Edit tour

Windows Analysis Report
skZwfU6wMR.exe

Overview

General Information

Sample name:	skZwfU6wMR.exe renamed because original name is a hash value
Original sample name:	9caaa34fa5fab572695f49cc496820dc5e4df6d8866b3f89a49e2dab1a6f85d2.exe
Analysis ID:	1543064
MD5:	339e94bff01e66552e855e9ade023163
SHA1:	55ff23f6f35ce96592d41723a933bc928f3afe50
SHA256:	9caaa34fa5fab572695f49cc496820dc5e4df6d8866b3f89a49e2dab1a6f85d2
Tags:	exegurt-duna-uauser-JAMESWT_MHT
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains an invalid checksum

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

skZwfU6wMR.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\skZwfU6wMR.exe" MD5: 339E94BFF01E66552E855E9ADE023163)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: skZwfU6wMR.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: skZwfU6wMR.exe	Virustotal: Detection: 45%			Perma Link
Source: skZwfU6wMR.exe	ReversingLabs: Detection: 52%

Source: skZwfU6wMR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: skZwfU6wMR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: dccw.pdbGCTL source: skZwfU6wMR.exe
Source:	Binary string: dccw.pdb source: skZwfU6wMR.exe

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Code function: 0_2_0033EDC2 GetObjectW,GetLastError,GetWindowRect,GetLastError,GetDC,GetLastError,CreateCompatibleDC,GetLastError,SelectObject,CreateCompatibleDC,GetLastError,SetStretchBltMode,GetLastError,CreateCompatibleBitmap,GetLastError,SelectObject,StretchBlt,GetLastError,SendMessageW,DeleteObject,ReleaseDC,DeleteDC,DeleteDC,DeleteObject,

0_2_0033EDC2

Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Code function: 0_2_00336166		0_2_00336166
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Code function: 0_2_00335245		0_2_00335245

Source: skZwfU6wMR.exe	Binary or memory string: OriginalFilename vs skZwfU6wMR.exe
Source: skZwfU6wMR.exe, 00000000.00000000.1286934071.0000000000343000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedccw.exej% vs skZwfU6wMR.exe
Source: skZwfU6wMR.exe, 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedccw.exej% vs skZwfU6wMR.exe
Source: skZwfU6wMR.exe	Binary or memory string: OriginalFilenamedccw.exej% vs skZwfU6wMR.exe

Source: skZwfU6wMR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Code function: 0_2_0034002C FormatMessageW,LocalFree,GetLastError,

0_2_0034002C

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Code function: 0_2_00340138 CoCreateInstance,SysAllocString,WinSqmAddToStream,SysFreeString,

0_2_00340138

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Code function: 0_2_0033F117 FindResourceW,GetLastError,LoadResource,GetLastError,SizeofResource,LockResource,

0_2_0033F117

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\DCCW Startup Mutex

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Command line argument: strg

0_2_00333BBD

Source: skZwfU6wMR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: skZwfU6wMR.exe	Virustotal: Detection: 45%
Source: skZwfU6wMR.exe	ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: dxva2.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Section loaded: textshaping.dll	Jump to behavior

Source: skZwfU6wMR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: skZwfU6wMR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: skZwfU6wMR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: skZwfU6wMR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: skZwfU6wMR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: skZwfU6wMR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: skZwfU6wMR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: skZwfU6wMR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: dccw.pdbGCTL source: skZwfU6wMR.exe
Source:	Binary string: dccw.pdb source: skZwfU6wMR.exe

Source: skZwfU6wMR.exe

Static PE information: real checksum: 0x2100c should be: 0x79d41

Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Code function: 0_2_00331D0C pushad ; retf		0_2_00331D0D
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Code function: 0_2_00340DD1 push ecx; ret		0_2_00340DE4

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

API coverage: 5.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Code function: 0_2_0033F7EE mov esi, dword ptr fs:[00000030h]

0_2_0033F7EE

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Code function: 0_2_0033F8CD GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_0033F8CD

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Code function: 0_2_00340A80 SetUnhandledExceptionFilter,		0_2_00340A80
Source: C:\Users\user\Desktop\skZwfU6wMR.exe	Code function: 0_2_003407FD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_003407FD

Source: C:\Users\user\Desktop\skZwfU6wMR.exe

Code function: 0_2_00340CC9 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00340CC9

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
skZwfU6wMR.exe	45%	Virustotal		Browse
skZwfU6wMR.exe	53%	ReversingLabs	Win32.Dropper.Lumma
skZwfU6wMR.exe	100%	Avira	DR/AVI.Lumma.ecpqm

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543064
Start date and time:	2024-10-27 07:36:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	skZwfU6wMR.exe renamed because original name is a hash value
Original Sample Name:	9caaa34fa5fab572695f49cc496820dc5e4df6d8866b3f89a49e2dab1a6f85d2.exe
Detection:	MAL
Classification:	mal56.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.375842623435884
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	skZwfU6wMR.exe
File size:	458'699 bytes
MD5:	339e94bff01e66552e855e9ade023163
SHA1:	55ff23f6f35ce96592d41723a933bc928f3afe50
SHA256:	9caaa34fa5fab572695f49cc496820dc5e4df6d8866b3f89a49e2dab1a6f85d2
SHA512:	652b3dc0e38bf071f0e20b60a5abd8a5538c16708a9d5a45d630bce72073a360f67b531b54b5abbbdf915982b5c3c755977b4f631e78c342f4ab34b7afab1dfd
SSDEEP:	6144:NLj3gPQYfLQzXGkr1lpLj3gPQYfLQzXGkr1lMLj3gPQYfLQzXGkr1lpLj3gPQYft:ht9t+t9twt
TLSH:	39A4D61136454025EEAB16BB112CBC74E2ADB3323F1084E7B3648695A4722D5DFB1FAF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[..a...a...a.......a...b...a...e...a...d...a...`...a...`.[.a...i...a.......a...c...a.Rich..a.........PE..L.....g............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x410670
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x1B679987 [Fri Jul 27 11:05:43 1984 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	491393967a8d093caa31d224e1563ec2

Entrypoint Preview

Instruction
call 00007FAAF4F612D9h
jmp 00007FAAF4F609F4h
int3
int3
int3
int3
int3
int3
cmp ecx, dword ptr [00412074h]
jne 00007FAAF4F60C85h
retn 0000h
jmp 00007FAAF4F60E22h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push dword ptr [ebp+14h]
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
push 00410680h
push 00412074h
call 00007FAAF4F613B0h
add esp, 18h
pop ebp
ret
int3
int3
int3
int3
int3
int3
jmp dword ptr [004133B4h]
int3
int3
int3
int3
int3
int3
push 00000014h
push 00411010h
call 00007FAAF4F6132Eh
and dword ptr [ebp-24h], 00000000h
mov eax, dword ptr [004128DCh]
mov dword ptr [ebp-1Ch], eax
cmp eax, FFFFFFFFh
jne 00007FAAF4F60C98h
push dword ptr [ebp+08h]
mov esi, dword ptr [00413350h]
mov ecx, esi
call dword ptr [004133DCh]
call esi
pop ecx
jmp 00007FAAF4F60CD6h
push 00000008h
call 00007FAAF4F6136Bh
pop ecx
and dword ptr [ebp-04h], 00000000h
mov eax, dword ptr [004128DCh]
mov dword ptr [ebp-1Ch], eax
mov eax, dword ptr [004128D8h]
mov dword ptr [ebp-20h], eax
lea eax, dword ptr [ebp-20h]
push eax
lea eax, dword ptr [ebp-1Ch]
push eax
push dword ptr [ebp+08h]
call 00007FAAF4F6135Eh
add esp, 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x133e4	0x118	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0xad8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0x1100	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36ec	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a18	0xc0	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10074	0x10200	a0f29a9cfdb6ce8a5e5b661d4c75fddd	False	0.4699763808139535	data	6.213626139783662	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0x940	0x600	e13e04f6d2fb4da4268ddcbfffc6f9ca	False	0.2903645833333333	data	2.5070998695029845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13000	0x1a88	0x1c00	d1d54d4ebc4341b577fa01ca1ae5cd84	False	0.41322544642857145	data	5.362229922857188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0xad8	0xc00	f6912cbbd83d4fc3adab01bc338a72ff	False	0.396484375	data	4.422366166757536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0x1100	0x1200	3f96f8b6178ac65c1972f0c44dfe3d56	False	0.7999131944444444	data	6.534591735538366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0x159d0	0x108	data	English	United States	0.5681818181818182
RT_VERSION	0x15640	0x390	data	English	United States	0.46600877192982454
RT_MANIFEST	0x150f0	0x54b	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4154981549815498

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegQueryInfoKeyW, RegEnumKeyExW, RegOpenKeyExW, RegSetValueExW, RegCreateKeyExW, RegDeleteValueW, EventRegister, EventUnregister, EventWrite, RegQueryValueExW
KERNEL32.dll	CreateMutexW, HeapSetInformation, InitializeCriticalSection, GetModuleFileNameW, FindResourceExW, LoadResource, SizeofResource, WaitForSingleObject, lstrcmpiW, GetModuleHandleW, LoadLibraryExW, GetProcAddress, FreeLibrary, GetLastError, ReleaseMutex, CloseHandle, CreateFileW, GetCurrentProcessId, LockResource, FindResourceW, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, LocalFree, FormatMessageW, GetSystemDirectoryW, WriteFile, WideCharToMultiByte, GetSystemTime, CopyFileW, MultiByteToWideChar, EnterCriticalSection, LeaveCriticalSection, RaiseException, DeleteCriticalSection, GetSystemTimeAsFileTime, GetCurrentThreadId, GetTickCount, OutputDebugStringA, TerminateProcess, SetUnhandledExceptionFilter, HeapFree, VirtualFree, GetCurrentProcess, VirtualAlloc, LoadLibraryExA, EncodePointer, HeapAlloc, DecodePointer, IsProcessorFeaturePresent, GetProcessHeap, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, Sleep, GetStartupInfoW, UnhandledExceptionFilter, QueryPerformanceCounter
GDI32.dll	StretchBlt, CreateCompatibleBitmap, SetStretchBltMode, SelectObject, CreateCompatibleDC, GetObjectW, GetTextExtentPoint32W, SetDeviceGammaRamp, GetDeviceGammaRamp, GetStockObject, SetBkMode, SetBkColor, SetTextColor, CreateSolidBrush, GetDeviceCaps, CreateDCW, DeleteDC, DeleteObject
USER32.dll	LoadStringW, GetWindow, ShowWindow, MessageBoxW, ReleaseDC, GetWindowTextW, GetWindowTextLengthW, GetDC, KillTimer, SetTimer, SetWindowTextW, PostMessageW, MapDialogRect, EnumChildWindows, DisplayConfigGetDeviceInfo, QueryDisplayConfig, GetDisplayConfigBufferSizes, EnumDisplayDevicesW, ShowCursor, LoadCursorW, SetCursor, GetMonitorInfoW, EnumDisplayMonitors, MonitorFromWindow, GetParent, InvalidateRect, MapWindowPoints, GetWindowRect, GetDlgItem, DefWindowProcW, SendMessageW, CallWindowProcW, SetWindowPos, SetForegroundWindow, OpenIcon, SetWindowLongW, GetWindowLongW, MonitorFromRect, SendMessageTimeoutW, AllowSetForegroundWindow, GetWindowThreadProcessId, FindWindowW, RegisterWindowMessageW, GetActiveWindow, GetSystemMetrics, CharNextW, DestroyWindow, UnregisterClassA, MoveWindow
msvcrt.dll	_ftol2, memcpy, _controlfp, ?terminate@@YAXXZ, realloc, _errno, _onexit, __dllonexit, _unlock, _lock, _except_handler4_common, _wcmdln, _initterm, __setusermatherr, __p__fmode, _cexit, _exit, exit, __set_app_type, __wgetmainargs, _amsg_exit, __p__commode, _XcptFilter, _callnewh, swscanf_s, wcsstr, _wcsupr, _purecall, memcpy_s, malloc, wcsncpy_s, free, _ftol2_sse, _vsnwprintf, towlower, iswupper, _CIpow, memset
ntdll.dll	WinSqmAddToStream
dxva2.dll	GetNumberOfPhysicalMonitorsFromHMONITOR, GetPhysicalMonitorsFromHMONITOR, DestroyPhysicalMonitors, GetMonitorBrightness, SetMonitorBrightness, GetMonitorContrast, SetMonitorContrast, GetVCPFeatureAndVCPFeatureReply, SetVCPFeature
mscms.dll	GetColorProfileFromHandle, UninstallColorProfileW, WcsCreateIccProfile, GetColorDirectoryW, InstallColorProfileW, CloseColorProfile, DccwSetDisplayProfileAssociationList, WcsGetUsePerUserProfiles, WcsGetDefaultColorProfile, WcsOpenColorProfileW, DccwGetGamutSize, DccwCreateDisplayProfileAssociationList, DccwGetDisplayProfileAssociationList, WcsGetCalibrationManagementState, SetColorProfileElement, SetColorProfileElementSize, DccwReleaseDisplayProfileAssociationList, WcsDisassociateColorProfileFromDevice, WcsSetCalibrationManagementState, WcsSetDefaultColorProfile
SHELL32.dll	ShellExecuteW
GDIPLUS.dll	GdipCreateHBITMAPFromBitmap, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipFree, GdipCreateLineBrushI, GdipFillRectangleI, GdipCloneBrush, GdipAlloc, GdipDeleteBrush, GdipCreateSolidFill, GdipDeleteGraphics, GdipCreateFromHDC, GdiplusShutdown, GdiplusStartup
COMCTL32.dll	TaskDialogIndirect, DestroyPropertySheetPage, CreatePropertySheetPageW, PropertySheetW
OLEAUT32.dll	SysFreeString, VarUI4FromStr, SysAllocString
api-ms-win-core-com-l1-1-0.dll	CoTaskMemRealloc, CoTaskMemFree, CreateStreamOnHGlobal, CoTaskMemAlloc, StringFromCLSID, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	02:37:02
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\skZwfU6wMR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\skZwfU6wMR.exe"
Imagebase:	0x330000
File size:	458'699 bytes
MD5 hash:	339E94BFF01E66552E855E9ADE023163
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.2%
Total number of Nodes:	1556
Total number of Limit Nodes:	24

Executed Functions

Function 00336166 Relevance: 39.1, APIs: 16, Strings: 6, Instructions: 627
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(00000000,00000001,Local\DCCW Startup Mutex,00000000,00000000,00000000,?,?,?,?,?,00333D49,00000000), ref: 00336185
GetLastError.KERNEL32(?,?,?,?,?,00333D49,00000000), ref: 00336194
WaitForSingleObject.KERNEL32(00002710,?,?,?,?,?,00333D49,00000000), ref: 003361AC
RegisterWindowMessageW.USER32(Microsoft.Windows.ICM.DCCW.Activate,?,?,?,?,?,00333D49,00000000), ref: 003361B7
FindWindowW.USER32(NativeHWNDHost,003428C8), ref: 003361E8
GetWindowThreadProcessId.USER32(00000000,I=3), ref: 003361FC
AllowSetForegroundWindow.USER32(I=3), ref: 00336205
SendMessageTimeoutW.USER32(00000000,00000000,00000000,00000002,00002710,?), ref: 00336221
RegisterWindowMessageW.USER32(003323E8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003367CB
GetLastError.KERNEL32 ref: 003367EC
WcsGetCalibrationManagementState.MSCMS(?), ref: 00336808
GetLastError.KERNEL32 ref: 00336812
WcsSetCalibrationManagementState.MSCMS(00000000), ref: 0033683D
GetLastError.KERNEL32 ref: 00336847
ReleaseMutex.KERNEL32(000001D8), ref: 0033687A
CloseHandle.KERNEL32 ref: 00336886

Part of subcall function 003402FE: malloc.MSVCRT ref: 00340316

Part of subcall function 0033C11C: CreateSolidBrush.GDI32(00787878), ref: 0033C179

Part of subcall function 003402FE: _callnewh.MSVCRT ref: 00340309

Part of subcall function 0033A74B: memset.MSVCRT ref: 0033A772
Part of subcall function 0033A74B: CreateSolidBrush.GDI32(00AAAAAA), ref: 0033A80B

Strings

NativeHWNDHost, xrefs: 003361E3
Local\DCCW Startup Mutex, xrefs: 00336175
I=3, xrefs: 003361F7, 00336202, 003361FA
strg, xrefs: 003361CD
Microsoft.Windows.ICM.DCCW.Activate, xrefs: 003361B2
dccw, xrefs: 0033622B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$ErrorLast$CreateMessage$BrushCalibrationManagementMutexRegisterSolidState$AllowCloseFindForegroundHandleObjectProcessReleaseSendSingleThreadTimeoutWait_callnewhmallocmemset
String ID: I=3$Local\DCCW Startup Mutex$Microsoft.Windows.ICM.DCCW.Activate$NativeHWNDHost$dccw$strg
API String ID: 2331678428-2446108083
Opcode ID: 773ad8733f262749d99bc1eb844bde2239dac146ce2a918296c1926d05ded5cf
Instruction ID: 6308e6e8a59cb9a637d25fca66df398429f74b8f2984c490828de87a3e5ef89f
Opcode Fuzzy Hash: 773ad8733f262749d99bc1eb844bde2239dac146ce2a918296c1926d05ded5cf
Instruction Fuzzy Hash: 4602E736B81B367FEB2B1A648C97F3EA5959B45B50F05822CBE42BF2C1DEA45C0047D1

Function 00333BBD Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 171
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00333BD7

Part of subcall function 00335F21: GetCurrentThreadId.KERNEL32 ref: 00335F5D

EventRegister.ADVAPI32(00331F40,00000000,00000000,00342858), ref: 00333BF3
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00333C14
GetSystemMetrics.USER32(00001000), ref: 00333C92
memset.MSVCRT ref: 00333CDC

Part of subcall function 0034002C: FormatMessageW.KERNEL32(00000500,?,00000000,00000000,00000137,00000000,?,67727473,?,?,?,00333C64,?,?,00000000), ref: 00340052
Part of subcall function 0034002C: LocalFree.KERNEL32(00000000,00000137,?,?,?,00333C64,?,?,00000000), ref: 00340075

memset.MSVCRT ref: 00333D0B
GetActiveWindow.USER32 ref: 00333D4F
PropertySheetW.COMCTL32(?,?,?), ref: 00333D91

Part of subcall function 0033E8E3: EventWrite.ADVAPI32(00331F20,00000001,?,?,003368A9,00000000), ref: 0033E944
Part of subcall function 0033E8E3: MessageBoxW.USER32(00000000,00000000,003428C8,00000010), ref: 0033E973

GdiplusShutdown.GDIPLUS(?), ref: 00333DBF
EventUnregister.ADVAPI32(028E6100,0000002B), ref: 00333DD9

Strings

strg, xrefs: 00333C2B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Event$GdiplusMessagememset$ActiveCurrentFormatFreeHeapInformationLocalMetricsPropertyRegisterSheetShutdownStartupSystemThreadUnregisterWindowWrite
String ID: strg
API String ID: 299502029-3320446829
Opcode ID: c969197b2b5fcaa7401c42615d627ebc8a3688102183ec08f8b956aa4fc3d0e2
Instruction ID: b62eb620647c2ea3fd76081d6b4d7bc56b88e71a96ae825da50f2a1afb5059f7
Opcode Fuzzy Hash: c969197b2b5fcaa7401c42615d627ebc8a3688102183ec08f8b956aa4fc3d0e2
Instruction Fuzzy Hash: EF51C275908355AFC363AF65C8C595FB7E8EF80750F008A2DF885AB251DB34EE048B92

Function 003403E9 Relevance: 10.6, APIs: 7, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32(?,00340FF0,00000058), ref: 003403FE
Sleep.KERNEL32(000003E8), ref: 00340433
_amsg_exit.MSVCRT ref: 00340448
_initterm.MSVCRT ref: 0034049C
__IsNonwritableInCurrentImage.LIBCMT ref: 003404C8
exit.KERNELBASE ref: 0034054B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_inittermexit
String ID:
API String ID: 2849151604-0
Opcode ID: 32baadc548a4d78eaa0c456a153bb95060d97edbadc759ba2f71cea84ef29005
Instruction ID: 122d832a9dfcbef1ef98a90997f18360fd16dbe27ffcadf32c792203812b2b84
Opcode Fuzzy Hash: 32baadc548a4d78eaa0c456a153bb95060d97edbadc759ba2f71cea84ef29005
Instruction Fuzzy Hash: 8941DF7AB043018FDB2F9B65AC4476A76E8EB06760F50406AEB01AF290DF74B840CF50

Function 0033F064 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator,00000000,00020019,00333CC0,00000000,00000000,00000000,?,?,?,00333CC0), ref: 0033F094
RegQueryValueExW.ADVAPI32(00333CC0,UseSimulator,00000000,?,?,?,?,?,?,00333CC0), ref: 0033F0B5
RegCloseKey.ADVAPI32(00333CC0,?,?,?,00333CC0), ref: 0033F0D6

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator, xrefs: 0033F081
UseSimulator, xrefs: 0033F0AD

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator$UseSimulator
API String ID: 3677997916-1182467772
Opcode ID: 84f084e35a888c665b9400c4ce3740e7b55f28b3b8c0cdd5a9fd2740ee5a23a6
Instruction ID: 37f91c137d2428ecc4db2531fbca2746cd064d7fdde55826312cb38484e7fafe
Opcode Fuzzy Hash: 84f084e35a888c665b9400c4ce3740e7b55f28b3b8c0cdd5a9fd2740ee5a23a6
Instruction Fuzzy Hash: 37118B76D40218FFDB228B9A9C859DFBFBCEB44714F104277F501AA141D7B05A44CB90

Function 0033A74B Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0033A772
CreateSolidBrush.GDI32(00AAAAAA), ref: 0033A80B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: BrushCreateSolidmemset
String ID:
API String ID: 1302505579-0
Opcode ID: e2b354c1bf322d34ca5d8df05175168e4ede46160567cf75f1ce5982b26064fb
Instruction ID: 38b6bed28c2c9be460a4afcbf82ffcde5fbef00a99c51d314f3b86197a65e71d
Opcode Fuzzy Hash: e2b354c1bf322d34ca5d8df05175168e4ede46160567cf75f1ce5982b26064fb
Instruction Fuzzy Hash: 2431E0B4A01B06BFD346CF2AD585681FBE4FF09314F50822AE558CBA50D7B0B464DBD0

Function 003402FE Relevance: 3.0, APIs: 2, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.MSVCRT ref: 00340309
malloc.MSVCRT ref: 00340316

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: _callnewhmalloc
String ID:
API String ID: 2285944120-0
Opcode ID: 827a41add3e7882cda66cdcc4134e2c9379e0503a851913f5d561a6cac6c916e
Instruction ID: d4a5eb717ab3b4a074d30d3a2ae50445c9b594f4639b1745cfd976ab338ae807
Opcode Fuzzy Hash: 827a41add3e7882cda66cdcc4134e2c9379e0503a851913f5d561a6cac6c916e
Instruction Fuzzy Hash: 57D0A73A301129338A2B2D55EC0055A7FCCCA417B03154031FB48AE555DB31FC0046C0

Function 0033FE77 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003402FE: malloc.MSVCRT ref: 00340316

LoadStringW.USER32(003361E0,?,00000000,00000400), ref: 0033FE9A

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: LoadStringmalloc
String ID:
API String ID: 905986743-0
Opcode ID: 7296881d8fe89fa7b6d0611966828ed5ed4db439ddd6b7e6411f5aae4c82610f
Instruction ID: 73b667164bceb5bd6909cab84838b30e0805f0a682f36c8de77cc4cc77d4e83d
Opcode Fuzzy Hash: 7296881d8fe89fa7b6d0611966828ed5ed4db439ddd6b7e6411f5aae4c82610f
Instruction Fuzzy Hash: 54012B327410547FDB2B25289C4AE2F5A8C9F853A0F15813AFF09CE5F2D960D84052A4

Function 003403B0 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 003403D4

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: 7cfbef598a6185d90ddff1b1f6b7323fbcf4edcc200b25789e9f8d9391d88296
Instruction ID: e293a1f273066811739078f68429ed507cbbaf35fde2d729db1354cd5373167c
Opcode Fuzzy Hash: 7cfbef598a6185d90ddff1b1f6b7323fbcf4edcc200b25789e9f8d9391d88296
Instruction Fuzzy Hash: 04D0C9B8A41200AB8707AF24AD26867BAF8AA03702BC000D8F4007E172EE623310CF52

Non-executed Functions

Function 0033EDC2 Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 227
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetObjectW.GDI32(?,00000018,?), ref: 0033EE1B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EE33
GetWindowRect.USER32(?,?), ref: 0033EE55
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EE78
GetDC.USER32(?), ref: 0033EE96
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EEA5
CreateCompatibleDC.GDI32(00000000), ref: 0033EEC3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EECF
SelectObject.GDI32(00000000,?), ref: 0033EEF0
CreateCompatibleDC.GDI32(?), ref: 0033EF01
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EF0E
SetStretchBltMode.GDI32(00000000,00000003), ref: 0033EF31
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EF3B
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0033EF61
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EF6D
SelectObject.GDI32(?,00000000), ref: 0033EF8A
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0033EFB6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0033767F,?), ref: 0033EFC0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0033EFE4
DeleteObject.GDI32(00000000), ref: 0033EFFE
ReleaseDC.USER32(?,?), ref: 0033F00F
DeleteDC.GDI32(00000000), ref: 0033F01A
DeleteDC.GDI32(?), ref: 0033F028
DeleteObject.GDI32(00000000), ref: 0033F037

Strings

SendMessage(STM_SETIMAGE, 0x%08x) returned 0x%08x, xrefs: 0033EFEC

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLast$Object$Delete$CompatibleCreate$SelectStretch$BitmapMessageModeRectReleaseSendWindow
String ID: SendMessage(STM_SETIMAGE, 0x%08x) returned 0x%08x
API String ID: 1596057509-2907994607
Opcode ID: c03f4c34fa3452d605b5088c8997368e34f6bf5f5c667065a7cd9256734841cb
Instruction ID: 1eacb724b5d3b094434cd77d3c6614de46e811a57b5cc2165807f01f2ba8f067
Opcode Fuzzy Hash: c03f4c34fa3452d605b5088c8997368e34f6bf5f5c667065a7cd9256734841cb
Instruction Fuzzy Hash: 45718D7AD006259FDB279FA9DDC4AAEBAB8BF08751F120124FD05F7251DB34DD008AA0

Function 00335245 Relevance: 28.5, APIs: 12, Strings: 4, Instructions: 457
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 00335132
Part of subcall function 003350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 0033514F
Part of subcall function 003350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 00335162
Part of subcall function 003350F7: CharNextW.USER32(00000027,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 0033516D

lstrcmpiW.KERNEL32(?,Delete,?,?,00000000,00000000,?,00335944,?,00000000,00000000,00000000,?), ref: 003352B8
lstrcmpiW.KERNEL32(?,ForceRemove,?,00000000,00000000,?,00335944,?,00000000,00000000,00000000,?), ref: 003352CD
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,00335944,?,00000000,00000000,00000000,?), ref: 0033536B
lstrcmpiW.KERNEL32(?,NoRemove,?,?,00000000,00000000,?,00335944,?,00000000,00000000,00000000,?), ref: 00335392
lstrcmpiW.KERNEL32(?,Val,?,00000000,00000000,?,00335944,?,00000000,00000000,00000000,?), ref: 003353B6
RegDeleteValueW.ADVAPI32(?,?,?,00000000,00020006,?,?), ref: 00335482
RegCloseKey.ADVAPI32(?), ref: 0033549A
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,00020019,?,?,0002001F), ref: 0033551F
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00335944,?,00000000,00000000,00000000,?), ref: 00335535
wcsncpy_s.MSVCRT ref: 00335628

Part of subcall function 00335245: RegCloseKey.ADVAPI32(?,?,?), ref: 0033572E
Part of subcall function 00335245: RegCloseKey.ADVAPI32(?,?,00000000,00020006,?,?), ref: 003357AA

Strings

ForceRemove, xrefs: 003352C0
NoRemove, xrefs: 0033538C
Delete, xrefs: 003352AA
Val, xrefs: 003353B0

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Close$CharNextlstrcmpi$CreateDeleteValuewcsncpy_s
String ID: Delete$ForceRemove$NoRemove$Val
API String ID: 670805417-1781481701
Opcode ID: 40f58d2fcf05580231be0ed753b31bb9b7d904ef87dae33016089270cbe20a7b
Instruction ID: 2c4183fdea4bf7d5f1117a2108a170acb3656267d28d8d6ae49db2b98644237f
Opcode Fuzzy Hash: 40f58d2fcf05580231be0ed753b31bb9b7d904ef87dae33016089270cbe20a7b
Instruction Fuzzy Hash: 93E19E35A08B129BC726DF24C8D5A2FB7E8BF84B50F05491DF9469B241EB74DD40CB92

Function 00340138 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0(00333658,00000000,00000017,00333668,?,?,00000001), ref: 0034015B
SysAllocString.OLEAUT32(mshelp://windows/?id=27a2764a-ad05-4a52-96f4-eac32ae3c9e1), ref: 0034016C
WinSqmAddToStream.NTDLL(00000000,0000038F,00000001,00000053), ref: 00340199
SysFreeString.OLEAUT32(00000000), ref: 003401CD

Strings

COLOR_MANAGEMENT_CALIBRATE_DISPLAY, xrefs: 00340182
mshelp://windows/?id=27a2764a-ad05-4a52-96f4-eac32ae3c9e1, xrefs: 00340167
P5w, xrefs: 0034015B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: String$AllocCreateFreeInstanceStream
String ID: COLOR_MANAGEMENT_CALIBRATE_DISPLAY$P5w$mshelp://windows/?id=27a2764a-ad05-4a52-96f4-eac32ae3c9e1
API String ID: 148082582-2333206421
Opcode ID: 0514e88beada93f343f896ed76abd5faa3d597b5ab6017cfe5edf924c7137e44
Instruction ID: ede77c36ba5cb2b8cf1cff1bacbb56b08030d6e77cca92d3e9fc15f439a0b15a
Opcode Fuzzy Hash: 0514e88beada93f343f896ed76abd5faa3d597b5ab6017cfe5edf924c7137e44
Instruction Fuzzy Hash: 11117339740214BFD7169B54DC89DAE7BFCDB49B51F114059F905EB250CFB0AE008B50

Function 0033F117 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00330000,?,000001F4,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F13C
GetLastError.KERNEL32(?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F14B
LoadResource.KERNEL32(00330000,00000000,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F166
GetLastError.KERNEL32(?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F172
SizeofResource.KERNEL32(00330000,?,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F18F
LockResource.KERNEL32(00000000,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F19B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Resource$ErrorLast$FindLoadLockSizeof
String ID:
API String ID: 518650369-0
Opcode ID: c4d07cede180b4960a5d3adc23f6f93e5fe5ba8c365bad025ae5efd821aac5ba
Instruction ID: 4a43462ee38d3ceaf442f96add5ff85bde16af169de052947c455a7b7fffd53f
Opcode Fuzzy Hash: c4d07cede180b4960a5d3adc23f6f93e5fe5ba8c365bad025ae5efd821aac5ba
Instruction Fuzzy Hash: 4611217BD01225AFC7139BA9E94495ABABCAB89761F124125FD45DB310DA34DD00C7E0

Function 003407FD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00340939, %4), ref: 00340804
UnhandledExceptionFilter.KERNEL32(94,?,00340939, %4), ref: 0034080D
GetCurrentProcess.KERNEL32(C0000409,?,00340939, %4), ref: 00340818
TerminateProcess.KERNEL32(00000000,?,00340939, %4), ref: 0034081F

Strings

94, xrefs: 0034080A

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID: 94
API String ID: 3231755760-613239025
Opcode ID: b1e8f3b35d981182db483df76a0163b09ee80f0a9b46fd516c73109443f0403b
Instruction ID: ed95a1b8d8e100d9ea9a57a63a2537dc2c80b9e004bfeee98e88674c25069e95
Opcode Fuzzy Hash: b1e8f3b35d981182db483df76a0163b09ee80f0a9b46fd516c73109443f0403b
Instruction Fuzzy Hash: 72D01236000208BBCB023BF1ED0CA097F2CFB46312F584000F3098B020CF3266018B65

Function 00340CC9 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00340CF6
GetCurrentProcessId.KERNEL32 ref: 00340D05
GetCurrentThreadId.KERNEL32 ref: 00340D0E
GetTickCount.KERNEL32 ref: 00340D17
QueryPerformanceCounter.KERNEL32(?), ref: 00340D2C

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 9ee7b04cb4fa4f429cf3e2d26a865ebc904f7436530cfecf15eb3ee8caa559c4
Instruction ID: fe2ecdd4ce875750d172dbfcebe013f850639f1e2b5b45d622948ccae7277dfd
Opcode Fuzzy Hash: 9ee7b04cb4fa4f429cf3e2d26a865ebc904f7436530cfecf15eb3ee8caa559c4
Instruction Fuzzy Hash: 4511EC75E01608EBCB15DFF8EA4869FBBF8EF59311F610555E501EB264DA30AB04CB40

Function 0033F7EE Relevance: 7.5, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,0033F721,00000000,00000000,0033F911,00000000,?,00000000,?,00336DFD,?), ref: 0033F7F0
GetProcessHeap.KERNEL32(00000008,00000008,00000000,?,00000000,?,00336DFD,?), ref: 0033F816
HeapAlloc.KERNEL32(00000000,?,00000000,?,00336DFD,?), ref: 0033F81D
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,00336DFD,?), ref: 0033F838
HeapFree.KERNEL32(00000000,?,00000000,?,00336DFD,?), ref: 0033F83F

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreePresentProcessor
String ID:
API String ID: 53968077-0
Opcode ID: 467dbe660533465fbc7b3eb5be803ea29ce54601c8ffb26540182c0c28d2232b
Instruction ID: d4ee86bc090ac9098440206df1a388adf7fc4c00e1608e70858df7733055570d
Opcode Fuzzy Hash: 467dbe660533465fbc7b3eb5be803ea29ce54601c8ffb26540182c0c28d2232b
Instruction Fuzzy Hash: 3DF06D79A016029FEB16AF689C08B1637EDBF46701F458438E686DF280EF30E840CB50

Function 0033F8CD Relevance: 5.0, APIs: 4, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,00337016,?,00000000,?,00336DFD,?), ref: 0033F8D4
HeapAlloc.KERNEL32(00000000,?,00000000,?,00336DFD,?), ref: 0033F8DB
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,00336DFD,?), ref: 0033F91B
HeapFree.KERNEL32(00000000,?,00000000,?,00336DFD,?), ref: 0033F922

Part of subcall function 0033F711: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,00000000,0033F911,00000000,?,00000000,?,00336DFD,?), ref: 0033F733
Part of subcall function 0033F711: HeapAlloc.KERNEL32(00000000,?,00000000,?,00336DFD,?), ref: 0033F73A

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 71cb304dc999a5f11e96c73d2416506a4a28c4b1165349effc5f8391a9e4dbe2
Instruction ID: a88fbf32700cefee1b24a482ed4a831ff25f28588228cd95db070b74581c1d0d
Opcode Fuzzy Hash: 71cb304dc999a5f11e96c73d2416506a4a28c4b1165349effc5f8391a9e4dbe2
Instruction Fuzzy Hash: F2F0BE7AA046116FCB633B787C4CB6A2A6CAFC2B91F524038F54ACF250DF30C8018B50

Function 0034002C Relevance: 4.5, APIs: 3, Instructions: 42windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000500,?,00000000,00000000,00000137,00000000,?,67727473,?,?,?,00333C64,?,?,00000000), ref: 00340052
LocalFree.KERNEL32(00000000,00000137,?,?,?,00333C64,?,?,00000000), ref: 00340075
GetLastError.KERNEL32(?,?,?,00333C64,?,?,00000000), ref: 0034007D

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: af06e8b9c4a54f9fd55657fc071834bea43216c8745775965e54875babacdaff
Instruction ID: 1bb5f6f46e06a503d0b81f55156a3b1d7ff7597bf0cde3d51d921fc6574f284b
Opcode Fuzzy Hash: af06e8b9c4a54f9fd55657fc071834bea43216c8745775965e54875babacdaff
Instruction Fuzzy Hash: 03014B76901128FBDB229B91CD08ADEBEBCEF05350F114066F901AB140EA30AF00DAE0

Function 00340A80 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00010A30), ref: 00340A85

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a6d9835acd29bf017ccff0d62fc80bf92a6373940c8af9c844a35f7ba2579958
Instruction ID: 5d0cac319b67a7878f0c4975ffa0f57541348c16874e2d95cb72fe1666cd26d1
Opcode Fuzzy Hash: a6d9835acd29bf017ccff0d62fc80bf92a6373940c8af9c844a35f7ba2579958
Instruction Fuzzy Hash: 4B9002643612004646062B705D1994675D45A59702F950550E542CD054DF7061009511

Function 0033BD3D Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A9ED: MapDialogRect.USER32(?,?), ref: 0033AA1C
Part of subcall function 0033A9ED: GetWindowRect.USER32(?,?), ref: 0033AA42
Part of subcall function 0033A9ED: EnumChildWindows.USER32(?,0033AD30), ref: 0033AABD
Part of subcall function 0033A9ED: InvalidateRect.USER32(?,00000000,00000001), ref: 0033AAC9

GetDlgItem.USER32(?,sx}), ref: 0033BDB1

Part of subcall function 0033EC08: GlobalAlloc.KERNEL32(00000002,?,?,?,?,00000000,?), ref: 0033EC3C
Part of subcall function 0033EC08: GetLastError.KERNEL32(?,00000000,?), ref: 0033EC48
Part of subcall function 0033EC08: GlobalLock.KERNEL32(00000000), ref: 0033EC66
Part of subcall function 0033EC08: GetLastError.KERNEL32(?,00000000,?), ref: 0033EC72
Part of subcall function 0033EC08: memcpy.MSVCRT(00000000,?,?,?,00000000,?), ref: 0033EC96
Part of subcall function 0033EC08: CreateStreamOnHGlobal.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000001,00000000,?,00000000,?), ref: 0033ECA5
Part of subcall function 0033EC08: GlobalUnlock.KERNEL32(00000000), ref: 0033ECB2
Part of subcall function 0033EC08: GlobalFree.KERNEL32(00000000), ref: 0033ECB9

GetWindowRect.USER32(?,?), ref: 0033BDEB
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033BE00
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 0033BE08
_ftol2_sse.MSVCRT ref: 0033BE6B
MoveWindow.USER32(?,?,?,?,?,00000000,?,00000005,?,?,00000001,?), ref: 0033BE86
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 0033BE90
InvalidateRect.USER32(?,00000000,00000000,?,?,00000005,?,?,00000001,?), ref: 0033BECD
GetDlgItem.USER32(?,00000064), ref: 0033BEDA
GetWindowRect.USER32(00000000,?), ref: 0033BEE7
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033BEFC
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 0033BF04
MoveWindow.USER32(00000000,?,?,?,?,00000001,?,00000005,?,?,00000001,?), ref: 0033BF40
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 0033BF4A
DeleteObject.GDI32(00000000), ref: 0033BF5C

Strings

x, xrefs: 0033BD84
n, xrefs: 0033BDA0
d, xrefs: 0033BD92
sx}, xrefs: 0033BDAA
}, xrefs: 0033BD8B
i, xrefs: 0033BD99

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$ErrorLastRect$Global$InvalidateItemMovePoints$AllocChildCreateDeleteDialogEnumFreeLockObjectStreamUnlockWindows_ftol2_ssememcpy
String ID: d$i$n$sx}$x$}
API String ID: 3487292329-3487999874
Opcode ID: f778df661839fb76838e426ecef993f51ada85c75c3c2d3b0be9479ee6dd88e3
Instruction ID: b024195d64f3a7aa5d9a925961b5eacddc68a74a5cd4c922709797c30eb299a9
Opcode Fuzzy Hash: f778df661839fb76838e426ecef993f51ada85c75c3c2d3b0be9479ee6dd88e3
Instruction Fuzzy Hash: 46711735A00219EFEB029FE5DD88BAEBBB9FF05740F114015EA05AB264CB74A915CF60

Function 00338AC0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 181
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00339D26: GetSystemTime.KERNEL32(?,000001F5,?,00000000), ref: 00339DEA

WcsCreateIccProfile.MSCMS(?,00000000,?,?), ref: 00338B0C
GetLastError.KERNEL32 ref: 00338B1C
GetColorProfileFromHandle.MSCMS(00000000,00000000,?,?,?), ref: 00338B51
GetLastError.KERNEL32 ref: 00338B5B
GetColorProfileFromHandle.MSCMS(00000000,00000000,?), ref: 00338BAC
GetLastError.KERNEL32 ref: 00338BB6
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00338BEF
GetLastError.KERNEL32 ref: 00338BFC
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00338C26
GetLastError.KERNEL32 ref: 00338C41
CloseHandle.KERNEL32(00000000), ref: 00338C5B
InstallColorProfileW.MSCMS(00000000,?), ref: 00338C6D
GetLastError.KERNEL32 ref: 00338C77
CloseHandle.KERNEL32(00000000), ref: 00338CAE
CloseColorProfile.MSCMS(00000000,?,?), ref: 00338CBF
CloseColorProfile.MSCMS(?,?,?), ref: 00338CCE

Strings

strg, xrefs: 00338C30

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLastProfile$Color$CloseHandle$CreateFileFrom$InstallSystemTimeWrite
String ID: strg
API String ID: 3772428985-3320446829
Opcode ID: 59dffb074dd3d30e09b0027b7eae9a294c359bcc175d3ef4f17790617558d073
Instruction ID: 9606379630af38168560aefdca3b7e62677d14672711f6e8f8f07c315341f8c3
Opcode Fuzzy Hash: 59dffb074dd3d30e09b0027b7eae9a294c359bcc175d3ef4f17790617558d073
Instruction Fuzzy Hash: 0E51057A1447029BD7139F258DC4B5BFAEAAFC4360F260929F955CB251EF70D9008AB1

Function 0033A1B6 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000080,?,000000FF,00000000,00000000,00000000,00000000,00330000,000001F7,00000000,00000000,00000000), ref: 0033A253
GetLastError.KERNEL32 ref: 0033A262

Part of subcall function 0033FE77: LoadStringW.USER32(003361E0,?,00000000,00000400), ref: 0033FE9A

WideCharToMultiByte.KERNEL32(0000FDE9,00000080,?,000000FF,00000000,00000000,00000000,00000000), ref: 0033A2A9
GetLastError.KERNEL32 ref: 0033A2B3
memset.MSVCRT ref: 0033A33A
memcpy.MSVCRT(00000004,?,?,00000000,00000000,?,00330000,000001F7,00000000,00000000,00000000), ref: 0033A35C
SetColorProfileElementSize.MSCMS(?,64657363,?,?,00330000,000001F7,00000000,00000000,00000000), ref: 0033A441
GetLastError.KERNEL32(?,00330000,000001F7,00000000,00000000,00000000), ref: 0033A44B
SetColorProfileElement.MSCMS(?,64657363,00000000,?,00000000,?,00330000,000001F7,00000000,00000000,00000000), ref: 0033A47A
GetLastError.KERNEL32(?,00330000,000001F7,00000000,00000000,00000000), ref: 0033A484

Strings

strg, xrefs: 0033A37C, 0033A3C4, 0033A39B
strg, xrefs: 0033A1D8
strg, xrefs: 0033A200
strg, xrefs: 0033A21E

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLast$ByteCharColorElementMultiProfileWide$LoadSizeStringmemcpymemset
String ID: strg$strg$strg$strg
API String ID: 139363455-4050408924
Opcode ID: 196760de31b2c6cc6e5e184ec521c567c7f687d60ef6b8b76398cd32fdeb0b41
Instruction ID: a5516cc7c66f6357cf5e0a0206d9e34e3dba28c83f5c986911027b625536fea6
Opcode Fuzzy Hash: 196760de31b2c6cc6e5e184ec521c567c7f687d60ef6b8b76398cd32fdeb0b41
Instruction Fuzzy Hash: C7A1C075E0021A9BCB06DFA9C8C1AEEBBF5FF48310F244129E941BB351DB71A901CB91

Function 00339D26 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 235
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTime.KERNEL32(?,000001F5,?,00000000), ref: 00339DEA
_CIpow.MSVCRT ref: 00339ED5

Part of subcall function 0033FE77: LoadStringW.USER32(003361E0,?,00000000,00000400), ref: 0033FE9A

_CIpow.MSVCRT ref: 00339EF3
_CIpow.MSVCRT ref: 00339F11
WcsOpenColorProfileW.MSCMS(00000002,?,00000000,00000001,00000001,00000003,00000000,</cdm:Calibration></cdm:ColorDeviceModel>), ref: 00339FC7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00339FD6

Strings

D65.camp, xrefs: 00339FA4
strg, xrefs: 00339E71
</cdm:Calibration></cdm:ColorDeviceModel>, xrefs: 00339F60
<?xml version="1.0" encoding="utf-16"?><cdm:ColorDeviceModel%txmlns:cdm="http://schemas.microsoft.com/windows/2005/02/color/Colo, xrefs: 00339E37
strg, xrefs: 00339F8F
strg, xrefs: 00339D4C
%4d-%02d-%02dT%02d:%02d:%02d, xrefs: 00339E11
<cal:AdapterGammaConfiguration><cal:ParameterizedCurves><wcs:RedTRC Gamma="%f" Gain="%f" Offset1="0.0"/><wcs:GreenT, xrefs: 00339F2C

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Ipow$ColorErrorLastLoadOpenProfileStringSystemTime
String ID: </cdm:Calibration></cdm:ColorDeviceModel>$<cal:AdapterGammaConfiguration><cal:ParameterizedCurves><wcs:RedTRC Gamma="%f" Gain="%f" Offset1="0.0"/><wcs:GreenT$%4d-%02d-%02dT%02d:%02d:%02d$<?xml version="1.0" encoding="utf-16"?><cdm:ColorDeviceModel%txmlns:cdm="http://schemas.microsoft.com/windows/2005/02/color/Colo$D65.camp$strg$strg$strg
API String ID: 1408563361-1103866935
Opcode ID: 5ad8eb0a731f3d8cc10fe3a8952d095a0a0f4b75207e48b201a83b9407f7d21f
Instruction ID: f20c062719af0c6561fe824a75be454a18e0c8efa63b048299301e6482e40d9a
Opcode Fuzzy Hash: 5ad8eb0a731f3d8cc10fe3a8952d095a0a0f4b75207e48b201a83b9407f7d21f
Instruction Fuzzy Hash: 41915635D01219EBCB02EFA4D885AEEBBB5FF48700F514069F941BB265DB35A921CB90

Function 003391D3 Relevance: 24.2, APIs: 16, Instructions: 245COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 003391F9
SetCursor.USER32(00000000), ref: 00339200
ShowCursor.USER32(00000001), ref: 00339208
GetNumberOfPhysicalMonitorsFromHMONITOR.DXVA2(?,?), ref: 00339266
ShowCursor.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,00337BA6,00000000), ref: 003394AC
LoadCursorW.USER32(00000000,00007F00), ref: 003394BA
SetCursor.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,00337BA6,00000000), ref: 003394C1

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Cursor$LoadShow$FromMonitorsNumberPhysical
String ID:
API String ID: 1684749270-0
Opcode ID: cfd423c4c22d6a7f7e7f570cbd693d20844ee33db66efd15c4667508c1a3db4e
Instruction ID: 78b6c4268cde384f993b0bffd97f275088242f33867483874fe8b2675ec79d24
Opcode Fuzzy Hash: cfd423c4c22d6a7f7e7f570cbd693d20844ee33db66efd15c4667508c1a3db4e
Instruction Fuzzy Hash: 9581A579A00622DBC713DF75D88576AB7A9AF48720F05462AED02EB350DFB0ED418BD1

Function 0033EC08 Relevance: 22.6, APIs: 15, Instructions: 149memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0033F117: FindResourceW.KERNEL32(00330000,?,000001F4,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F13C
Part of subcall function 0033F117: GetLastError.KERNEL32(?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F14B
Part of subcall function 0033F117: LoadResource.KERNEL32(00330000,00000000,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F166
Part of subcall function 0033F117: GetLastError.KERNEL32(?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F172
Part of subcall function 0033F117: SizeofResource.KERNEL32(00330000,?,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F18F
Part of subcall function 0033F117: LockResource.KERNEL32(00000000,?,00000000,?,?,?,0033EC29,?,?,?,00000000,?), ref: 0033F19B

GlobalAlloc.KERNEL32(00000002,?,?,?,?,00000000,?), ref: 0033EC3C
GetLastError.KERNEL32(?,00000000,?), ref: 0033EC48
GlobalLock.KERNEL32(00000000), ref: 0033EC66
GetLastError.KERNEL32(?,00000000,?), ref: 0033EC72
memcpy.MSVCRT(00000000,?,?,?,00000000,?), ref: 0033EC96
CreateStreamOnHGlobal.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000001,00000000,?,00000000,?), ref: 0033ECA5
GlobalUnlock.KERNEL32(00000000), ref: 0033ECB2
GlobalFree.KERNEL32(00000000), ref: 0033ECB9
GlobalUnlock.KERNEL32(00000000), ref: 0033ECC5
GetLastError.KERNEL32(?,00000000,?), ref: 0033ECCF
GdipAlloc.GDIPLUS(00000010,?,00000000,?), ref: 0033ECF0
GdipCreateBitmapFromStream.GDIPLUS(00000000,?,?,00000000,?), ref: 0033ED12
GdipCreateHBITMAPFromBitmap.GDIPLUS(00000000,00000110,FF000000,?,00000000,?), ref: 0033ED2D
GetObjectW.GDI32(00000110,00000018,?), ref: 0033ED68
GetLastError.KERNEL32(?,00000000,?), ref: 0033ED86

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorGlobalLast$Resource$CreateGdip$AllocBitmapFromLockStreamUnlock$FindFreeLoadObjectSizeofmemcpy
String ID:
API String ID: 4269010864-0
Opcode ID: 4e103d76b83c95fdcd2e96ca72f34f1f2f25ca39236bdfa89a1157431ed79fba
Instruction ID: 688f167735965951e57887facc76bfeba9e67069e76d6b427eac0365223d9967
Opcode Fuzzy Hash: 4e103d76b83c95fdcd2e96ca72f34f1f2f25ca39236bdfa89a1157431ed79fba
Instruction Fuzzy Hash: F051427BD00626AFC7239B9AC9847AEBAB8AF54711F124114ED55FB290DB30DE009B90

Function 0033DC75 Relevance: 21.2, APIs: 14, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 00337505
Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 0033751D
Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 00337535
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033754E
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033755F
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00337570
Part of subcall function 003374D3: _ftol2_sse.MSVCRT ref: 00337602

GetWindowRect.USER32(?,?), ref: 0033DCB6
GetWindowRect.USER32(?,?), ref: 0033DCCE
GetWindowRect.USER32(?,?), ref: 0033DCE6
_ftol2_sse.MSVCRT ref: 0033DD2C
_ftol2_sse.MSVCRT ref: 0033DD4B
_ftol2_sse.MSVCRT ref: 0033DD5F
_ftol2_sse.MSVCRT ref: 0033DD87
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 0033DDA0
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 0033DDB6
_ftol2_sse.MSVCRT ref: 0033DDCB
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 0033DDED
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 0033DE06
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 0033DE27
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 0033DE3D

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$MoveRect_ftol2_sse$Points
String ID:
API String ID: 4142400812-0
Opcode ID: ca8a6af545d2684760c934b8ae4f52c314f4564b1cc476319a309abf3fe8a4c3
Instruction ID: 5279b1aae02c5f7bbb8a79f8a5f259ec7bc4cc646dffa8556a9b8c4989f0b0a8
Opcode Fuzzy Hash: ca8a6af545d2684760c934b8ae4f52c314f4564b1cc476319a309abf3fe8a4c3
Instruction Fuzzy Hash: EB514872E00208FFCB169FA0EC89AEEBBB9EF48700F154528F105A6274DB716961DF50

Function 003394E3 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,00000068), ref: 00339519
GetLastError.KERNEL32(?,?,?), ref: 00339523
EnumDisplayDevicesW.USER32(?,00000000,?,00000000), ref: 00339557
GetLastError.KERNEL32(?,?,?), ref: 00339561
StringFromCLSID.API-MS-WIN-CORE-COM-L1-1-0(0033343C,?,?,?,?), ref: 0033958A
_wcsupr.MSVCRT ref: 0033959D
wcsstr.MSVCRT ref: 003395B0
swscanf_s.MSVCRT ref: 003395FB
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(00000000,?,?,?), ref: 0033961D

Strings

h, xrefs: 003394FD
%04d, xrefs: 003395F2

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLast$DevicesDisplayEnumFreeFromInfoMonitorStringTask_wcsuprswscanf_swcsstr
String ID: %04d$h
API String ID: 4201562086-3314846054
Opcode ID: 3f0dadb6773f24ead64309c0aef219047606c9a0d9ec454436d2a7699048c08f
Instruction ID: 4109b8a58e9c46fe158c1d2dd466c878ea532fe50f0a0227e36f62a82e0a5144
Opcode Fuzzy Hash: 3f0dadb6773f24ead64309c0aef219047606c9a0d9ec454436d2a7699048c08f
Instruction Fuzzy Hash: CC31A07A801228DBDB239B64DC89BA9B7BCEF45714F024199ED05EB204DB74EE45CB90

Function 003374D3 Relevance: 18.2, APIs: 12, Instructions: 169COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00337505
GetWindowRect.USER32(?,?), ref: 0033751D
GetWindowRect.USER32(?,?), ref: 00337535
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033754E
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033755F
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00337570
_ftol2_sse.MSVCRT ref: 00337602
_ftol2_sse.MSVCRT ref: 00337617
_ftol2_sse.MSVCRT ref: 0033762E
MoveWindow.USER32(?,?,?,-00000001,?,00000000,?,00000001,?), ref: 00337661
InvalidateRect.USER32(?,00000000,00000000,?,?,00000001,?), ref: 00337689
InvalidateRect.USER32(?,00000000,00000001,?,00000001,?), ref: 003376B3

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$Rect$Points_ftol2_sse$Invalidate$Move
String ID:
API String ID: 3848721580-0
Opcode ID: 6ab1dc1a6d8086405d1477e498152c8757e118da7b6aeae6152e5a061f9a071e
Instruction ID: 64cd422710f1c7ff20d9e1365295b0dc179ef5a86ff2c87fea5a3c82ae3e71ab
Opcode Fuzzy Hash: 6ab1dc1a6d8086405d1477e498152c8757e118da7b6aeae6152e5a061f9a071e
Instruction Fuzzy Hash: F4618F71A00208EFCF169FA4DD89BEDBFB9FF48300F058064E905AA1A5DB70A915CF50

Function 0033596D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00000022), ref: 003359A8
FindResourceExW.KERNEL32(00000000,?,?,00000000), ref: 003359C5
FreeLibrary.KERNEL32(00000000), ref: 00335A89

Part of subcall function 00334658: GetLastError.KERNEL32(003359D6), ref: 00334658

Strings

REGISTRY, xrefs: 00335CA3
Module, xrefs: 00335C57
Module_Raw, xrefs: 00335C77

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Library$ErrorFindFreeLastLoadResource
String ID: Module$Module_Raw$REGISTRY
API String ID: 3418355812-549000027
Opcode ID: 328e546c606042ff23270da832daa735be5a68d0482736ebb5e2a816275d9de5
Instruction ID: 9f63c36b403cf176d0fb12155693a3986188ed85996f04ab8aa80a5289c1c394
Opcode Fuzzy Hash: 328e546c606042ff23270da832daa735be5a68d0482736ebb5e2a816275d9de5
Instruction Fuzzy Hash: 1C31A7B5A00519ABDB27DF148CC5BAE76B8DF45360F1142A9F606BB240DF309E819BA4

Function 003401E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

iswupper.MSVCRT ref: 00340217
towlower.MSVCRT ref: 00340226
iswupper.MSVCRT ref: 00340234
towlower.MSVCRT ref: 00340240
iswupper.MSVCRT ref: 00340278
towlower.MSVCRT ref: 00340287
iswupper.MSVCRT ref: 00340295
towlower.MSVCRT ref: 003402A1

Strings

{4D36E96E-E325-11CE-BFC1-08002BE10318}, xrefs: 003401FC, 0034020B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: iswuppertowlower
String ID: {4D36E96E-E325-11CE-BFC1-08002BE10318}
API String ID: 2404469642-206008433
Opcode ID: dea506cde700180ea5759d0474e80f385dbf74d8a6644eccb304fd2bde7ddfcd
Instruction ID: 68a7b5ea6c72b2573637190ca6cd5f91c5db8132232d641b8b5ba02490d4a2ad
Opcode Fuzzy Hash: dea506cde700180ea5759d0474e80f385dbf74d8a6644eccb304fd2bde7ddfcd
Instruction Fuzzy Hash: 7031B17AB00211DBCB2A9FA9D8485BA77F8EF59311711046AF581DB2C0EFB4EE40D760

Function 00335046 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(API-MS-Win-Core-LocalRegistry-L1-1-0.dll,?,00000000,?,?,00334FD9,?), ref: 00335061
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00335071
LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000000,?,00334FD9,?), ref: 00335083
GetProcAddress.KERNEL32(00000000,RegDeleteKeyW), ref: 00335093
GetLastError.KERNEL32(?,00000000,?,?,00334FD9,?), ref: 003350CE

Strings

RegDeleteKeyExW, xrefs: 0033506B
RegDeleteKeyW, xrefs: 0033508D
API-MS-Win-Core-LocalRegistry-L1-1-0.dll, xrefs: 0033505C
advapi32.dll, xrefs: 0033507E

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: AddressProc$ErrorHandleLastLibraryLoadModule
String ID: API-MS-Win-Core-LocalRegistry-L1-1-0.dll$RegDeleteKeyExW$RegDeleteKeyW$advapi32.dll
API String ID: 856554993-2654589138
Opcode ID: 23aed4b53b1fe4957ebf6fdf7110c4003e22bf37b13e89ea49396d1e36f97cbb
Instruction ID: 8bc5f11f1101cf3deb4e1739a5e844debfe6537acca297cfe900f6de59aa68bb
Opcode Fuzzy Hash: 23aed4b53b1fe4957ebf6fdf7110c4003e22bf37b13e89ea49396d1e36f97cbb
Instruction Fuzzy Hash: 7A11A975600B05EF87376F21DCC586BBB6DEB81781B254429F44697520DE72EC00CB60

Function 0033B6C3 Relevance: 15.2, APIs: 10, Instructions: 153COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0033B6F5
GetWindowRect.USER32(?,?), ref: 0033B70D
GetWindowRect.USER32(?,?), ref: 0033B725
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0033B778
_ftol2_sse.MSVCRT ref: 0033B796
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0033B7D3
MoveWindow.USER32(?,?,?,00000010,?,00000001), ref: 0033B7ED
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 0033B82A
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 0033B854
InvalidateRect.USER32(?,00000000,00000001), ref: 0033B861

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$Move$Rect$Invalidate_ftol2_sse
String ID:
API String ID: 1052920605-0
Opcode ID: ecd404c58e9676b906a030a131321d3bea4900ddc91e63a8afca03a1bb69a10f
Instruction ID: a81dd40513472c695a669b7f119b1b565539dc8a156aefd9f531ff907a735278
Opcode Fuzzy Hash: ecd404c58e9676b906a030a131321d3bea4900ddc91e63a8afca03a1bb69a10f
Instruction Fuzzy Hash: BB511A75B00619AFDB198FB9DD89BADFBB9FF04310F044228F519A62A0DB71A851CB50

Function 00339B02 Relevance: 15.1, APIs: 10, Instructions: 119COMMON

Download Yara Rule

APIs

WcsSetCalibrationManagementState.MSCMS(00000001,?,?,00000000), ref: 00339B18
GetLastError.KERNEL32(?,?,00000000), ref: 00339B22
WcsSetDefaultColorProfile.MSCMS(00000000,?,00000000,00000004,00000000,?,?,?,00000000), ref: 00339B64
GetLastError.KERNEL32(?,?,00000000), ref: 00339B6E
WcsGetUsePerUserProfiles.MSCMS(?,6D6E7472,?,?,?,00000000), ref: 00339B9C
GetLastError.KERNEL32(?,?,00000000), ref: 00339BA6
WcsSetDefaultColorProfile.MSCMS(00000001,?,00000000,00000004,00000000,?,?,?,00000000), ref: 00339BEF
GetLastError.KERNEL32(?,?,00000000), ref: 00339BF9
WcsSetCalibrationManagementState.MSCMS(00000000,?,?,00000000), ref: 00339C15
GetLastError.KERNEL32(?,?,00000000), ref: 00339C1F

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLast$CalibrationColorDefaultManagementProfileState$ProfilesUser
String ID:
API String ID: 2534168751-0
Opcode ID: 610de486d92ac943d0c6bfd4fde26a69e16f9d8e9f66cd3c47f58506c6effd2d
Instruction ID: 4a86c6c5ae305fdaa6c3e69143eb227d50b46ce99333b3dda9cc43f3713e1f5a
Opcode Fuzzy Hash: 610de486d92ac943d0c6bfd4fde26a69e16f9d8e9f66cd3c47f58506c6effd2d
Instruction Fuzzy Hash: F431F63FE00135DBD7235B699CC47BBBAA8AF44711F168166ED41EF240EAB0ED0086E0

Function 0033FC10 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(1C2474FF,?,0033F9CB,?,00000000,?,00336D51,00000000,?,00000000,0033615B,00000000,00000000,00000000,?,?), ref: 0033FC25
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,00333DB7,1C2474FF,?,0033F9CB,?,00000000,?,00336D51,00000000,?,00000000,0033615B,00000000), ref: 0033FC3A
DecodePointer.KERNEL32(003428AC,003428B0,003428B4,003428BC,?,0033F9CB,?,00000000,?,00336D51,00000000,?,00000000,0033615B,00000000,00000000), ref: 0033FCAF

Strings

AtlThunk_AllocateData, xrefs: 0033FC4B
AtlThunk_FreeData, xrefs: 0033FC8A
atlthunk.dll, xrefs: 0033FC35
AtlThunk_InitData, xrefs: 0033FC60
AtlThunk_DataToCode, xrefs: 0033FC75

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 8f263c8c6395fbaddfbfe06679e1b3af4eaa1b493db32b1fbe30605b23bf976e
Instruction ID: 9657c97b558972b32bc32227ce38c8eabe35ca74ee55437a917e64034cbf302e
Opcode Fuzzy Hash: 8f263c8c6395fbaddfbfe06679e1b3af4eaa1b493db32b1fbe30605b23bf976e
Instruction Fuzzy Hash: 4A01B539B802486FDB1BA7209D876AE7A45CF92704F958068BC467F3D1CF60AE418685

Function 0033F9FA Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,0033F8A5,?,00000000,00000000,?,0033702D,?,?,00000000,00000000,?,00000000,?,00336DFD), ref: 0033FA0F
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,0033F8A5,?,00000000,00000000,?,0033702D,?,?,00000000,00000000), ref: 0033FA24
DecodePointer.KERNEL32(003428AC,003428B0,003428B4,003428BC,?,?,0033F8A5,?,00000000,00000000,?,0033702D,?,?,00000000,00000000), ref: 0033FA99

Strings

AtlThunk_AllocateData, xrefs: 0033FA35
AtlThunk_FreeData, xrefs: 0033FA74
atlthunk.dll, xrefs: 0033FA1F
AtlThunk_InitData, xrefs: 0033FA4A
AtlThunk_DataToCode, xrefs: 0033FA5F

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 61519fb563dcec7d4d68239b94ec1cda2a9a528729ed640e360251d6bef68d58
Instruction ID: 560e2c321d34471fc1e79fe8bb3938fb9a2bde700f6a9a813fd3b7731b35e957
Opcode Fuzzy Hash: 61519fb563dcec7d4d68239b94ec1cda2a9a528729ed640e360251d6bef68d58
Instruction Fuzzy Hash: B901B528B402947FEF1BE7109CC76AE3A458B82748F95407CF41A7F3D1CF60AE458A85

Function 0033FAAC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,0033F8F1,00000000,?,00000000,?,00336DFD,?), ref: 0033FAC1
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,00000000,?,?,0033F8F1,00000000,?,00000000,?,00336DFD,?), ref: 0033FAD6
DecodePointer.KERNEL32(003428AC,003428B0,003428B4,003428BC,?,?,0033F8F1,00000000,?,00000000,?,00336DFD,?), ref: 0033FB4B

Strings

AtlThunk_AllocateData, xrefs: 0033FAE7
AtlThunk_FreeData, xrefs: 0033FB26
atlthunk.dll, xrefs: 0033FAD1
AtlThunk_InitData, xrefs: 0033FAFC
AtlThunk_DataToCode, xrefs: 0033FB11

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: a1070530f38f919312bc3247a7ebc66f3704594e934f630f542d431be096d056
Instruction ID: eab13884b37b552367b624ef0e936ade9d83c103681c72a4c14388b7d652d7bf
Opcode Fuzzy Hash: a1070530f38f919312bc3247a7ebc66f3704594e934f630f542d431be096d056
Instruction Fuzzy Hash: 4901F564B002002FEB1BA720DC97AAF7B468B42708F99803CB41A7F3D1CF64AE018695

Function 0033FB5E Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,0033F980,00000000,00000000,?,00337025,?,00000000,00000000,?,00000000,?,00336DFD,?), ref: 0033FB73
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,0033F980,00000000,00000000,?,00337025,?,00000000,00000000,?,00000000), ref: 0033FB88
DecodePointer.KERNEL32(003428AC,003428B0,003428B4,003428BC,?,0033F980,00000000,00000000,?,00337025,?,00000000,00000000,?,00000000), ref: 0033FBFD

Strings

AtlThunk_AllocateData, xrefs: 0033FB99
AtlThunk_FreeData, xrefs: 0033FBD8
atlthunk.dll, xrefs: 0033FB83
AtlThunk_InitData, xrefs: 0033FBAE
AtlThunk_DataToCode, xrefs: 0033FBC3

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 61b1dd098344ed18b1a67e3d400de6a6d5755f3420316efe24141254660c5db3
Instruction ID: 8460f7f443378383358ca1c900c4fd5f02cf2938fd76195992a181cefcf359cf
Opcode Fuzzy Hash: 61b1dd098344ed18b1a67e3d400de6a6d5755f3420316efe24141254660c5db3
Instruction Fuzzy Hash: 9401F964B402452FEB1B57108DCB69F3A458B42704F95403CB8023F3D1DF54DD028685

Function 0033A4CC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 003401E0: iswupper.MSVCRT ref: 00340217
Part of subcall function 003401E0: towlower.MSVCRT ref: 00340226
Part of subcall function 003401E0: iswupper.MSVCRT ref: 00340234
Part of subcall function 003401E0: towlower.MSVCRT ref: 00340240
Part of subcall function 003401E0: iswupper.MSVCRT ref: 00340278
Part of subcall function 003401E0: towlower.MSVCRT ref: 00340287
Part of subcall function 003401E0: iswupper.MSVCRT ref: 00340295
Part of subcall function 003401E0: towlower.MSVCRT ref: 003402A1

GetDisplayConfigBufferSizes.USER32(00000002,?,?), ref: 0033A522

Strings

T, xrefs: 0033A5F1

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: iswuppertowlower$BufferConfigDisplaySizes
String ID: T
API String ID: 3551102313-3187964512
Opcode ID: 53f8f4d8cee7eabd958841aa074a1266d0fb285130f6ce98c4e1d5c52c400633
Instruction ID: f32e039083bf762b7fa99a12b3a1bf70331e3ba2ec47752cd2fa46a3097ff440
Opcode Fuzzy Hash: 53f8f4d8cee7eabd958841aa074a1266d0fb285130f6ce98c4e1d5c52c400633
Instruction Fuzzy Hash: AA51B671A007199FDB26DF64CC85BAEB7FCAF45300F0541AAA645EB180DB709E808F51

Function 00338AA1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

WcsCreateIccProfile.MSCMS(?,00000000,?,?), ref: 00338B0C
GetLastError.KERNEL32 ref: 00338B1C
GetColorProfileFromHandle.MSCMS(00000000,00000000,?,?,?), ref: 00338B51
GetLastError.KERNEL32 ref: 00338B5B
CloseColorProfile.MSCMS(00000000,?,?), ref: 00338CBF
CloseColorProfile.MSCMS(?,?,?), ref: 00338CCE

Strings

strg, xrefs: 00338ACF

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Profile$Color$CloseErrorLast$CreateFromHandle
String ID: strg
API String ID: 2314085371-3320446829
Opcode ID: fe9c9596b5615946c4a01b563738012214c91faaae5822492c41a070de52ab2c
Instruction ID: a4cfcd3b6d518501d0e26abc05b32f4f2664ac359140c20731037b01fecf35c0
Opcode Fuzzy Hash: fe9c9596b5615946c4a01b563738012214c91faaae5822492c41a070de52ab2c
Instruction Fuzzy Hash: 072107B52043029BC3039F29D98555BFBE9AFC5790F11092EF954C7251EFB0CE058BA2

Function 00336A60 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39synchronizationwindowCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(000001D8), ref: 00336A72
CloseHandle.KERNEL32 ref: 00336A7E
OpenIcon.USER32(?), ref: 00336A98
SetForegroundWindow.USER32(?), ref: 00336AA1
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000003), ref: 00336AB1
CallWindowProcW.USER32(?,?,?,?), ref: 00336ACE

Strings

dccw, xrefs: 00336AB7

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$CallCloseForegroundHandleIconMutexOpenProcRelease
String ID: dccw
API String ID: 1295780963-1595938506
Opcode ID: 8669f46ac7c61c014a3172efff2b0c67f5b9e607edc85f743e381c0c9560792a
Instruction ID: 9beeb585fe09e85a74afb9b646d2c41e0cf69e2ae75a150386ba9f5a0589ac55
Opcode Fuzzy Hash: 8669f46ac7c61c014a3172efff2b0c67f5b9e607edc85f743e381c0c9560792a
Instruction Fuzzy Hash: ADF0E77A10421CFFCB13AF95EC4889A7FADFF4A341F448415F905AA130CB71AA60EB90

Function 0033905D Relevance: 12.1, APIs: 8, Instructions: 119COMMON

Download Yara Rule

APIs

WcsGetUsePerUserProfiles.MSCMS(?,6D6E7472,?,?,?,?), ref: 0033909A
GetLastError.KERNEL32(?,?,?), ref: 003390A4
WcsGetDefaultColorProfile.MSCMS(00000000,?,00000001,00000004,00000000,00000208,?,?,?,?), ref: 003390E7
GetLastError.KERNEL32(?,?,?), ref: 003390F1
WcsOpenColorProfileW.MSCMS(?,00000000,00000000,00000001,00000001,00000003,00000000,?,?,?), ref: 0033913B
GetLastError.KERNEL32(?,?,?), ref: 00339147
DccwGetGamutSize.MSCMS(00000000,?,?,?,?), ref: 00339168
CloseColorProfile.MSCMS(00000000,?,?,?), ref: 003391B6

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ColorErrorLastProfile$CloseDccwDefaultGamutOpenProfilesSizeUser
String ID:
API String ID: 1332131993-0
Opcode ID: 4ef57fa8a2efa5aae432e778c6ba971edc081e8ae30f181ab36ec74cd70d7583
Instruction ID: 1d215183649466420feb1c8cf3f139fe1a53c175b9b585ba7c6cd9d580d231b1
Opcode Fuzzy Hash: 4ef57fa8a2efa5aae432e778c6ba971edc081e8ae30f181ab36ec74cd70d7583
Instruction Fuzzy Hash: AB41EB3AD4013ADBD7228B55DCCCBEBBAB8AB45710F12029AED45F7251DE70DD408A90

Function 00334A7B Relevance: 10.8, APIs: 7, Instructions: 264registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 003350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 00335132
Part of subcall function 003350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 0033514F
Part of subcall function 003350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 00335162
Part of subcall function 003350F7: CharNextW.USER32(00000027,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 0033516D

lstrcmpiW.KERNEL32(?,00000000,?,?,?,?,0033542A,?,?,?,?,?), ref: 00334AE0
CharNextW.USER32(00000000), ref: 00334BBA
CharNextW.USER32(00000000), ref: 00334BD4
VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 00334C4B
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,-00000008,?,?,0033542A,?,?,?,?,?), ref: 00334DB3

Part of subcall function 003350F7: CharNextW.USER32(?,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 003351CA
Part of subcall function 003350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 003351EE

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CharNext$FromValuelstrcmpi
String ID:
API String ID: 2221274522-0
Opcode ID: e7535ccc786e413eed685b8b430a0dfe3a4ebbdc8e0abb7433af7c7719d20dfd
Instruction ID: 840bedcfd7c9d2ad35068a8151b29390254ba3607c9aff0cbd14d85c984cb0c5
Opcode Fuzzy Hash: e7535ccc786e413eed685b8b430a0dfe3a4ebbdc8e0abb7433af7c7719d20dfd
Instruction Fuzzy Hash: 23A1C835A002289BDB369F24CCD9AE9B7B9EF65300F0541E9EB099B251D770AEC1CF50

Function 0033DE5A Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

GdipCreateSolidFill.GDIPLUS(FF787878,00000000,00000001,?,?), ref: 0033DEAF
GdipCreateFromHDC.GDIPLUS(?,00000000,?,?), ref: 0033DEC0
GdipFillRectangleI.GDIPLUS(00000000,00000000,00000000,?,00000001,?,?,?), ref: 0033DEE3
GdipFillRectangleI.GDIPLUS(00000000,?,00000005,?,?,?,?,?,?,FFFF0000), ref: 0033DF6B
GdipDeleteBrush.GDIPLUS(?), ref: 0033DF74
GdipDeleteGraphics.GDIPLUS(00000000), ref: 0033DF7B
GdipDeleteBrush.GDIPLUS(00000000), ref: 0033DF84

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Gdip$DeleteFill$BrushCreateRectangle$FromGraphicsSolid
String ID:
API String ID: 2116296181-0
Opcode ID: 6ec384f1d9146bb7754cc7f91940f0407f8abc5084f550a99e621b5c58325b30
Instruction ID: 27be903f43386f0fc769764c801b14692fee8dd5d6656f347b81dd812276fce8
Opcode Fuzzy Hash: 6ec384f1d9146bb7754cc7f91940f0407f8abc5084f550a99e621b5c58325b30
Instruction Fuzzy Hash: 07415D72900609EFDB21CFA8CD88AAEBBFDFF48301F114619E546E7654DB30AA05CB50

Function 0033C710 Relevance: 10.6, APIs: 7, Instructions: 104COMMON

Download Yara Rule

APIs

GdipCreateFromHDC.GDIPLUS(?,?,?,?,00000001), ref: 0033C779
GdipCreateSolidFill.GDIPLUS(FF000000,00000093,?,?,00000001), ref: 0033C78C
GdipFillRectangleI.GDIPLUS(?,00000093,00000000,?,00000001,?,?,?,00000001), ref: 0033C7AC

Part of subcall function 0033C8B1: GdipCreateLineBrushI.GDIPLUS(?,?,?,?,00000000,00000000,?,?,?,0033C7E2,?,00000000,?,?,?,?), ref: 0033C8E2

GdipFillRectangleI.GDIPLUS(?,?,00000005,?,?,?,?,00000000,?,?,?,?,00000001), ref: 0033C806
GdipDeleteBrush.GDIPLUS(?,?,?,00000001), ref: 0033C80F
GdipDeleteBrush.GDIPLUS(00000093,?,?,00000001), ref: 0033C818
GdipDeleteGraphics.GDIPLUS(?,?,?,00000001), ref: 0033C81F

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Gdip$BrushCreateDeleteFill$Rectangle$FromGraphicsLineSolid
String ID:
API String ID: 1713370201-0
Opcode ID: 9dff18e3c789f01e4e1268a70e890de25deaf4b26c09f04279df6e21fc84e758
Instruction ID: ceca51a7e64a8aa9a0c0f8f84fa3b09b5deeed5dcf459657fe580236b87ef423
Opcode Fuzzy Hash: 9dff18e3c789f01e4e1268a70e890de25deaf4b26c09f04279df6e21fc84e758
Instruction Fuzzy Hash: 1741DB7690051AFFCB05DFA8D984CAEBBB9FF08314B104269E516E7610DB30EA15CF91

Function 00336EB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,00000024,?), ref: 00336F30
GetWindowLongW.USER32(?,000000FC), ref: 00336F40
CallWindowProcW.USER32(?,?,00000082,00000024,?), ref: 00336F59
GetWindowLongW.USER32(?,000000FC), ref: 00336F72
SetWindowLongW.USER32(?,000000FC,?), ref: 00336F84

Strings

$, xrefs: 00336EEB

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 2fb2daf4053f9fa6092ea635ae2bfd0f19b57b766a515f609943d535c11b5514
Instruction ID: 1af162b33d4a118d7f3ac7d4ebd4f7492f6ee425b8938d9570edcb7ad13676a7
Opcode Fuzzy Hash: 2fb2daf4053f9fa6092ea635ae2bfd0f19b57b766a515f609943d535c11b5514
Instruction Fuzzy Hash: 06413B75A0061AFFCB06CF58D9859ADFBB5FF48310F108219E815E3660DB71AA60DF90

Function 0033E9DC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001100,00000000,003368A9,00000000,00330000,00000000,00000000), ref: 0033EA5C
FormatMessageW.KERNEL32(00002500,?,00000000,00000000,?,00000000,?,00330000,-0000012A), ref: 0033EAC2
LocalFree.KERNEL32(00000000), ref: 0033EAE2
LocalFree.KERNEL32(00000000,00330000,-0000012A), ref: 0033EAF3

Part of subcall function 0033E8E3: EventWrite.ADVAPI32(00331F20,00000001,?,?,003368A9,00000000), ref: 0033E944
Part of subcall function 0033E8E3: MessageBoxW.USER32(00000000,00000000,003428C8,00000010), ref: 0033E973

Strings

strg, xrefs: 0033EA8F
strg, xrefs: 0033EA82

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Message$FormatFreeLocal$EventWrite
String ID: strg$strg
API String ID: 3780319976-3117884289
Opcode ID: 6af3dbc80cacdd45f6f891586647abd0b1d221981b95ab68a0ecb3114696cca5
Instruction ID: df5e825194479c8bac2413712f8dcfa973835d4f12cf691e988b961f3ace49af
Opcode Fuzzy Hash: 6af3dbc80cacdd45f6f891586647abd0b1d221981b95ab68a0ecb3114696cca5
Instruction Fuzzy Hash: 8431A2716083019FE302DF60DC85B6BBBE8FB84755F00092DF5919A2A0DB74E904CBA2

Function 0033F3B0 Relevance: 10.6, APIs: 7, Instructions: 82windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 0033F3C9
EnumDisplayMonitors.USER32(00000000,00000000,Function_0000F100,00000000), ref: 0033F3E1
ReleaseDC.USER32(?,00000000), ref: 0033F3E9
GetLastError.KERNEL32 ref: 0033F3F1
GetParent.USER32(00000000), ref: 0033F43B
PostMessageW.USER32(00000000,00000470,00000000,00000003), ref: 0033F44B
ShowWindow.USER32(00000000,00000003,?), ref: 0033F460

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: DisplayEnumErrorLastMessageMonitorsParentPostReleaseShowWindow
String ID:
API String ID: 3937410996-0
Opcode ID: fa6a13c65efb35cf5ab9ff0f852a6d83b5ebfe8c70210c7356b11c80b9e7fe7d
Instruction ID: 90a4cce4442a63d92db81b6fbcc3934569a739d593eb56597e4def53eb18df89
Opcode Fuzzy Hash: fa6a13c65efb35cf5ab9ff0f852a6d83b5ebfe8c70210c7356b11c80b9e7fe7d
Instruction Fuzzy Hash: 7B21B039B00211AFDB12AB66DC89BAA7BACEF45751F504065F501EB2A0CF74EE018B51

Function 0033AF80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000095), ref: 0033AFD1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0033AFE1
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0033AFF9
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0033B044

Strings

open, xrefs: 0033B03E
CTTune.exe, xrefs: 0033B01D

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: DirectoryExecuteItemMessageSendShellSystem
String ID: CTTune.exe$open
API String ID: 2938676387-2528619867
Opcode ID: 7894982a38ff5fe2c694e479c05dd2cf98595f5529829351830bf28a1ff7749a
Instruction ID: 105e4d229be1cee7a9f0107bea7e1eac255fa8a7a1f75549860b9a0c7832fe64
Opcode Fuzzy Hash: 7894982a38ff5fe2c694e479c05dd2cf98595f5529829351830bf28a1ff7749a
Instruction Fuzzy Hash: 4021D475B01224A7CB27AB25DCC9E6BB7ACDF81B10F114165FA15EF281CF74EE408A90

Function 0033F711 Relevance: 10.6, APIs: 7, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,00000000,0033F911,00000000,?,00000000,?,00336DFD,?), ref: 0033F733
HeapAlloc.KERNEL32(00000000,?,00000000,?,00336DFD,?), ref: 0033F73A

Part of subcall function 0033F7EE: IsProcessorFeaturePresent.KERNEL32(0000000C,0033F721,00000000,00000000,0033F911,00000000,?,00000000,?,00336DFD,?), ref: 0033F7F0

InterlockedPopEntrySList.KERNEL32(00000000,00000000,00000000,0033F911,00000000,?,00000000,?,00336DFD,?), ref: 0033F743
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,?,00336DFD,?), ref: 0033F766
InterlockedPopEntrySList.KERNEL32(?,00000000,?,00336DFD,?), ref: 0033F77E
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,00336DFD,?), ref: 0033F792

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$FeatureFreePresentProcessProcessor
String ID:
API String ID: 3687752540-0
Opcode ID: c66f052ee5ac123462cf7096e1f40ea80a19caab8addf501e96017c1aa17bb97
Instruction ID: 0a7f6c05e77cbdc81bda49e7e08f33ed608172d4caf572b9884330395510f29a
Opcode Fuzzy Hash: c66f052ee5ac123462cf7096e1f40ea80a19caab8addf501e96017c1aa17bb97
Instruction Fuzzy Hash: AA11A939A00611BFE7672768DD88B2A769DEF467C2F950430F945EB2A0DF20EC418B60

Function 0033BC83 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0033A94C: GetWindowLongW.USER32(?,000000EC), ref: 0033A956
Part of subcall function 0033A94C: EnumChildWindows.USER32(?,0033AC60), ref: 0033A994
Part of subcall function 0033A94C: EnumChildWindows.USER32(?,0033AC80), ref: 0033A9CC

GetDlgItem.USER32(?,din), ref: 0033BD04
SetWindowTextW.USER32(00000000,003428C8), ref: 0033BD0E

Strings

din, xrefs: 0033BCFD
i, xrefs: 0033BCCB
n, xrefs: 0033BCD2
strg, xrefs: 0033BCE0

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ChildEnumWindowWindows$ItemLongText
String ID: din$i$n$strg
API String ID: 2822888986-2104475465
Opcode ID: c86d43cc03b08f92e11bb01bfd4d64b9e5940a6c5e5256e538a31cbcef46ffde
Instruction ID: e31d1e3fb6cffa9b55f34fb646409c6c1997c80882decac05a10060be2335687
Opcode Fuzzy Hash: c86d43cc03b08f92e11bb01bfd4d64b9e5940a6c5e5256e538a31cbcef46ffde
Instruction Fuzzy Hash: 98118275A00209AFDF15DFA5DD84AAEFBBAFF48304F01452DE51567210CB75A914CFA0

Function 0033A94C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0033A956
EnumChildWindows.USER32(?,0033AC60), ref: 0033A994
EnumChildWindows.USER32(?,0033AC80), ref: 0033A9CC

Strings

true, xrefs: 0033A967
IDD = %d: m_bIsRtl = %s, xrefs: 0033A977
false, xrefs: 0033A96E, 0033A973

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ChildEnumWindows$LongWindow
String ID: IDD = %d: m_bIsRtl = %s$false$true
API String ID: 92254136-2899959848
Opcode ID: fc6fb4e687891de60b60dc6449692490f03e1d3121b3b471d7b6f1bf19542876
Instruction ID: c30c0cc6d6b6bc1d2ac8e4c7393c39b67d86397b8b32e558c64a03cafefca253
Opcode Fuzzy Hash: fc6fb4e687891de60b60dc6449692490f03e1d3121b3b471d7b6f1bf19542876
Instruction Fuzzy Hash: F9018C75601A00AFD7265B38DD4AB97BBA8EF15361F01892DF1E6D90A1CFA0A8449711

Function 00334793 Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(?,00000000,?,00000000), ref: 00334805
CharNextW.USER32(00000000,?,?,00000001,?,00000000), ref: 00334838
wcsncpy_s.MSVCRT ref: 00334879
CharNextW.USER32(00000000,00000000,?,?,?,00000001,?,00000000), ref: 003348C6
CharNextW.USER32(?,?,00000001,?,00000000), ref: 003348E5
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,00000000,?,00000000), ref: 00334922

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CharNext$Task$AllocFreewcsncpy_s
String ID:
API String ID: 3890462556-0
Opcode ID: 6d0435a2eb7ad8f9315006017ef51af423b31dabd78f32c8ac90e3498c762af6
Instruction ID: a751745265c30edc774a1d80a0be52a3520b8aedce0ca43dc57d50edec963e5a
Opcode Fuzzy Hash: 6d0435a2eb7ad8f9315006017ef51af423b31dabd78f32c8ac90e3498c762af6
Instruction Fuzzy Hash: 4F51E239A002198BCF1B9F68C8D4A6EB7B9EF45700F254129E902EF694EB71FD41CB40

Function 003350F7 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 003357ED: CharNextW.USER32(?,00000000,00335107,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 0033580C

CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 00335132
CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 0033514F
CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 00335162
CharNextW.USER32(00000027,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 0033516D
CharNextW.USER32(?,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 003351CA
CharNextW.USER32(00000000,?,00000000,00000000,?,?,00335878,?,00000000,?,00000000,00000000,00000000), ref: 003351EE

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 2cea047b72e55ea42dcf162794fe0b46f1417ac08d4412781ba5cd9b8f195445
Instruction ID: fd990a863164f2f7c268287cea0a43a0a5d2a8f084932171dfca521a69efc619
Opcode Fuzzy Hash: 2cea047b72e55ea42dcf162794fe0b46f1417ac08d4412781ba5cd9b8f195445
Instruction Fuzzy Hash: 76419139A006128BCF2A9F78D9C457AB7B5FF59300BA64969D84287254FB70EE84C750

Function 00339C43 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

WcsDisassociateColorProfileFromDevice.MSCMS(00000000,?,?,?,00000000,00000000,?,?,?,00338D76,?,?,?), ref: 00339C7E
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00338D76,?,?,?), ref: 00339C88
WcsGetUsePerUserProfiles.MSCMS(?,6D6E7472,?,?,00000000,00000000,?,?,?,00338D76,?,?,?), ref: 00339CBB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00338D76,?,?,?), ref: 00339CC5
WcsDisassociateColorProfileFromDevice.MSCMS(00000001,?,?,?,00000000,00000000,?,?,?,00338D76,?,?,?), ref: 00339CEA
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00338D76,?,?,?), ref: 00339CF4

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLast$ColorDeviceDisassociateFromProfile$ProfilesUser
String ID:
API String ID: 2382097621-0
Opcode ID: c378cdb1caf97e75a21334e9c861e4fd22e0c24c4a19c8c9c06b9d174bed4476
Instruction ID: e9d7d352fc97a4b2b03138a2416d9ea0b486e4a9c42f26576daa4bac55b41e01
Opcode Fuzzy Hash: c378cdb1caf97e75a21334e9c861e4fd22e0c24c4a19c8c9c06b9d174bed4476
Instruction Fuzzy Hash: B921C63B900121DBD7334B5D8CC9BA7BAA9EF45750F2A4127EC05DB121EBA5DD40C6E0

Function 0033DFA0 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0033DFB3
GetWindowTextLengthW.USER32(?), ref: 0033DFC1
GetWindowTextW.USER32(?,00000000,?), ref: 0033DFF3
GetTextExtentPoint32W.GDI32(00000000,00000000,?,?), ref: 0033E002
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 0033E028
ReleaseDC.USER32(?,00000000), ref: 0033E03C

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: TextWindow$ExtentLengthMovePoint32Release
String ID:
API String ID: 516594899-0
Opcode ID: 23748e689e5ee95ecbed21d2da40880e0d641fa9901ce1049caba9ebd9a8a7f5
Instruction ID: 2acb138e75cacc705041229c355cc93e861e164ab6363f4e6834e1d9357631c1
Opcode Fuzzy Hash: 23748e689e5ee95ecbed21d2da40880e0d641fa9901ce1049caba9ebd9a8a7f5
Instruction Fuzzy Hash: BD11A776600205FFDB169FB4EC4EE9F7BBDEB45301F114429F642CA0A0DA71AA009B20

Function 0033D96E Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00337443: GetDlgItem.USER32(?,00000091), ref: 0033745F
Part of subcall function 00337443: GetDlgItem.USER32(?,00000087), ref: 003374B2

GetDlgItem.USER32(?,000000C8), ref: 0033D98D
GetDlgItem.USER32(?,000000CD), ref: 0033D9A1
GetDlgItem.USER32(?,000000D2), ref: 0033D9B5
GetDlgItem.USER32(?,000000D7), ref: 0033D9C9
GetDlgItem.USER32(?,000000DC), ref: 0033D9DD
GetDlgItem.USER32(?,000000E1), ref: 0033D9F1

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Item
String ID:
API String ID: 3207170592-0
Opcode ID: 66b75cbed1e2887b9ed147ee5d9d3663dbfcad118fd3f33e7088ca88c955cd1a
Instruction ID: fd484339f1c894e300c809495d65f1cf73ae2928c06c28d9a182018a909dc004
Opcode Fuzzy Hash: 66b75cbed1e2887b9ed147ee5d9d3663dbfcad118fd3f33e7088ca88c955cd1a
Instruction Fuzzy Hash: EC11BF34415B00EFE7325B61DD05BA6BAE1FF45B01F018A2FE5AE9A1A0DB716890CB20

Function 00333FBE Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 0033434F: InitializeCriticalSection.KERNEL32(?,00340FD0,0000000C,00334017), ref: 00334361

GetModuleFileNameW.KERNEL32(00330000,?,00000104), ref: 00334073
GetModuleHandleW.KERNEL32(00000000,?), ref: 003340C6

Strings

REGISTRY, xrefs: 00334198
Module, xrefs: 0033413F
Module_Raw, xrefs: 0033415F

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Module$CriticalFileHandleInitializeNameSection
String ID: Module$Module_Raw$REGISTRY
API String ID: 3195065971-549000027
Opcode ID: 8a3a05eee564d4cdcce2d36f9ee15cf4d7961f3c1d9fef7130b72b328220b4b8
Instruction ID: 47c7ab2804e50684e8f99bea28a15e75e2431d0614a93b03260ec2e5b379ee9e
Opcode Fuzzy Hash: 8a3a05eee564d4cdcce2d36f9ee15cf4d7961f3c1d9fef7130b72b328220b4b8
Instruction Fuzzy Hash: 1F519436B003299BCB26DB14DDC0AAAB7BDAF45310F054199EA05AB650EB31BF94CF51

Function 0033963A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetColorDirectoryW.MSCMS(00000000,?,?,00000000), ref: 0033966C
GetLastError.KERNEL32 ref: 00339676

Strings

%s\%s, xrefs: 003396BB, 003396C7, 00339706
CalibratedDisplayProfile-%d.icc, xrefs: 0033969C
CalibratedDisplayProfile-%d-Temp.icc, xrefs: 003396E1

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ColorDirectoryErrorLast
String ID: %s\%s$CalibratedDisplayProfile-%d-Temp.icc$CalibratedDisplayProfile-%d.icc
API String ID: 3534830153-2182247336
Opcode ID: 121ee6a4b0b452fdefa132a300c7a54dd26834f2cc01b1132709b39181cf6790
Instruction ID: 0c5077f2ee454277e94c811eac30e356af7a3c5a5c0f592c2585995bd4ff29e5
Opcode Fuzzy Hash: 121ee6a4b0b452fdefa132a300c7a54dd26834f2cc01b1132709b39181cf6790
Instruction Fuzzy Hash: 2821D275A00309ABDB229B318CC9FD7B7FCEB54304F40496BE959D7042EA70F6058AA0

Function 0033E7A1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator,00000000,00020019,?), ref: 0033E7C4
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0033E7E6
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0033E814
RegCloseKey.ADVAPI32(?), ref: 0033E829

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator, xrefs: 0033E7B7

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator
API String ID: 1586453840-1252446219
Opcode ID: 87d8c75a64f2c0d7c5cf4df85f8010dcea16c0a86f3ebc7fa627af7f2339c69a
Instruction ID: e8f37eb316ef3ce81dc05bd29e17e4b6a7708a3b7ea6390f7a4513c44ac42c4d
Opcode Fuzzy Hash: 87d8c75a64f2c0d7c5cf4df85f8010dcea16c0a86f3ebc7fa627af7f2339c69a
Instruction Fuzzy Hash: 4511F67AD00118BBCB22DF85D884DEEBBB8EB84B60F118165FC05AB150D730AE50DBA0

Function 00338D00 Relevance: 7.6, APIs: 5, Instructions: 113fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000), ref: 00338D29
GetLastError.KERNEL32 ref: 00338D33
WcsSetCalibrationManagementState.MSCMS(00000001,?,?,?,?), ref: 00338D99
GetLastError.KERNEL32 ref: 00338DA3
EventWrite.ADVAPI32(00331F80,00000002,?), ref: 00338E47

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLast$CalibrationCopyEventFileManagementStateWrite
String ID:
API String ID: 4173155175-0
Opcode ID: b036882909514498546c26d3412cf8a4104c6009c92bd920afcd9496a0ed6c07
Instruction ID: 1c65dc570a521f55c863b3e1cfcd6cc015a34056b5cfd58dceb0ca2290de8249
Opcode Fuzzy Hash: b036882909514498546c26d3412cf8a4104c6009c92bd920afcd9496a0ed6c07
Instruction Fuzzy Hash: 0B41A43AA00715DBCB1B9F6998916AEFAB5FF84710F56412DE9066B350DF30AD408A90

Function 0033C605 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 00337505
Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 0033751D
Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 00337535
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033754E
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033755F
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00337570
Part of subcall function 003374D3: _ftol2_sse.MSVCRT ref: 00337602

GetWindowRect.USER32(?,?), ref: 0033C643
GetWindowRect.USER32(?,?), ref: 0033C65B
GetWindowRect.USER32(?,?), ref: 0033C673
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,?,?,00000001), ref: 0033C6DB
MoveWindow.USER32(?,-00000010,?,00000010,?,00000001,?,00000000,00000000,?,?,00000001), ref: 0033C6F3

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$Rect$Points$Move$_ftol2_sse
String ID:
API String ID: 3053001243-0
Opcode ID: f64b2b6e934787e9ac39259d6d65d677cacedc4446f3c903c4ad18187a04e256
Instruction ID: 91d95afc74f3496ce3fefb7f073774a7575620dbdef9af5cf189f9728beccbb9
Opcode Fuzzy Hash: f64b2b6e934787e9ac39259d6d65d677cacedc4446f3c903c4ad18187a04e256
Instruction Fuzzy Hash: 2031817160010AAFDB19CF78CC89BEEBBBAEF48304F085629F515E6160DB71A854CB50

Function 003368BE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

MonitorFromRect.USER32(?,00000002), ref: 00336949
MonitorFromRect.USER32(?,00000002), ref: 00336A0B

Strings

Current display is 0x%08x, xrefs: 003369DC
New rect (%d, %d, %d, %d) is on display 0x%08x, xrefs: 0033695E, 00336A1E

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: FromMonitorRect
String ID: Current display is 0x%08x$New rect (%d, %d, %d, %d) is on display 0x%08x
API String ID: 2578442757-1896848492
Opcode ID: 903131587c45b0a4c2851638a05a21b31ec4f45a70da5e49f3cd53857af1bc58
Instruction ID: cb621063e69417aff63dd843b75c1a123dc6b3dc47de1ea6485c1b5875647aa5
Opcode Fuzzy Hash: 903131587c45b0a4c2851638a05a21b31ec4f45a70da5e49f3cd53857af1bc58
Instruction Fuzzy Hash: 37512A79A00215AFCF06DF98C8859BEBBB5AF88710F15805AE905AB351CB74AE11CF91

Function 00335E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00342860,00000000,00000000,?,?,?,00333DED), ref: 00335EA8
DestroyWindow.USER32(00000000,?,?,?,00333DED), ref: 00335EC2
LeaveCriticalSection.KERNEL32(00342860,?,?,?,00333DED), ref: 00335EE8

Strings

p(4, xrefs: 00335E9B

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CriticalSection$DestroyEnterLeaveWindow
String ID: p(4
API String ID: 1456685395-3612994397
Opcode ID: 54c09ff03940aa1da39e8fc8b0a37893de76d81387e275ac276d65de1a5d5442
Instruction ID: 97a87690aa8261e54719adafbf0a2b271d2ec3ffd4bf74554fee8b30cdfdb7df
Opcode Fuzzy Hash: 54c09ff03940aa1da39e8fc8b0a37893de76d81387e275ac276d65de1a5d5442
Instruction Fuzzy Hash: 3901D435601A24ABC7236B54D88975FB7ACEF82B15F56040CF8007F351CF74BE418695

Function 0033E84A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator,00000000,00020006,00000000,?,?,?,0033E16E,Brightness,00000004,00000004,?), ref: 0033E86A
RegSetValueExW.ADVAPI32(00000000,?,00000000,?,?,?,?,?,?,0033E16E,Brightness,00000004,00000004,?), ref: 0033E886
RegCloseKey.ADVAPI32(00000000,?,?,?,0033E16E,Brightness,00000004,00000004,?), ref: 0033E897

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator, xrefs: 0033E860

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator
API String ID: 779948276-1252446219
Opcode ID: 04aab94bc552a2e196aaaaad9cf8144d39e01bb7be12e4a3db34e56c3880d6dd
Instruction ID: 39438f41b22777daafc231034fd179000526d9edb711587623400ad4166d49b9
Opcode Fuzzy Hash: 04aab94bc552a2e196aaaaad9cf8144d39e01bb7be12e4a3db34e56c3880d6dd
Instruction Fuzzy Hash: D6F04936900228FBDB228F809D09FDE7A79EB04755F114150FD01BA1A0C7729E10EBA0

Function 00338540 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

_ftol2.MSVCRT ref: 003385A1
GetLastError.KERNEL32 ref: 003385BC
_ftol2.MSVCRT ref: 003385FF
GetLastError.KERNEL32 ref: 0033861C

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ErrorLast_ftol2
String ID:
API String ID: 3138094797-0
Opcode ID: a738a70d7a50922478171ca93df90a9a4cb9a1a7b66747b04ec58d53f7f5b95c
Instruction ID: 8864af19b33fcc9ffc52f2e96ead0cd61d37ccf8431444bce9014a02044d125f
Opcode Fuzzy Hash: a738a70d7a50922478171ca93df90a9a4cb9a1a7b66747b04ec58d53f7f5b95c
Instruction Fuzzy Hash: BA516E397006208FCB039F24D894B6D7BA6AF89790F1640A9ED06DF395DF74ED058B91

Function 0033D780 Relevance: 6.2, APIs: 4, Instructions: 152windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033E04F: SendMessageW.USER32(?,00000406,00000001,?), ref: 0033E06C

SendMessageW.USER32(?,00000415,00000000,00000000), ref: 0033D7E7

Part of subcall function 0033E07C: SendMessageW.USER32(?,00000405,00000001,?), ref: 0033E08E

SendMessageW.USER32(?,00000415,00000000,00000000), ref: 0033D87A
SendMessageW.USER32(?,00000415,00000000,00000000), ref: 0033D910
SetTimer.USER32(?,00000001,00000032,00000000), ref: 0033D952

Part of subcall function 0033AB40: GetParent.USER32(?), ref: 0033AB48
Part of subcall function 0033AB40: PostMessageW.USER32(00000000,00000470,00000000,00000003), ref: 0033AB58
Part of subcall function 0033AB40: GetParent.USER32(?), ref: 0033AB61
Part of subcall function 0033AB40: SendMessageW.USER32(00000000,00000489,00000000,00331FA0), ref: 0033AB74

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Message$Send$Parent$PostTimer
String ID:
API String ID: 1672226202-0
Opcode ID: 0cda692951c369dfbe408e452a39d3cac4ad1ac83cbc93ab9c27edc2f481f88b
Instruction ID: e03f4a4b8f5a1c35dee34123b79f6e264f949c94c0a67b7637b69616a24e1fb4
Opcode Fuzzy Hash: 0cda692951c369dfbe408e452a39d3cac4ad1ac83cbc93ab9c27edc2f481f88b
Instruction Fuzzy Hash: F5510835600116EFDF069F54DCC4FA87BAABF49700F1940B5EE09AF2A6CB71A9119F60

Function 0033A030 Relevance: 6.1, APIs: 4, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

DestroyPhysicalMonitors.DXVA2(00000001,00000014,00000000,00000000,00000000,?,00337B14,00000000,00000000,00333D1A), ref: 0033A054
DeleteDC.GDI32(?), ref: 0033A06C
DccwReleaseDisplayProfileAssociationList.MSCMS(?,00000000,00000000,00000000,?,00337B14,00000000,00000000,00333D1A), ref: 0033A14D
DccwReleaseDisplayProfileAssociationList.MSCMS(?,?,00337B14,00000000,00000000,00333D1A), ref: 0033A159

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: AssociationDccwDisplayListProfileRelease$DeleteDestroyMonitorsPhysical
String ID:
API String ID: 896183022-0
Opcode ID: 365909ae69512e74ab40c1ab195cf68b7f9c0d9efbe42c7433d8861459289a8a
Instruction ID: a22ac62d612afb45f023239ae0daa846e4c7d0c4e9d2d4a11c85edbe75821b23
Opcode Fuzzy Hash: 365909ae69512e74ab40c1ab195cf68b7f9c0d9efbe42c7433d8861459289a8a
Instruction Fuzzy Hash: 994169B5805B009FD3729F2A9994AD3FBE4FF4A710F90492EE5AE86214DB317940CF81

Function 0033A9ED Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

MapDialogRect.USER32(?,?), ref: 0033AA1C
GetWindowRect.USER32(?,?), ref: 0033AA42
EnumChildWindows.USER32(?,0033AD30), ref: 0033AABD
InvalidateRect.USER32(?,00000000,00000001), ref: 0033AAC9

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Rect$ChildDialogEnumInvalidateWindowWindows
String ID:
API String ID: 102734436-0
Opcode ID: 599d59b18d5e934037b14b5e5bf12509602d1f87f085a141c4d7890aca705229
Instruction ID: 120ba2c724b8fdba50d7e791f0a4484b447ce28be7a699d5f803b2d4ea991f22
Opcode Fuzzy Hash: 599d59b18d5e934037b14b5e5bf12509602d1f87f085a141c4d7890aca705229
Instruction Fuzzy Hash: F6313C31600A0A9FDB15CF7CC985BEEBBFAEB45301F454528A59AEB150DBB0B908CB51

Function 0033C047 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 00337505
Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 0033751D
Part of subcall function 003374D3: GetWindowRect.USER32(?,?), ref: 00337535
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033754E
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0033755F
Part of subcall function 003374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00337570
Part of subcall function 003374D3: _ftol2_sse.MSVCRT ref: 00337602

GetWindowRect.USER32(?,?), ref: 0033C085
GetWindowRect.USER32(?,?), ref: 0033C099
GetWindowRect.USER32(?,?), ref: 0033C0AD
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000), ref: 0033C0FF

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Window$Rect$Points$Move_ftol2_sse
String ID:
API String ID: 4240149109-0
Opcode ID: 0cc6cdc998ac2eee3852ad5a7836afbd9a846333a118885e4db9b85fd3153b38
Instruction ID: 0cd8f11e9282c49d52d901812c259cfdfda754edccd0963710ef1dfb0a0bb824
Opcode Fuzzy Hash: 0cc6cdc998ac2eee3852ad5a7836afbd9a846333a118885e4db9b85fd3153b38
Instruction Fuzzy Hash: 1A21AC75A00209AFDB119F79CD88BEEBBB9EF48304F054528F516E61A0DB30E844CB20

Function 0033B9B0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 0033BA20
SetTextColor.GDI32(?,00000000), ref: 0033BA32
SetBkMode.GDI32(?,00000001), ref: 0033BA3C
GetStockObject.GDI32(00000005), ref: 0033BA44

Part of subcall function 0033BAD1: GetDlgItem.USER32(?,000000AA), ref: 0033BB07

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ColorItemLongModeObjectStockTextWindow
String ID:
API String ID: 3442870416-0
Opcode ID: b679628b0da868a81835dca752bda5a0389cc4f495e4d6aaa1c15b515b33d32c
Instruction ID: 8ce29c519cb8d37b574d0cad945850b39827383596437fd85e56b624eff038c9
Opcode Fuzzy Hash: b679628b0da868a81835dca752bda5a0389cc4f495e4d6aaa1c15b515b33d32c
Instruction Fuzzy Hash: EC11BC31104A19EBCF228F15DC48B9EBB68FB04725F00812AFA258A1A0CB74AD60DF90

Function 0033AEE0 Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0033AEEA
PostMessageW.USER32(00000000,00000470,00000000,00000005), ref: 0033AEFB
GetDlgItem.USER32(?,00000095), ref: 0033AF17
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0033AF26

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: Message$ItemParentPostSend
String ID:
API String ID: 3857695281-0
Opcode ID: 2a104dd2b33149322d98b5833b3bdbd521821cae89f1db7de25ab5a243af9be8
Instruction ID: ccd646e56751fde9ec6fef46e9287263f3b4da0ebc458fd3df913ac4af0fa4ef
Opcode Fuzzy Hash: 2a104dd2b33149322d98b5833b3bdbd521821cae89f1db7de25ab5a243af9be8
Instruction Fuzzy Hash: AF01A139300211AFCB125F20CC88A6B3F69EB85B91F044471FD05DF291CF70A9018B91

Function 00340340 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00340B1A: GetModuleHandleW.KERNEL32(00000000), ref: 00340B21

__set_app_type.MSVCRT ref: 00340352
__p__fmode.MSVCRT ref: 00340368
__p__commode.MSVCRT ref: 00340376
__setusermatherr.MSVCRT ref: 00340397

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: ae013f08572afbaa7a1a24b4ca4a7b4f722c028ec8597dffa7ac449b44b13b5b
Instruction ID: 8cc4ad48fe133abc8608bde778cb6260bbeb45128dd2ef9fa5929ed1891a313a
Opcode Fuzzy Hash: ae013f08572afbaa7a1a24b4ca4a7b4f722c028ec8597dffa7ac449b44b13b5b
Instruction Fuzzy Hash: E1F0D47C6443048FC72B6F70AC4AA097AE9FB42321F500609F4529E2F1CF39B1448A00

Function 0033F360 Relevance: 6.0, APIs: 4, Instructions: 21windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0033F368
PostMessageW.USER32(00000000,00000470,00000000,00000002), ref: 0033F378
GetParent.USER32(?), ref: 0033F381
SendMessageW.USER32(00000000,00000489,00000000,00331FA0), ref: 0033F394

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: MessageParent$PostSend
String ID:
API String ID: 2241083247-0
Opcode ID: 1df00f262909f263397ade25b735ecf0ce7512ebc6afcc0ba525d1d0c7b1aa46
Instruction ID: d893865aabc3bfb5fedfeb3ad43bb26f1f27701e46c584b14ecc102438c62cac
Opcode Fuzzy Hash: 1df00f262909f263397ade25b735ecf0ce7512ebc6afcc0ba525d1d0c7b1aa46
Instruction Fuzzy Hash: D8E0EC76684640BBE6222B70EC0EF863A6CAB45B05F118910B356EE0E0CFE079408B44

Function 0033AB40 Relevance: 6.0, APIs: 4, Instructions: 21windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0033AB48
PostMessageW.USER32(00000000,00000470,00000000,00000003), ref: 0033AB58
GetParent.USER32(?), ref: 0033AB61
SendMessageW.USER32(00000000,00000489,00000000,00331FA0), ref: 0033AB74

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: MessageParent$PostSend
String ID:
API String ID: 2241083247-0
Opcode ID: f8469e923fb0bcf6165473ca20ef263104eb51d8c8ef803afd4f6a0647730a74
Instruction ID: e8a8f0b50b10ddea800f30f40ba8ffa90198b75241f380f2e714f474ca402e33
Opcode Fuzzy Hash: f8469e923fb0bcf6165473ca20ef263104eb51d8c8ef803afd4f6a0647730a74
Instruction Fuzzy Hash: 91E0EC76684640BBE6222B70EC0EF863A6CAB45B05F118910B356EE0E0CFE07A408B44

Function 0033E8E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

EventWrite.ADVAPI32(00331F20,00000001,?,?,003368A9,00000000), ref: 0033E944
MessageBoxW.USER32(00000000,00000000,003428C8,00000010), ref: 0033E973

Strings

strg, xrefs: 0033E952, 0033E955

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: EventMessageWrite
String ID: strg
API String ID: 2344367845-3320446829
Opcode ID: f67c26f825ff8b7b06061a0776e1b959eca38cb3189842c162d8af5a19270855
Instruction ID: e1b25ac2da88f1705ad91a1917598b767b8fcf0e6d3e2e1b1616f2684c774d31
Opcode Fuzzy Hash: f67c26f825ff8b7b06061a0776e1b959eca38cb3189842c162d8af5a19270855
Instruction Fuzzy Hash: 8A11047AD00209ABCF169F55DC85AEFBBB9EF89300F410119F9127B250DB74AE05CB90

Function 0033A6A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0033A6CC

Part of subcall function 0033A4CC: GetDisplayConfigBufferSizes.USER32(00000002,?,?), ref: 0033A522

DisplayConfigGetDeviceInfo.USER32(?), ref: 0033A70F

Strings

, xrefs: 0033A705

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: ConfigDisplay$BufferDeviceInfoSizesmemset
String ID:
API String ID: 4257415688-3916222277
Opcode ID: 8a14da48388519f6392d453df88c42d8ed9e0c3b7cf091cdca4385f97a2bfa95
Instruction ID: 6f58157ce4c2f30e92b874ceabb809bd115df813e7e04a48a582233e6e4be9ee
Opcode Fuzzy Hash: 8a14da48388519f6392d453df88c42d8ed9e0c3b7cf091cdca4385f97a2bfa95
Instruction Fuzzy Hash: A311B276E012298BCB15CBE4C98579EB7F4AB44710F220529DD05AB381DB78ED04CBD1

Function 0033EB17 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0033EB33
TaskDialogIndirect.COMCTL32(00000060,00000001,00000000,00000000,?,00000000,00000000), ref: 0033EB79

Strings

`, xrefs: 0033EB49

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: DialogIndirectTaskmemset
String ID: `
API String ID: 3334335582-2679148245
Opcode ID: 6789f43d11a6e8e0e93746757039a9c68280210defd1ca61774d248e05a33837
Instruction ID: 49c9f6536a11f072c53aa94882bd813d31330dae2780f6f55cfbdeefff5aed8d
Opcode Fuzzy Hash: 6789f43d11a6e8e0e93746757039a9c68280210defd1ca61774d248e05a33837
Instruction Fuzzy Hash: D201E1B5900358ABDF21DF95C949BCFBFBDEB81715F10012AE505AB240D7B45948CB51

Function 00338FF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,?), ref: 00339020
CreateDCW.GDI32(?,?,00000000,00000000), ref: 00339034

Strings

h, xrefs: 00339016

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: CreateInfoMonitor
String ID: h
API String ID: 3263162237-2439710439
Opcode ID: 1cc7f605e6b9a6dbd23778d48820d950c07f5943764c2f3f8e03646cb35e82d1
Instruction ID: 93f3a52b9f23f2d4b01d1cc5756b4d71d7438fb1fb817e292ccb11cfeca43926
Opcode Fuzzy Hash: 1cc7f605e6b9a6dbd23778d48820d950c07f5943764c2f3f8e03646cb35e82d1
Instruction Fuzzy Hash: 1DF08C72614704AFC724DF34D885B5777E8EB48350F518A1AF996CB190EB70F900CBA2

Function 0033F857 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,AtlThunk_AllocateData), ref: 0033F85E
EncodePointer.KERNEL32(00000000,?,0033FC57,003428BC,?,0033F9CB,?,00000000,?,00336D51,00000000,?,00000000,0033615B,00000000,00000000), ref: 0033F86D

Strings

AtlThunk_AllocateData, xrefs: 0033F85C

Memory Dump Source

Source File: 00000000.00000002.1288590890.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.1288556056.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288613361.0000000000342000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1288638151.0000000000343000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_skZwfU6wMR.jbxd

Similarity

API ID: AddressEncodePointerProc
String ID: AtlThunk_AllocateData
API String ID: 1846120836-3926079072
Opcode ID: 60b0b8ca4ce3d92ff71cb88465d3c5ea7930cef4b3653941c947448144da988e
Instruction ID: f55339214dd4bff2226a0443b8456b7376a566468a85177ede79c7e599d6e250
Opcode Fuzzy Hash: 60b0b8ca4ce3d92ff71cb88465d3c5ea7930cef4b3653941c947448144da988e
Instruction Fuzzy Hash: BED0A774100304BF8B155F3298499637B5CEA93711B004028F806CB210E936E4059534

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report skZwfU6wMR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: skZwfU6wMR.exePID: 7328, Parent PID: 4056

General

Chronological Activities

Disassembly

Analysis Process: skZwfU6wMR.exePID: 7328, Parent PID: 4056COMMON

Execution Graph

Graph

Executed Functions

Function 00336166 Relevance: 39.1, APIs: 16, Strings: 6, Instructions: 627synchronizationwindowregistryCOMMON

Control-flow Graph

Function 00333BBD Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 171memoryCOMMON

Control-flow Graph

Windows Analysis Report
skZwfU6wMR.exe

Function 00336166 Relevance: 39.1, APIs: 16, Strings: 6, Instructions: 627
synchronizationwindowregistryCOMMON

Function 00333BBD Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 171
memoryCOMMON

Function 003403E9 Relevance: 10.6, APIs: 7, Instructions: 138
sleepCOMMON

Function 0033F064 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58
registryCOMMON

Function 0033A74B Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Function 003402FE Relevance: 3.0, APIs: 2, Instructions: 20
COMMONLIBRARYCODE

Function 0033FE77 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 003403B0 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Function 0033EDC2 Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 227
windowCOMMON

Function 00335245 Relevance: 28.5, APIs: 12, Strings: 4, Instructions: 457
registrystringCOMMON

Function 0033BD3D Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 193
COMMON

Function 00338AC0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 181
fileCOMMON

Function 0033A1B6 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 277
COMMON

Function 00339D26 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 235
timeCOMMON