6E0D45E1, 6E0D4619, 6E0D45E4, 6E0D461C

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: ELn
API String ID: 1324828854-3953799589
Opcode ID: 06d75a298bdd4013cc99ed4cda2ef55eec6972191b6385262cb58648325e0815
Instruction ID: 876010ecc3ba4a6ff6b4e0f9dd734dc62757affc01ceeee694b36bdb4c409576
Opcode Fuzzy Hash: 06d75a298bdd4013cc99ed4cda2ef55eec6972191b6385262cb58648325e0815
Instruction Fuzzy Hash: 5051A47190034AAFDB10CFE8D845BEEBBF8EF09300F15415AE955E7251E7709945CB61

Function 6E0D6001 Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,6E0D6252,?,?,00000003), ref: 6E0D605B
__alloca_probe_16.LIBCMT ref: 6E0D6093
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,?,?,6E0D6252,?,?,00000003,?), ref: 6E0D60E1
__alloca_probe_16.LIBCMT ref: 6E0D6178
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000003,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6E0D61DB
__freea.LIBCMT ref: 6E0D61E8

Part of subcall function 6E0D1204: HeapAlloc.KERNEL32(00000000,00000001,00000004,?,6E0D8205,00000001,00000000,?,6E0D4294,00000001,00000004,00000000,00000001,?,?,6E0D0BA3), ref: 6E0D1236

__freea.LIBCMT ref: 6E0D61F1
__freea.LIBCMT ref: 6E0D6216

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: 2f6364a9f0a51bc8190640764afca646abd7441e90e571e2d146efe5d556154c
Instruction ID: 44eb21c0942a23e69cfb4c007fedc2df13d4895e0b3b342390d18b2f4d7b9c80
Opcode Fuzzy Hash: 2f6364a9f0a51bc8190640764afca646abd7441e90e571e2d146efe5d556154c
Instruction Fuzzy Hash: A251DE7262031AAFEB158EE4DC81FAF3BA9EB44790B154628FC14D7141EB35DC58C760

Function 6E0D5DE0 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E0D5DA4: _free.LIBCMT ref: 6E0D5DCD

_free.LIBCMT ref: 6E0D5E2E

Part of subcall function 6E0CFA74: HeapFree.KERNEL32(00000000,00000000,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA8A
Part of subcall function 6E0CFA74: GetLastError.KERNEL32(7692A396,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA9C

_free.LIBCMT ref: 6E0D5E39
_free.LIBCMT ref: 6E0D5E44
_free.LIBCMT ref: 6E0D5E98
_free.LIBCMT ref: 6E0D5EA3
_free.LIBCMT ref: 6E0D5EAE
_free.LIBCMT ref: 6E0D5EB9

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2e0abbf9e2f0679a27bed9c289bf954e3f22a9d2ebe3e0042cd6ddc301c31e5a
Instruction ID: 8cbe6d34e7e6f3585eddcb1cb2e831a6fbfe13936063bf8482160291ad028d8d
Opcode Fuzzy Hash: 2e0abbf9e2f0679a27bed9c289bf954e3f22a9d2ebe3e0042cd6ddc301c31e5a
Instruction Fuzzy Hash: FE114C71540B04EAD670ABF0CC09FDBB7DCAF00B08F440D15AAE9AB050DB75B5098762

Function 6E0CC814 Relevance: 10.5, APIs: 7, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,00000000,6E0CB97B,6E0C938D,6E0C8CB8,?,6E0C8EB5,?,00000001,?,?,00000001,?,6E0E3BD0,0000000C,6E0C8FBE), ref: 6E0CC822
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E0CC830
SetLastError.KERNEL32(00000000,6E0C8EB5,?,00000001,?,?,00000001,?,6E0E3BD0,0000000C,6E0C8FBE,?,00000001,?), ref: 6E0CC83D

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ErrorLast$Value___vcrt_
String ID:
API String ID: 483936075-0
Opcode ID: 4dcca90f700cc586bdfa0758eb74e7b7783504aabdc6a1f52b15c7d5fe91324c
Instruction ID: 7c698d5f6b9c9ca3270cbd8ab73d3287c5b362bce1dce4edb3cac2378c171a6b
Opcode Fuzzy Hash: 4dcca90f700cc586bdfa0758eb74e7b7783504aabdc6a1f52b15c7d5fe91324c
Instruction Fuzzy Hash: 3AF02D36505F119B862216F5984C75F2AE4DB47FB57160135F810AB2C4EF304805D792

Function 6E0CCB70 Relevance: 9.3, APIs: 6, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 6E0CCC80
__FindPESection.LIBCMT ref: 6E0CCC9A

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: faf42885b9ae5df9973bc4dcca2c357e7d85f152b04db7c1b62944fdb1782a7c
Instruction ID: 9236945f94a0ab25e57eb70d523b8f9ecd3bf38f0e5c7539095ca6f55469b539
Opcode Fuzzy Hash: faf42885b9ae5df9973bc4dcca2c357e7d85f152b04db7c1b62944fdb1782a7c
Instruction Fuzzy Hash: D5A17872A006168FDB00CFA8C9D079DBBF4AB49B54F2946A9D815AF245D731ED00CB92

Function 6E0D18F3 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,6E0D3179,?,?,?,?,?,?,?,?,?,?,6E0C812C,?), ref: 6E0D18F7
_free.LIBCMT ref: 6E0D192A
_free.LIBCMT ref: 6E0D1952
SetLastError.KERNEL32(00000000,6E0CF850,00000016,6E0D3595), ref: 6E0D195F
SetLastError.KERNEL32(00000000,6E0CF850,00000016,6E0D3595), ref: 6E0D196B
_abort.LIBCMT ref: 6E0D1971

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f56b65160949e61b69d31b2b9c502cd27bc5b6543b492b16b3a7f2453f47a9c9
Instruction ID: 2930848ed17d932e8de577436857e644c5110da3dd7e839169dfc722b8337668
Opcode Fuzzy Hash: f56b65160949e61b69d31b2b9c502cd27bc5b6543b492b16b3a7f2453f47a9c9
Instruction Fuzzy Hash: 6BF0C236144B017AD64263E45C0CF8E66FD9FC3BF9B250524F928A3294FF34884E4322

Function 6E0BF720 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(63E27454), ref: 6E0BF8F7
GetProcAddress.KERNEL32(00000000,-0B2180EC), ref: 6E0BF8FF

Strings

_$4, xrefs: 6E0BF766
_$4, xrefs: 6E0BF787
_$4, xrefs: 6E0BF751

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _$4$_$4$_$4
API String ID: 1646373207-3055943180
Opcode ID: 04b196a6534875e32f1c52265e575a18d07fe2fe11ee87ca2f8b3090877f9034
Instruction ID: 69faaf8ab0c2e6be624c7ee47cbdfaf31fa33c80a1b0ab664698ad951dcef69e
Opcode Fuzzy Hash: 04b196a6534875e32f1c52265e575a18d07fe2fe11ee87ca2f8b3090877f9034
Instruction Fuzzy Hash: 33414A3964CA418FCF24C9BD8D84218BEF9F78A310BF484AAE580DB306E636DC458B51

Function 6E0C1050 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

Q>,, xrefs: 6E0C1068
Q>,, xrefs: 6E0C109D
Q>,, xrefs: 6E0C10B2

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID:
String ID: Q>,$Q>,$Q>,
API String ID: 0-1249747301
Opcode ID: 850cb6204b35bfc19ac96f8bd69d5bf3eecb55938b2e8fc79b1083382bed46bc
Instruction ID: ab0a3a961397951111cb515d6e13452d9ae6c9fb1d8c73d24a9128f93828e4eb
Opcode Fuzzy Hash: 850cb6204b35bfc19ac96f8bd69d5bf3eecb55938b2e8fc79b1083382bed46bc
Instruction Fuzzy Hash: C7415A7170D9418FCF1489FD898021E7BF1EB4EB10BA48969E958C7346D279DC4A8B93

Function 6E0CB440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E0CB46B
__IsNonwritableInCurrentImage.LIBCMT ref: 6E0CB4E5

Part of subcall function 6E0DA0A0: __FindPESection.LIBCMT ref: 6E0DA0F9

_ValidateLocalCookies.LIBCMT ref: 6E0CB559
_ValidateLocalCookies.LIBCMT ref: 6E0CB584

Strings

csm, xrefs: 6E0CB4CF

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentFindImageNonwritableSection
String ID: csm
API String ID: 1685366865-1018135373
Opcode ID: 8f85bce11e9bca9fd95d6bb6ecac4e24fc17ca144360faf26dd2f2f13decde48
Instruction ID: 6c7090c00a5658b33816fba8189f5815f14ade7411c2cc809f80c1977785759f
Opcode Fuzzy Hash: 8f85bce11e9bca9fd95d6bb6ecac4e24fc17ca144360faf26dd2f2f13decde48
Instruction Fuzzy Hash: 09419030D00209ABCF00DFE8D890B9EBBF9AF45768F148955E9186B359C731DA06CF92

Function 6E0D9B85 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6E0D9B8C
new.LIBCMT ref: 6E0D9BF8
__ExceptionPtr::__ExceptionPtr.LIBCMT ref: 6E0D9C10
__ExceptionPtr::__ExceptionPtr.LIBCMT ref: 6E0D9C43

Strings

csm, xrefs: 6E0D9C0A, 6E0D9C0D

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: Exception$Ptr::__$H_prolog3_catch
String ID: csm
API String ID: 2421427270-1018135373
Opcode ID: db4b01c767e2b90c2114d44652076268a60d81806ccdc0cef7701e628cac7b33
Instruction ID: f5404e69350fb276baebb50ad56975147dfb785feb2bc1152b937b1006716d97
Opcode Fuzzy Hash: db4b01c767e2b90c2114d44652076268a60d81806ccdc0cef7701e628cac7b33
Instruction Fuzzy Hash: B13105B0D053599FDF05CFE8C6A0BEDBBF8AF09614F544459E805AB280DBB49A09CB60

Function 6E0D0636 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6E0D05E7,?,?,6E0D0587,?,6E0E3DC8,0000000C,6E0D06BA,00000000,00000000), ref: 6E0D0656
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E0D0669
FreeLibrary.KERNEL32(00000000,?,?,?,6E0D05E7,?,?,6E0D0587,?,6E0E3DC8,0000000C,6E0D06BA,00000000,00000000,00000001,6E0C8E32), ref: 6E0D068C

Strings

mscoree.dll, xrefs: 6E0D064F
CorExitProcess, xrefs: 6E0D0661

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 68903465faa50dda81015505ba6a644dd1e0e4e6b46461b8d6dfbeace50884ea
Instruction ID: cbe76d07fe49630ab0b496eacb96dae2add76f06df22fe75dbf0156463fe1566
Opcode Fuzzy Hash: 68903465faa50dda81015505ba6a644dd1e0e4e6b46461b8d6dfbeace50884ea
Instruction Fuzzy Hash: 6DF08C3090061EABCB109FD4C818B9EBFA9EB45751F414169F80DE6250DB309A44DFA4

Function 6E0D0B16 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6E0D0B88
_free.LIBCMT ref: 6E0D0BA8

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e761ffa314129c21605515c79a596fee0bc2d9e51b90f868c488188f43651897
Instruction ID: 3888e84f08cc9366949574dbcb49950d84236bf08a3aa399faa4aea560ae0118
Opcode Fuzzy Hash: e761ffa314129c21605515c79a596fee0bc2d9e51b90f868c488188f43651897
Instruction Fuzzy Hash: E441D332A043009FDB10CFB8C880B9EB7F6EF85718F2549A9D519EB345E731A905CB81

Function 6E0D5EC4 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000,?,?,?,6E0D1B22,00000001,?,?,00000001,?,6E0D1C55), ref: 6E0D5F11
__alloca_probe_16.LIBCMT ref: 6E0D5F49
MultiByteToWideChar.KERNEL32(?,00000001,?,00000001,00000000,00000001,?,?,?,6E0D1B22,00000001,?,?,00000001,?,6E0D1C55), ref: 6E0D5F9A
GetStringTypeW.KERNEL32(?,00000000,00000000,6E0D1B22,?,?,?,6E0D1B22,00000001,?,?,00000001,?,6E0D1C55,?,00000001), ref: 6E0D5FAC
__freea.LIBCMT ref: 6E0D5FB5

Part of subcall function 6E0D1204: HeapAlloc.KERNEL32(00000000,00000001,00000004,?,6E0D8205,00000001,00000000,?,6E0D4294,00000001,00000004,00000000,00000001,?,?,6E0D0BA3), ref: 6E0D1236

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 7056b8833f23f6b0b70e569bb0b87357e6db893564fb400a876001775fc3ae4c
Instruction ID: 87d42d18fa2140e9870ae0b885adf21fcdd71704e6cbe95d23f8e77f331696f5
Opcode Fuzzy Hash: 7056b8833f23f6b0b70e569bb0b87357e6db893564fb400a876001775fc3ae4c
Instruction Fuzzy Hash: 9331BE76A0020AEBDF158FA4CC85EEE7BB9EB44750B004528FC15EB290E735C959CBA0

Function 6E0D41BD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E0D41C6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E0D41E9

Part of subcall function 6E0D1204: HeapAlloc.KERNEL32(00000000,00000001,00000004,?,6E0D8205,00000001,00000000,?,6E0D4294,00000001,00000004,00000000,00000001,?,?,6E0D0BA3), ref: 6E0D1236

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 6E0D420F
_free.LIBCMT ref: 6E0D4222
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E0D4231

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 46c05c245a5463bc30c66bd396b21ef6cf9a1fe06802d3ed6f549ccacfa5f775
Instruction ID: dbccbf90a5bd4b80e24d7de9ed03309af782613ea103fbbae644cbff4d830e75
Opcode Fuzzy Hash: 46c05c245a5463bc30c66bd396b21ef6cf9a1fe06802d3ed6f549ccacfa5f775
Instruction Fuzzy Hash: 8401B572601B167F67215AEA5C8CE7F29ADDEDB9913510129FD14C3100EA608D068774

Function 6E0D1977 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,7692A396,-00000004,6E0D150E,6E0CFA9A,7692A396,?,6E0D0AD1,00000001,00000001), ref: 6E0D197C
_free.LIBCMT ref: 6E0D19B1
_free.LIBCMT ref: 6E0D19D8
SetLastError.KERNEL32(00000000,00000001), ref: 6E0D19E5
SetLastError.KERNEL32(00000000,00000001), ref: 6E0D19EE

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: d02bdd00a125e508e608229165c0620c87f860996b81af978074d1e309ff5dba
Instruction ID: eaeafac4965519b75bf13743a6f3eb3256e5a32057da5a8fc48ae5f48de90f04
Opcode Fuzzy Hash: d02bdd00a125e508e608229165c0620c87f860996b81af978074d1e309ff5dba
Instruction Fuzzy Hash: 7701D176109B006B820266E5AC88F4FAAFD8BC2BF87650525F924E3244EF34880E8361

Function 6E0D5D3B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6E0D5D53

Part of subcall function 6E0CFA74: HeapFree.KERNEL32(00000000,00000000,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA8A
Part of subcall function 6E0CFA74: GetLastError.KERNEL32(7692A396,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA9C

_free.LIBCMT ref: 6E0D5D65
_free.LIBCMT ref: 6E0D5D77
_free.LIBCMT ref: 6E0D5D89
_free.LIBCMT ref: 6E0D5D9B

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f3a72e3a6afd6e2085d070ed54412ad88606798b000737b492ea85e77fcc722e
Instruction ID: 002af4643bd61035620d4b233a804755e7f52994da8035618ba290eaff9c705f
Opcode Fuzzy Hash: f3a72e3a6afd6e2085d070ed54412ad88606798b000737b492ea85e77fcc722e
Instruction Fuzzy Hash: 2EF04FB5500B05DB8AA4EAE4D195F6BB3DDEB01B5036C0D06EC58D7500D730F880C7B1

Function 6E0D0D68 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E0D0D86

Part of subcall function 6E0CFA74: HeapFree.KERNEL32(00000000,00000000,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA8A
Part of subcall function 6E0CFA74: GetLastError.KERNEL32(7692A396,?,6E0D0AD1,00000001,00000001), ref: 6E0CFA9C

_free.LIBCMT ref: 6E0D0D98
_free.LIBCMT ref: 6E0D0DAB
_free.LIBCMT ref: 6E0D0DBC
_free.LIBCMT ref: 6E0D0DCD

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0c326a9fa5c6860eed8737a5fe124c096a48c78b3f16d4d9ffcdb488188573a5
Instruction ID: 6f3218c3cf7526e10a94c0fdf20cb037e67148ae1230b17ce38469c5e240f1b0
Opcode Fuzzy Hash: 0c326a9fa5c6860eed8737a5fe124c096a48c78b3f16d4d9ffcdb488188573a5
Instruction Fuzzy Hash: 31F0DAF0804E209F8E05AFA89801A9C7BE9B70AF343991AABF81467364DB354541CF92

Function 6E0B7CA9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(1B191CF2), ref: 6E0B7D01

Strings

j3, xrefs: 6E0B7DAE
j3, xrefs: 6E0B7D42
j3, xrefs: 6E0B7D67

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: HandleModule
String ID: j3$j3$j3
API String ID: 4139908857-1354161450
Opcode ID: d80f6db6b5e6d16430a785c2faca32ce2d8c149eb0bc40f4aa92c260e1146509
Instruction ID: ae4a8d28caf02c39ed3262fd0f7c464501ef51497de4acf1eb4bd6aaa526d8bd
Opcode Fuzzy Hash: d80f6db6b5e6d16430a785c2faca32ce2d8c149eb0bc40f4aa92c260e1146509
Instruction Fuzzy Hash: F63192746187448FC720CF69C48076ABBF1FB99380F18896EE8D4CB365D636D9048F42

Function 6E0D2064 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6E0D20EF
__alldvrm.LIBCMT ref: 6E0D22F0
__alldvrm.LIBCMT ref: 6E0D2312

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: c8569fa6165621ae4bfdc23a65b375cf660c5957c43072294c7eaaba4b6edca1
Instruction ID: 462183f3666866358c52c811ace7a5260f8ad38c70631e5bd337f832a2eab196
Opcode Fuzzy Hash: c8569fa6165621ae4bfdc23a65b375cf660c5957c43072294c7eaaba4b6edca1
Instruction Fuzzy Hash: B6A17A76904786AFE702CFD8C8917AEBBF5FF26350F1445ADE5949B281C338894AC750

Function 6E0D3223 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,?,00000001,?,6E0D31CA,?,00000001,00000000,?,?,6E0D35F8,00000008,GetCurrentPackageId), ref: 6E0D3255
GetLastError.KERNEL32(?,6E0D31CA,?,00000001,00000000,?,?,6E0D35F8,00000008,GetCurrentPackageId,6E0DEA78,6E0DEA80,00000000), ref: 6E0D3261
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,6E0D31CA,?,00000001,00000000,?,?,6E0D35F8,00000008,GetCurrentPackageId,6E0DEA78,6E0DEA80,00000000), ref: 6E0D326F

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 14c9937a9385974e8b9bf278d9b3c30cd58e307ff5c70478aa46e9981112a386
Instruction ID: ffa7ae912098ab9f9942e338667c27d7b7b6c419ae3a37881f12ad1a888cb3dc
Opcode Fuzzy Hash: 14c9937a9385974e8b9bf278d9b3c30cd58e307ff5c70478aa46e9981112a386
Instruction Fuzzy Hash: 0501FC32A55726ABCB6149ED8C4CB667BA8AF1ABF1B100620FD19D3144D724D808CBE0

Function 6E0D3F95 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 6E0D3B68: GetOEMCP.KERNEL32 ref: 6E0D3B93

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,6E0D3E36,?,00000000), ref: 6E0D4009
GetCPInfo.KERNEL32(00000000,6>n,?,?,?,6E0D3E36,?,00000000), ref: 6E0D401C

Strings

6>n, xrefs: 6E0D4017, 6E0D401A

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: 6>n
API String ID: 546120528-3310715625
Opcode ID: 38ccc17f5ef102b2cf51aeee85a8cf374f20bb68e088057b400f67b8b7787e3f
Instruction ID: 8b3a7fa8ee7347eda5ba93ba6576462c52a3ce2c9590def693d58c2d33a1c24a
Opcode Fuzzy Hash: 38ccc17f5ef102b2cf51aeee85a8cf374f20bb68e088057b400f67b8b7787e3f
Instruction Fuzzy Hash: FD516474A0030AAEDB10CFF5C8907ABBFF5EF46300F14492ED0968B241E779994ACB91

Function 6E0D9964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,7692A396,?,?,?,6E0DA65A,000000FF), ref: 6E0D99C2
_free.LIBCMT ref: 6E0D9A1B

Strings

csm, xrefs: 6E0D998A

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: DecodePointer_free
String ID: csm
API String ID: 4139015823-1018135373
Opcode ID: 8846ce2443b705a4ea6b0c353a450441f6ec3db3c6a152fa9bdb06f6b6ff8aef
Instruction ID: faeba5706a0b21eeb1aa5eef810a0e2c9675fe44752fad26e3d3060cfb08f0ff
Opcode Fuzzy Hash: 8846ce2443b705a4ea6b0c353a450441f6ec3db3c6a152fa9bdb06f6b6ff8aef
Instruction Fuzzy Hash: 4321DE366047429BCB048FACC4A0B99F7E8FF04754F94865AD81887648CBB0E848CBD2

Function 6E0CD26E Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,?,?), ref: 6E0CD304
GetLastError.KERNEL32 ref: 6E0CD312
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 6E0CD36D

Memory Dump Source

Source File: 00000003.00000002.2139424852.000000006E0B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E0B0000, based on PE: true

Associated: 00000003.00000002.2139408740.000000006E0B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139450570.000000006E0DB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139469889.000000006E0E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139487091.000000006E0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2139507992.000000006E0EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0b0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: febe4f9b8e6de226df435688cebc503f73ea466ba70ac050a7fbdb4c66e4a7fa
Instruction ID: 2bf0518149e9218d33b0d8799a3de15fd693c6c19fb22ead51a3707c18e40104
Opcode Fuzzy Hash: febe4f9b8e6de226df435688cebc503f73ea466ba70ac050a7fbdb4c66e4a7fa
Instruction Fuzzy Hash: A741C430654606EFDB118FE5C844BAE7BF5EF42BA0F214559F869A7194EB30C902CF52

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8TuwlFKxC5.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 5688, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 7104, Parent PID: 5688

General

Chronological Activities

Analysis Process: cmd.exePID: 5908, Parent PID: 5688

Windows Analysis Report
8TuwlFKxC5.dll

Function 6E0C7868 Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 234
libraryloaderCOMMONLIBRARYCODE

Function 6E0C7422 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 182
libraryloaderCOMMONLIBRARYCODE

Function 6E0C7694 Relevance: 9.2, APIs: 6, Instructions: 157
COMMONLIBRARYCODE

Function 6E0C8E6F Relevance: 9.1, APIs: 6, Instructions: 87
COMMONLIBRARYCODE

Function 6E0C7D52 Relevance: 7.7, APIs: 5, Instructions: 168
fileCOMMONLIBRARYCODE

Function 6E0C73DE Relevance: 1.5, APIs: 1, Instructions: 31
COMMONLIBRARYCODE

Function 6E0C15F0 Relevance: 1.5, APIs: 1, Instructions: 28
threadCOMMON

Function 6E0C811F Relevance: 147.2, APIs: 42, Strings: 42, Instructions: 223
libraryloaderCOMMON

Function 6E0CBDD9 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 270
COMMONLIBRARYCODE

Function 6E0D5929 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Function 6E0D17D3 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Function 6E0D44D0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152
fileCOMMON