Edit tour

Windows Analysis Report
nCBC3f6tz1.dll

Overview

General Information

Sample name:	nCBC3f6tz1.dll renamed because original name is a hash value
Original sample name:	426fa8eecccaa92eb1bb7a298a37b434f98dd8445f58796c1414ada17a059a9a.dll
Analysis ID:	1544789
MD5:	7012991b1134738dcf2209c247965b9f
SHA1:	c36405cdeeefc0c6ea2e664b0965c5c4cda16a79
SHA256:	426fa8eecccaa92eb1bb7a298a37b434f98dd8445f58796c1414ada17a059a9a
Tags:	2024bankerdllgolangloadermekotiouser-johnk3r
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 1456 cmdline: loaddll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 5308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3168 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 3096 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6596 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 652 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 4632 cmdline: rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4940 cmdline: rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4924 cmdline: rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1220 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4108 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2364 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1196 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1696 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3868 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeResize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7180 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkePaint2 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7192 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeKillFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7224 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeIsDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7236 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeInitialize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7252 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeGetCaretRect MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7276 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseWheelEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7292 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7308 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyUpEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7324 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyPressEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7348 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyDownEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7368 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireContextMenuEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7380 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFinalize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7400 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeDestroyWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7416 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeCreateWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7428 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",dbkFCallWrapperAddr MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7556 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7452 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7464 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",TMethodImplementationIntercept MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7564 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7476 cmdline: rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarRecognize MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nCBC3f6tz1.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: nCBC3f6tz1.dll

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Source: nCBC3f6tz1.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D1C4 FindFirstFileW,FindClose,	4_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_0436D1C4 FindFirstFileW,FindClose,	30_2_0436D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_0436CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	30_2_0436CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041DD1C4 FindFirstFileW,FindClose,	32_2_041DD1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041DCBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_041DCBF8

Source: Amcache.hve.7.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004EA1D8 GetClipboardData,CopyEnhMetaFileW,GetEnhMetaFileHeader,

4_2_004EA1D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004EAA7C GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

4_2_004EAA7C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F6444	4_2_004F6444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F6704	4_2_004F6704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004E6918	4_2_004E6918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004B0F64	4_2_004B0F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004B10A8	4_2_004B10A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0043B4C4	4_2_0043B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004FFD00	4_2_004FFD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004EFE80	4_2_004EFE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F1FC4	4_2_004F1FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F5F80	4_2_004F5F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_04456444	30_2_04456444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_04456704	30_2_04456704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_04410F64	30_2_04410F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_04446918	30_2_04446918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_0439B4C4	30_2_0439B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_044110A8	30_2_044110A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_0445FD00	30_2_0445FD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_0444FE80	30_2_0444FE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_04451FC4	30_2_04451FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_04455F80	30_2_04455F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_0420B4C4	32_2_0420B4C4

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 652

Source: nCBC3f6tz1.dll

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: nCBC3f6tz1.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal60.winDLL@63/13@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004E5AA0 GetLastError,FormatMessageW,

4_2_004E5AA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004219D8 GetDiskFreeSpaceW,

4_2_004219D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004AA910 FindResourceW,LoadResource,SizeofResource,LockResource,

4_2_004AA910

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7464
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3096
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5308:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7428

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\24d928a9-8cd7-4d23-9b1e-191498551292

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarCreate

Source: nCBC3f6tz1.dll

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarCreate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 652
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarCreate
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeResize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkePaint2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeKillFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeIsDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeInitialize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeGetCaretRect
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseWheelEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyUpEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyPressEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyDownEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireContextMenuEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFinalize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeDestroyWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeCreateWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",TMethodImplementationIntercept
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarRecognize
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 640
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 640
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeResize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkePaint2	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeKillFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeIsDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeInitialize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeGetCaretRect	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseWheelEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyUpEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyPressEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyDownEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireContextMenuEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFinalize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeDestroyWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeCreateWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",dbkFCallWrapperAddr	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",__dbk_fcall_wrapper	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",TMethodImplementationIntercept	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarRecognize	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: nCBC3f6tz1.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: nCBC3f6tz1.dll

Static file information: File size 1270784 > 1048576

Source: nCBC3f6tz1.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10cc00

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00508FA8 LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00508FA8

Source: nCBC3f6tz1.dll

Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E000 push 0050E0DEh; ret	4_2_0050E0D6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E47C push 0050E519h; ret	4_2_0050E511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00460068 push ecx; mov dword ptr [esp], edx	4_2_00460069
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00504014 push 0050403Ah; ret	4_2_00504032
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050A0D0 push 0050A144h; ret	4_2_0050A13C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004380A4 push ecx; mov dword ptr [esp], eax	4_2_004380A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_005041A4 push 005041CAh; ret	4_2_005041C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00466248 push ecx; mov dword ptr [esp], ecx	4_2_0046624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00464264 push ecx; mov dword ptr [esp], ecx	4_2_00464268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004BE2E4 push ecx; mov dword ptr [esp], edx	4_2_004BE2E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004BA2F8 push ecx; mov dword ptr [esp], edx	4_2_004BA2FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C42F4 push ecx; mov dword ptr [esp], edx	4_2_004C42F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004682FC push ecx; mov dword ptr [esp], ecx	4_2_00468300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C0340 push ecx; mov dword ptr [esp], edx	4_2_004C0341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00502340 push 00502398h; ret	4_2_00502390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050A378 push 0050A3F2h; ret	4_2_0050A3EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0043A3D0 push ecx; mov dword ptr [esp], eax	4_2_0043A3D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050239C push ecx; mov dword ptr [esp], ecx	4_2_005023A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00464450 push ecx; mov dword ptr [esp], ecx	4_2_00464454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E540 push 0050E5F6h; ret	4_2_0050E5EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C460C push ecx; mov dword ptr [esp], edx	4_2_004C460D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E610 push 0050E671h; ret	4_2_0050E669
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E740 push 0050E7DCh; ret	4_2_0050E7D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046670C push ecx; mov dword ptr [esp], edx	4_2_0046670D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046671C push ecx; mov dword ptr [esp], edx	4_2_0046671D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004827C4 push 00482826h; ret	4_2_0048281E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004648E4 push ecx; mov dword ptr [esp], eax	4_2_004648E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0042E970 push 0042EA60h; ret	4_2_0042EA58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C2A30 push ecx; mov dword ptr [esp], edx	4_2_004C2A31
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00468B60 push ecx; mov dword ptr [esp], edx	4_2_00468B61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00508B90 push ecx; mov dword ptr [esp], eax	4_2_00508B95

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.5 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 7.3 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D1C4 FindFirstFileW,FindClose,	4_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_0436D1C4 FindFirstFileW,FindClose,	30_2_0436D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 30_2_0436CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	30_2_0436CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041DD1C4 FindFirstFileW,FindClose,	32_2_041DD1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041DCBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_041DCBF8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040EE84 GetSystemInfo,

4_2_0040EE84

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_4-47804
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_30-47060
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_32-31748

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004B8000 IsDebuggerPresent,RaiseException,

4_2_004B8000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00508FA8 LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00508FA8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00508B90 FreeLibrary,VirtualFree,GetProcessHeap,HeapFree,VirtualFree,

4_2_00508B90

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004079E8 cpuid

4_2_004079E8

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	4_2_0040D2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_0040C79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00428FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_0042920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00425334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00425380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	30_2_0436D2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	30_2_0436C79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	30_2_04388FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	30_2_0438920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	30_2_04385334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	30_2_04385380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	32_2_041DD2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	32_2_041DC79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	32_2_041F920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_041F5334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_041F5380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_041F8FD0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00423868 GetLocalTime,

4_2_00423868

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040C520 InitializeCriticalSection,GetVersion,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

4_2_0040C520

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nCBC3f6tz1.dll	47%	ReversingLabs	Win32.Trojan.Midie
nCBC3f6tz1.dll	100%	Avira	TR/Redcap.ystkm

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544789
Start date and time:	2024-10-29 18:50:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nCBC3f6tz1.dll renamed because original name is a hash value
Original Sample Name:	426fa8eecccaa92eb1bb7a298a37b434f98dd8445f58796c1414ada17a059a9a.dll
Detection:	MAL
Classification:	mal60.winDLL@63/13@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 83% Number of executed functions: 44 Number of non-executed functions: 167
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: nCBC3f6tz1.dll

Simulations

Behavior and APIs

Time	Type	Description
13:51:12	API Interceptor	1x Sleep call for process: loaddll32.exe modified
13:51:28	API Interceptor	3x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_9d3e772da6c0c3b2ba98571a98f1ccb5316d883_7522e4b5_b13a919c-48d8-47a8-ac20-04e70e997bbc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8639997692035788
Encrypted:	false
SSDEEP:	192:agRiyOFqt0BU/wjeTpLzuiFFZ24IO8dci:7RiTFquBU/wjeBzuiFFY4IO8dci
MD5:	0132FAA35C5E7B5327D53065F8250AEB
SHA1:	87FDA78C0E159828718465982665FA1C320BF377
SHA-256:	3DA4C718C2CFBFC6372F00E9F4DBD67863A2E8F10CFF2A9F08AEDA28C09051DE
SHA-512:	BCC1B37E7BDEABD31EE1563156127DD4DB5B5F094BD1562D06261F8AC1C4DEB3FC3BC936AF7F47C8833522EAC2107A2C3B738CC974037640A87FF6F8B4708C26
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.7.8.7.3.3.9.2.5.9.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.7.8.7.4.0.8.0.1.0.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.3.a.9.1.9.c.-.4.8.d.8.-.4.7.a.8.-.a.c.2.0.-.0.4.e.7.0.e.9.9.7.b.b.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.c.9.0.c.7.a.-.8.1.1.3.-.4.9.3.f.-.8.4.6.8.-.a.6.0.e.e.7.8.a.c.9.1.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.2.8.-.0.0.0.1.-.0.0.1.4.-.4.6.8.6.-.d.d.2.4.2.b.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c66a12a3cf7201bf6f31cc259909e9e2c78f020_7522e4b5_7d002d39-5284-4d12-ae4d-a51d443037c3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8694102111278192
Encrypted:	false
SSDEEP:	192:HeFixOTKqq0BU/wjeTpLzuiFFZ24IO84ci:+FiI+qxBU/wjeBzuiFFY4IO84ci
MD5:	E86397837C0AE92DF04945BB3EEB88FA
SHA1:	D2863A24DF979A43756FE447F74EC29FCA000E55
SHA-256:	F20A4D88C5A5D2ED899D43968AFA6275EEA50E3E07F0967F43F288A256F7DF88
SHA-512:	223088A24A7F8570C6C83844998BB8037E73C1608BD2FB8BF9007FB2D5F1308062B92221F2F15A1468CAB2B2B20057CB908650D8AAA20A5450DBE08D0920EA90
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.7.8.7.3.3.2.8.6.2.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.7.8.7.4.0.0.0.5.0.7.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.0.0.2.d.3.9.-.5.2.8.4.-.4.d.1.2.-.a.e.4.d.-.a.5.1.d.4.4.3.0.3.7.c.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.a.0.8.3.9.d.-.a.f.9.b.-.4.a.c.3.-.8.a.d.9.-.f.f.9.d.b.2.0.5.7.b.e.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.4.-.0.0.0.1.-.0.0.1.4.-.9.0.2.4.-.c.e.2.4.2.b.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c66a12a3cf7201bf6f31cc259909e9e2c78f020_7522e4b5_8c7c462f-9bf7-41c5-b513-6f865a843684\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8697903095984804
Encrypted:	false
SSDEEP:	192:ivFiXOP7qq0BU/wjeTpLzuiFFZ24IO84ci:8i+zqxBU/wjeBzuiFFY4IO84ci
MD5:	BA14E2BC5693178E2692B039635F55D0
SHA1:	51E359A24818C7423CCDC6CBFA0C2DDE250A1815
SHA-256:	EB46A1B425F00B40F298B1910ED137900DF5B58AB5D10BCA24DCD81992E4AF74
SHA-512:	B63B46D114F046A56CB7875767A0FB7588FE84E41A5DDD3F293C119DAA1443BB59BDC9EA8A7EE4ECB0A912733D43C840B691AFEC1A871955D65164A1BC4A6B49
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.7.8.6.2.4.5.4.4.9.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.7.8.6.2.8.9.1.9.9.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.c.7.c.4.6.2.f.-.9.b.f.7.-.4.1.c.5.-.b.5.1.3.-.6.f.8.6.5.a.8.4.3.6.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.6.8.7.f.b.c.b.-.0.5.8.7.-.4.0.9.5.-.a.f.2.e.-.0.0.2.a.d.9.4.f.d.c.7.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.1.8.-.0.0.0.1.-.0.0.1.4.-.5.3.0.d.-.7.3.1.e.2.b.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1905.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:51:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43708
Entropy (8bit):	1.9118257940178096
Encrypted:	false
SSDEEP:	192:8aYvJbXZyO5H4JnIeh7+obAJ1K5H9O7jaJ8iHf7:0LN5HonIeh5sJ1K5H9eif
MD5:	382FDA770D76FAC3B86AC77848C1BD87
SHA1:	3F01B560663B4A3F80B812B453FFFFBE9C2A6DB4
SHA-256:	CD5E9EDEC6EE474162E36F0F345B25E381228675DF9DE9213814EB6283C01B22
SHA-512:	705AC63AD1C21E905FB1A9292578C7B32601830679EC8BCBD4D6D1A35AEA9D816C93BA1F1238C2714AB6D1C615CCEB91C885F1E55467550C842E89F4328C50B3
Malicious:	false
Preview:	MDMP..a..... ........ !g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T............ !g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER19E1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.688450466573787
Encrypted:	false
SSDEEP:	192:R6l7wVeJRm6IUE6Yvr6Wgmf8gTfprQ89bsdsf5km:R6lXJA6IUE6YD6Wgmf86/sWfP
MD5:	F64D7C3DDEB1D70326E99210EEB5998E
SHA1:	4712E81AF6BA82F38363412B35B8FDC4297CC8FB
SHA-256:	00092D1F50A07F7A4F17E5244B130EDB5C1E162C2488C953A3C96FCB743465CB
SHA-512:	553246A3ECA1A1F5A80BE5E1D183C639BD06E1EF5728C21E5624D4C502D416F0BE27D398F11394C3F3D91B8EA843142B5E91B28C942BCA32BB4E7AD88E86F9BB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.0.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A11.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.448190135228524
Encrypted:	false
SSDEEP:	48:cvIwWl8zsAJg77aI9P8WpW8VYv0Ym8M4JCdP+hnFeso+q8vjP+hYMGScSid:uIjfGI7d17VmBJzhBoKShtJ3id
MD5:	18B7F73FAA1625B4EE290E8AA277ADE3
SHA1:	8E25BE00883267C93B5F83612D01283C46882073
SHA-256:	38871BF24B126884C4314D7836935F4F39B48905EE8B1942576520D46776AD7A
SHA-512:	ED2ACE09330F77A0256EE031B1E966B3E1708B9467765A1950317C6174E673398D23DB9544C4DF54749A9B4952D962A2BB4408558E68873CF49A390A14123522
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565013" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4390.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:51:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42300
Entropy (8bit):	1.9478092830830245
Encrypted:	false
SSDEEP:	192:P1pNLCvk5XZsXO5H4qULWN1+qAERn6JvO:tXCEs+5HdUyNAqA6
MD5:	C7E1759718953F24DB8428A98A41FF0B
SHA1:	E0FAF4548F7E700950B9812A838783865B38DC27
SHA-256:	A3842A3BE927EEC3784907F9C2527B096751DD1ACDEE2C433F992FA2336182E5
SHA-512:	F1AA63B15DD4DABD04DAE75000970C67EE783B1A25EC21DFCF08025C455F9C6F6D1A2C03BD0CCD626E693975B17085CA2241ACDC6FD5AB85D0B9550163904221
Malicious:	false
Preview:	MDMP..a..... ........ !g.........................................)..........T.......8...........T.......................................................................................................................eJ......,.......GenuineIntel............T............ !g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43CE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:51:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42840
Entropy (8bit):	1.980200881121982
Encrypted:	false
SSDEEP:	96:5W8ZZd6ciA4hFyoPKkJBUhXZebvoi75I4v4BR+7RtVc+o5mzvwOjqFZG2pjPvBW1:PZOvzIXZ7O5H4HGwO2pvDIBSHM5vPKc
MD5:	C470FB31A7266BFEB96B6420897C9E79
SHA1:	0C687731EFC7ED73E25D4C0BCB0CEC186CAF6A75
SHA-256:	E93F9435C66A58D10F8DD2E2D7E874F2CF3D48B91CFB4FE48769F1EA3EE2AAAA
SHA-512:	9174DBE5A0CD8589E6F51AF0D8E136B688251BCB4D7282A53B0DCEC887A513D41629E74AEE89A5227B710712F4FA35AD721425B708421671BEC265653ABDC38A
Malicious:	false
Preview:	MDMP..a..... ........ !g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T.......(.... !g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER445C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	3.687957068536289
Encrypted:	false
SSDEEP:	192:R6l7wVeJU86IUtFW/6YMH6ggmf8gTfprZ89bUEsf/Ecm:R6lXJn6IUtFO6Yk6ggmf86kU3f/m
MD5:	B64D725BD76C3CD70407A6843EC98408
SHA1:	2BC0F98711BAB6ACACB7EC641780D2DC7EAB19FF
SHA-256:	F0DD215729FDA1786FDE042FE8B0F6E4802F906B44CDE06C18FC81A3B1086917
SHA-512:	269AD73E855452BF3715A8A889EEC4213DA2E62D94410949C2A2BF633C183BD72CA64458FB0AA427D922308709CBFAEA1F7306B661B4C02D09B34AD55B4351EE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER448B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8266
Entropy (8bit):	3.6918792275299306
Encrypted:	false
SSDEEP:	192:R6l7wVeJc76IUntS6YMD6ggmfTgnfprZ89bUesfNcm:R6lXJY6IUntS6YQ6ggmfTekUdfD
MD5:	1E4B36F3292CB02B0AFC8408676084D3
SHA1:	5D0096BFE5A695DCC7A4B0ECCAE2E1F6A878EBDA
SHA-256:	F70BCBDE0E5B63EAC4690B4E901FD7E1772CC59F5DC30A34F1F19E85FA793514
SHA-512:	2B29474F7E0B5A5DBFF602F55C549EB6615EB907C26EDC8695A45C818B85E839330E2F311AA4D4999CC6174EDBC2BE53BD18A959C3678F7AB80AF3B155747728
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER449B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.448158924178178
Encrypted:	false
SSDEEP:	48:cvIwWl8zsAJg77aI9P8WpW8VYjYm8M4JCdP+hnFno+q8vjP+hHGScSgd:uIjfGI7d17VDJzhRoKShHJ3gd
MD5:	7E431B22C95AB9CC67410E4952358EC5
SHA1:	4D70B78154EA1A6C5783A3D402C383B994FDE4F0
SHA-256:	D9E583BA368C9009EA59933479B2F1551A916FF0B935974B07226ACBFFE7D0C6
SHA-512:	A1C116C65E4663F5D00ED9124F557B24F51892AA974ECA4B8E24E90A8FBE8434D3DBA98323032D68BE9D13C99E23A90107B6450D60C6544963BCFEDA8FB15E4C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565013" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44BA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.463138133741678
Encrypted:	false
SSDEEP:	48:cvIwWl8zsAJg77aI9P8WpW8VYQiPYm8M4JCdP+KF1+q8/8aQGScSud:uIjfGI7d17V3JzibvJ3ud
MD5:	CBD6B5B416FE8C59D32A2377DA0BACDF
SHA1:	4E8B0EB73ED3E21BA8B1DF87247B8F6413709DFD
SHA-256:	9C69A727287BF54F320806A99187C6CE456DCA21B66D4CAFE79F7C3F3ACDF106
SHA-512:	656B0398A827037B12B4F4816CFACB1CFB572A05CCE7A08DD34100BF369F2A81B1C0CDEAD4ABFE8CD636E45570F9E08ECCA41706290FE72A323A7DEBD24CACFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565013" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466257755934301
Encrypted:	false
SSDEEP:	6144:QIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNxdwBCswSbG:1XD94+WlLZMM6YFHT+G
MD5:	CB6D5DF843FFF05D892AF105E54560CF
SHA1:	88F58F6AFB1E7F304313743C321067E755FE0D94
SHA-256:	25FAB15638AEA09291B86007D1940C03B3CBB1B225D62686CB9708FB1DA4F316
SHA-512:	DE0096A755C5233CED42FDAEAF0B11DD0867FB3D27082C699BA29CD6A917E8BE4F19040D236E80340119937A2A5285E3AA38050F10EEF2F32CED15DFB2AA59C6
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.D..+..............................................................................................................................................................................................................................................................................................................................................K..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.648219399869683
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 95.46% Win32 EXE PECompact compressed (generic) (41571/9) 3.96% Win16/32 Executable Delphi generic (2074/23) 0.20% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19%
File name:	nCBC3f6tz1.dll
File size:	1'270'784 bytes
MD5:	7012991b1134738dcf2209c247965b9f
SHA1:	c36405cdeeefc0c6ea2e664b0965c5c4cda16a79
SHA256:	426fa8eecccaa92eb1bb7a298a37b434f98dd8445f58796c1414ada17a059a9a
SHA512:	b614d2edcebe1560562300499b0744aab2d8f6348b98b8f4bbd0f3bf4f804cf615d33600cc3bfd55942ed4679be603b3bb8162fd09d1e9766e5b24f09ec003a8
SSDEEP:	24576:DGkMq/UR+FgcAf11t36U2cjDz3YTMVKh:hR3F2DKU9DzoTMVK
TLSH:	24455C62F245643EC4AA0A364977AD50583FB7A2755AEC1E57F4088CCE3A5802F3E74F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x50eed0
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x66F1D604 [Mon Sep 23 20:56:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6327992c879b906e750778c69d550fed

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC0h
mov eax, 0050A450h
call 00007F2AF8CCABFDh
call 00007F2AF8CC4018h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x122000	0x2a3	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11f000	0x1c46	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13d000	0x4600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x1852c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11f5a4	0x464	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x121000	0x366	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10ca38	0x10cc00	c28d3315c6cf633aa713c8ea5f598524	False	0.3667360101744186	data	6.491607362705958	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x10e000	0xee8	0x1000	ab7dc8c516f6ff063fe164a8ca424a96	False	0.533935546875	data	6.067594508535782	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10f000	0x8fa0	0x9000	b52f8616a65ec421538aeb614017352b	False	0.6366102430555556	data	6.62898746697328	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x118000	0x62f4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x11f000	0x1c46	0x1e00	bd166391d3b2991897d3f90ec0b419cb	False	0.32083333333333336	data	4.974350011480841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x121000	0x366	0x400	9c7b1e6fd492c18332b403fa3ad29c2e	False	0.3544921875	data	3.0967012674854977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x122000	0x2a3	0x400	cd924b0cd3e6cf1a21119645d23b5f74	False	0.408203125	data	3.9902888665768597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x123000	0x44	0x200	c9f8bfa36b2dc5163b75d3196d251b45	False	0.15625	data	1.1660636886017055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0x1852c	0x18600	71671c2d2eeecdee8a180d069287c025	False	0.5805588942307692	data	6.710825998888914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x13d000	0x4600	0x4600	d8cd2ec23cd0c16ce8f3bd004f37743a	False	0.2739955357142857	data	3.6872696770617823	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x13d460	0x31c	DOS executable (COM, 0x8C-variant)			0.4258793969849246
RT_STRING	0x13d77c	0xb5c	data			0.2548143053645117
RT_STRING	0x13e2d8	0x428	data			0.37406015037593987
RT_STRING	0x13e700	0x3c4	data			0.37655601659751037
RT_STRING	0x13eac4	0x3cc	data			0.2757201646090535
RT_STRING	0x13ee90	0x394	data			0.4334061135371179
RT_STRING	0x13f224	0x4e4	data			0.35303514376996803
RT_STRING	0x13f708	0x374	data			0.3563348416289593
RT_STRING	0x13fa7c	0x454	data			0.38898916967509023
RT_STRING	0x13fed0	0x1ec	data			0.3983739837398374
RT_STRING	0x1400bc	0xc4	data			0.6428571428571429
RT_STRING	0x140180	0x170	data			0.5597826086956522
RT_STRING	0x1402f0	0x334	data			0.41585365853658535
RT_STRING	0x140624	0x408	data			0.3168604651162791
RT_STRING	0x140a2c	0x36c	data			0.4018264840182648
RT_STRING	0x140d98	0x2b8	data			0.4367816091954023
RT_RCDATA	0x141050	0x10	data			1.5
RT_RCDATA	0x141060	0x37c	data			0.602017937219731
RT_RCDATA	0x1413dc	0x2	data	English	United States	5.0
RT_VERSION	0x1413e0	0x1e8	data	English	United States	0.4979508196721312

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc, FreeLibrary
user32.dll	ReleaseDC, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, LoadImageW, LoadIconW, GetSystemMetrics, GetSysColor, GetIconInfo, GetDC, GetClipboardData, FrameRect, FillRect, DrawTextExW, DrawIconEx, DrawFocusRect, DestroyIcon, CreateIcon, CopyIcon, CharUpperBuffW, CharUpperW, CharLowerBuffW
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, SetWinMetaFileBits, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, RoundRect, ResizePalette, Rectangle, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixel, GetPaletteEntries, GetObjectW, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutW, ExtFloodFill, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, Chord, BitBlt, ArcTo, Arc, AngleArc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReadFile, RaiseException, IsDebuggerPresent, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, IsBadReadPtr, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVersionExW, GetTickCount, GetThreadPriority, GetThreadLocale, GetStdHandle, GetProcessHeap, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateFileW, CreateEventW, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	CoCreateInstance, IsEqualGUID
msvcrt.dll	memset, memcpy

Exports

Name	Ordinal	Address
BarCreate	4	0x50a444
BarDestroy	5	0x50a440
BarFreeRec	6	0x50a43c
BarRecognize	7	0x50a438
TMethodImplementationIntercept	3	0x45f330
__dbk_fcall_wrapper	2	0x41041c
dbkFCallWrapperAddr	1	0x51b630
wkeCreateWebView	13	0x50a420
wkeDestroyWebView	8	0x50a434
wkeFinalize	9	0x50a430
wkeFireContextMenuEvent	16	0x50a414
wkeFireKeyDownEvent	12	0x50a424
wkeFireKeyPressEvent	14	0x50a41c
wkeFireKeyUpEvent	23	0x50a3f8
wkeFireMouseEvent	15	0x50a418
wkeFireMouseWheelEvent	17	0x50a410
wkeGetCaretRect	20	0x50a404
wkeInitialize	22	0x50a3fc
wkeIsDirty	21	0x50a400
wkeKillFocus	19	0x50a408
wkePaint2	24	0x50a3f4
wkeResize	11	0x50a428
wkeSetDirty	10	0x50a42c
wkeSetFocus	18	0x50a40c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 18:51:23.754456997 CET	53	60345	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	13:51:01
Start date:	29/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll"
Imagebase:	0x560000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:51:01
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:51:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:51:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarCreate
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:51:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",#1
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:51:02
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 652
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:51:05
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarDestroy
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:51:08
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nCBC3f6tz1.dll,BarFreeRec
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarCreate
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarDestroy
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarFreeRec
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetFocus
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeSetDirty
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeResize
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkePaint2
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeKillFocus
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeIsDirty
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeInitialize
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeGetCaretRect
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseWheelEvent
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireMouseEvent
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:51:11
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyUpEvent
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyPressEvent
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireKeyDownEvent
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFireContextMenuEvent
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeFinalize
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeDestroyWebView
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",wkeCreateWebView
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",dbkFCallWrapperAddr
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",__dbk_fcall_wrapper
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",TMethodImplementationIntercept
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:51:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nCBC3f6tz1.dll",BarRecognize
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:51:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 640
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:51:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 640
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.6%
Total number of Nodes:	332
Total number of Limit Nodes:	36

Executed Functions

Function 0040D2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D337

Part of subcall function 0040D1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
Part of subcall function 0040D1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction ID: 31cc6c2f53d714b9faa06a3b986118d36ba9187928ad3646f11bb52bdd509fcd
Opcode Fuzzy Hash: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction Fuzzy Hash: DD113670E042099BDF00EFA5D952AAEB3B4EF45304F50447EB904B73C2D7785E098669

Function 0040D1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction ID: f2706f95e4b90df003fff4208de2c5c05cd5cdeba3f5e8022b992bb7b9acb03d
Opcode Fuzzy Hash: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction Fuzzy Hash: 80F08271944608BEDB20FBB5DC5299EB7FCEB48314BA005BAB404F31D2EB389E14995D

Function 0040EE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040EE88

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 4e8efc271a9064b51e8e7fb51594f2112b3c6a5914667696f4d1ddbf71e3eb2d
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 72A012208088000EC408A7194C4350F31805941118FC40624785CA92C2E619896546EF

Function 0040CDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D00D,?,?), ref: 0040CE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040CEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040CEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040CEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040CF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D), ref: 0040CF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001), ref: 0040CF6F
RegCloseKey.ADVAPI32(?,0040CFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales), ref: 0040CFEA

Strings

Software\Borland\Locales, xrefs: 0040CEDC
Software\CodeGear\Locales, xrefs: 0040CEA0, 0040CEBE
Software\Embarcadero\Locales, xrefs: 0040CE60, 0040CE82
Software\Borland\Delphi\Locales, xrefs: 0040CEFA

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction ID: 80583e44c54d8f6c8431ac525ce0e8cce3f8a82ce7c118a8e5b64ed8406c3328
Opcode Fuzzy Hash: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction Fuzzy Hash: DC512675A40609BEEB20DBA5CC82FAFB7BCDB08704F504077BA04F61C1D6789D059A5D

Function 0040CAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000,00000000), ref: 0040CAD2
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CAF6
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CB05
IsValidLocale.KERNEL32(00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB17
EnterCriticalSection.KERNEL32(0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB74
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB9D

Strings

en-GB,en,en-US,, xrefs: 0040CAE2, 0040CB89

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction ID: dbd07ac227d82710da470fa0a9828874cbe6fbb8e5c29b4c0eb771d3e90eaa4c
Opcode Fuzzy Hash: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction Fuzzy Hash: 59214220740744D7EA12B77AA85376E36A4EB45718F50853BB000B72C2D9BD9D418ADF

Function 004EEE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 004EEE3A

Part of subcall function 004EEDD0: GetDC.USER32(00000000), ref: 004EEDD9
Part of subcall function 004EEDD0: SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
Part of subcall function 004EEDD0: GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
Part of subcall function 004EEDD0: ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Strings

MS Shell Dlg 2, xrefs: 004EEEA4
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 004EEE90
Tahoma, xrefs: 004EEE5C

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 3e989dd22528e993a8f094909ded440fcce72ae8fe55bb623e6ec587366682e7
Instruction ID: 1ff446588a6e6a0fa4dd5297cfc109956efff4a3f0478c3220450b82ea8a73ab
Opcode Fuzzy Hash: 3e989dd22528e993a8f094909ded440fcce72ae8fe55bb623e6ec587366682e7
Instruction Fuzzy Hash: 1D11D030600149AFC711EF6BCC12A9E7BB5EB45705F90847BF400A7791DB39AD01CB18

Function 0040961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00409653

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction ID: 57d564f7514a768ac0d6b140dc1e0ae383663f7c9c7dd69698fd604fdf563357
Opcode Fuzzy Hash: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction Fuzzy Hash: FF516B706002449BDB25EF6AC88479B7BE1AF59314F14843FE809AA3D3D779DC88CB59

Function 0050E000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E02D

Part of subcall function 0040C520: InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
Part of subcall function 0040C520: GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Part of subcall function 0040EE84: GetSystemInfo.KERNEL32 ref: 0040EE88

GetCommandLineW.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E092

Part of subcall function 00405244: GetStartupInfoW.KERNEL32 ref: 00405255

GetACP.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E0A6
GetCurrentThreadId.KERNEL32 ref: 0050E0BA

Part of subcall function 0040EE98: GetVersion.KERNEL32(0050E0C9,00000400,00000000,0050E0D7), ref: 0040EE98

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction ID: b63630b870325ab19e945f9b7a74bc4420f07e9680e2ed97b13d29786ef075bf
Opcode Fuzzy Hash: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction Fuzzy Hash: 3411217040478889D720FF72AC1A2693AA4FB19308710C87ED1006A2E2DFBD540CEF6E

Function 004D915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D91D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004D92BC

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction ID: ad3af0877aad2f918cc60e01b05eab59aa261d8504b712c7e441bbb361f6d9d3
Opcode Fuzzy Hash: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction Fuzzy Hash: 87515431B00208BFDB11EBA5C852B9EB7FAAB48304F15446FB444E3382DA7D9F069759

Function 00427884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00427984), ref: 004278C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 00427902
VerQueryValueW.VERSION(?,00427998,?,?,00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 0042791C

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction ID: c637f2b1f86e41ba3c57f6c02bd3706f471a10e856d15e50b91235f572eefc7d
Opcode Fuzzy Hash: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction Fuzzy Hash: BC3141B5A04319AFEB00DFA9D881DAEB7F8EB48704B9144BAF544E3241D778DE40CB65

Function 004D9EDC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,004D9BB9), ref: 004D9F07

Strings

8DA, xrefs: 004D9F26

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: 8DA
API String ID: 3660427363-1089967677
Opcode ID: 62b5dd27d72dd0d9c1c038acb69b9933a80f44869dcc94b569568e39bbe6ba57
Instruction ID: 39c98cee85b92a318de15d9b41cd990746fee319e790c38c5fa8baae42c46660
Opcode Fuzzy Hash: 62b5dd27d72dd0d9c1c038acb69b9933a80f44869dcc94b569568e39bbe6ba57
Instruction Fuzzy Hash: A3015271600208AFDB00EFA9DC81ADEB7A89B59314F0081ABF914DB342DA759E0587A5

Function 0040D3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D473
GetSystemDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D49B

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction ID: 914cf1b0947d833fcc03ff50d5076885400eec8b7426a2207ce03941fa5f7576
Opcode Fuzzy Hash: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction Fuzzy Hash: DB31EB30E142099BDB10EFA9C891BAEB7B5EF44304F50457BE400B72D2D778AD498A59

Function 0040D4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction ID: 258510d9c4dee0299c5f3f79c4fbca46c564eaaadbdb9c5c4e3057b0bb4fa4ad
Opcode Fuzzy Hash: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction Fuzzy Hash: 3F114F70E4461CABDB10EB94CC86BDE73B8DB04304F5144BAB508B72D1EA785F858A99

Function 00405600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00405C17), ref: 00405617

Strings

@., xrefs: 00405652, 00405670

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction ID: 7dac567e4a07de2f06f580edb35680116b9bdba5c2a0860377bbd693bdd19f0d
Opcode Fuzzy Hash: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction Fuzzy Hash: 49F0AFF2B003004FD7248F789D407A67AD4FB08324F10827FE908EB798DBB488048B84

Function 004D8EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EB1
RegCloseKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EBA

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 6f4c2654893a1a96a1da4be1dd0c350b83e18a7e628d6434c516513760379d46
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 40D067B1E042049ADF60EF7AC9C5A577BDC6F44315B08C4ABB808DF247DA3CD9409B28

Function 004D98DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,004D9AE0,00000000,004D9C1C), ref: 004D990D

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction ID: bf80709a24f295cc4fff76cdf4c79f612c8773d4563c6b2b62db8eae0a0485ee
Opcode Fuzzy Hash: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction Fuzzy Hash: 3CF01C623052046FD344FA6E9C81F6B66DC9B88754F10843FB248C7342D964DC058375

Function 0040C278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040C296

Part of subcall function 0040D4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
Part of subcall function 0040D4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: dd2aa8039920255b97d322d6193c29fca073ce87a4a4145dda77fc50cf625817
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 07E0ED71E003109BCB10DF98C9C5A4737D8AB08754F0446A6AD14DF387D775DD148BD5

Non-executed Functions

Function 004EAA7C Relevance: 48.5, APIs: 32, Instructions: 501windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EAAFC
GetDC.USER32(00000000), ref: 004EAB0D
CreateCompatibleDC.GDI32(00000000), ref: 004EAB1E
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EAB6A
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004EAB8E
SelectObject.GDI32(?,?), ref: 004EADE6
SelectPalette.GDI32(?,00000000,00000000), ref: 004EAE26
RealizePalette.GDI32(?), ref: 004EAE32
SetTextColor.GDI32(?,00000000), ref: 004EAE9B
SetBkColor.GDI32(?,00000000), ref: 004EAEB6
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,004EB046,?,00000000,004EB068,?,00000000,004EB079), ref: 004EAEFF
FillRect.USER32(?,00000000,00000000), ref: 004EAE83

Part of subcall function 004E32AC: GetSysColor.USER32(?), ref: 004E32B6

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 004EAF21
CreateCompatibleDC.GDI32(00000000), ref: 004EAF34
SelectObject.GDI32(004EB33B,00000000), ref: 004EAF57
SelectPalette.GDI32(004EB33B,00000000,00000000), ref: 004EAF73
RealizePalette.GDI32(004EB33B), ref: 004EAF7E
SetTextColor.GDI32(004EB33B,00000000), ref: 004EAF9C
SetBkColor.GDI32(004EB33B,00000000), ref: 004EAFB7
BitBlt.GDI32(?,00000000,00000000,?,?,004EB33B,00000000,00000000,00CC0020), ref: 004EAFDF
SelectPalette.GDI32(004EB33B,00000000,000000FF), ref: 004EAFF1
SelectObject.GDI32(004EB33B,00000000), ref: 004EAFFB
DeleteDC.GDI32(004EB33B), ref: 004EB016

Part of subcall function 004E45BC: EnterCriticalSection.KERNEL32(-00000008), ref: 004E45E4
Part of subcall function 004E45BC: CreateBrushIndirect.GDI32(?), ref: 004E4671
Part of subcall function 004E45BC: LeaveCriticalSection.KERNEL32(?,004E46A5,-00000008), ref: 004E4698

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapCriticalRealizeSectionText$BrushDeleteEnterFillIndirectLeaveRectTable
String ID:
API String ID: 3271313764-0
Opcode ID: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction ID: 35a244f6f23a8f79e02010a3497fee76c02ec5d27261e314751b2550eb949676
Opcode Fuzzy Hash: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction Fuzzy Hash: 47121975A00248AFDB10DFAAC885F9EB7B9EF08315F118456F914EB291C778EE80CB55

Function 0040C520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Strings

kernel32.dll, xrefs: 0040C555, 0040C56F, 0040C589
GetThreadPreferredUILanguages, xrefs: 0040C550
GetThreadUILanguage, xrefs: 0040C584
SetThreadPreferredUILanguages, xrefs: 0040C56A

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction ID: 8edfc10a46b7400df28ad4f2c85025a5e0675a444164cbed82ad90a550fe5e83
Opcode Fuzzy Hash: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction Fuzzy Hash: 15F05EB8951B10BADA023772AD8375F3680DA1070CB20853BB100790D2DEBC19549E9E

Function 004FFD00 Relevance: 20.0, APIs: 10, Strings: 1, Instructions: 742windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004FFE79
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 004FFEC0
DeleteObject.GDI32(00000000), ref: 004FFEDE
DeleteDC.GDI32(00000000), ref: 004FFEE7
SelectObject.GDI32(00000000,00000000), ref: 004FFF18
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FFF47
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 00500607
SelectObject.GDI32(00000000,?), ref: 00500614
DeleteObject.GDI32(00000000), ref: 0050061D
DeleteDC.GDI32(00000000), ref: 00500626

Strings

4iQ, xrefs: 004FFE65

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DeleteObject$CreateSelect$CompatibleSection
String ID: 4iQ
API String ID: 1283611041-1953506770
Opcode ID: c56c04007e25d6d35d16b7203b49a7e51d421e1ba92ff66c7cbdc6c179cf3573
Instruction ID: be9d6b00bfd07e6650375709e39552807e6f3c9f16d22f912302f9deee62be0b
Opcode Fuzzy Hash: c56c04007e25d6d35d16b7203b49a7e51d421e1ba92ff66c7cbdc6c179cf3573
Instruction Fuzzy Hash: 81528D71E042598FCB15CFA9C881BEDBBF2FF45300F1481AAE458EB2D2C638A945DB14

Function 0040CBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041A5A8,?,?), ref: 0040CC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040CC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD26
FindClose.KERNEL32(?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD89

Strings

\, xrefs: 0040CD56
GetLongPathNameW, xrefs: 0040CC20
kernel32.dll, xrefs: 0040CC10

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction ID: 182d901b7ba620ca83dfe24b28ff924219823170be1df94bbfac5eeb8ceb1ef4
Opcode Fuzzy Hash: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction Fuzzy Hash: 73417F71A00618DBDB20EBA4CCC5ADEB3B5AF84314F1846BA9504F72C1E77CAE45CB49

Function 00508FA8 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,0050920D,?,00000000,?,00000000), ref: 0050902A
IsBadReadPtr.KERNEL32(?,00000014), ref: 005091DE

Strings

BuildImportTable: GetProcAddress failed, xrefs: 005091B1
BuildImportTable: ReallocMemory failed, xrefs: 005090BC
BuildImportTable: can't load library: , xrefs: 00509071

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: 07585b66520d2378765dc69f1b673a9492e3dd53a54e1aabfdadb43b698f55e9
Instruction ID: 06fdfb6f6a3ddd4d1125e6bdfe03ffd5b96b5dc28f3173b4db805a3c0c15cc66
Opcode Fuzzy Hash: 07585b66520d2378765dc69f1b673a9492e3dd53a54e1aabfdadb43b698f55e9
Instruction Fuzzy Hash: 33715E70A00206AFDB10DB69CC86BEEBBF9FB88314F0084A9B545DB296D774AD45CB50

Function 00508B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,0050A2C1,?,?,?,?,?,00000000,00000000), ref: 00508C00
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,0050A2C1,?,?,?,?,?,00000000,00000000), ref: 00508C2F
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,0050A2C1,?,?,?,?,?,00000000,00000000), ref: 00508C3A
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,0050A2C1,?,?,?,?,?,00000000,00000000), ref: 00508C40
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,0050A2C1,?,?,?,?,?,00000000,00000000), ref: 00508C80

Strings

Q, xrefs: 00508C45, 00508C5F, 00508C72

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID: Q
API String ID: 565514093-1716927825
Opcode ID: 281cdbc0fa74cc4902ccff2dadf30d3d003d19493235caf4340a304c263213d7
Instruction ID: 583c01e93af88c742b1e5183a1fc7bdee78daad3a7c294046d574e630c03107a
Opcode Fuzzy Hash: 281cdbc0fa74cc4902ccff2dadf30d3d003d19493235caf4340a304c263213d7
Instruction Fuzzy Hash: 84318171205605AFE710EF69CC84F7ABBA8FB88714F144659F594CB291CB64EC45C7A0

Function 004AA910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000), ref: 004AA965

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: cb9b2a388fffd021e353bf4cf2117ea65373932cb549638ab777629fd56d0805
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 96F062B26042047F5744EE5EA841D5B7BECDE5A264310011FF908D7207DA38ED51837D

Function 0040C79C Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C846
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C862
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C873

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction ID: 2a28b5b25d505860436f04a2e6c8396a795a98c7f85c76968f02c108a8d9c51a
Opcode Fuzzy Hash: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction Fuzzy Hash: BB319C71A0061CEBDB20EB55DC81BDE77B9EB44705F6042BAA508B32D0D6395E80DE59

Function 004EA1D8 Relevance: 4.6, APIs: 3, Instructions: 51fileclipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32(0000000E), ref: 004EA1E5
CopyEnhMetaFileW.GDI32(00000000,00000000), ref: 004EA207
GetEnhMetaFileHeader.GDI32(?,0000006C,?,00000000,00000000), ref: 004EA219

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID:
API String ID: 1752724394-0
Opcode ID: 8b16d8c7a66d7a50bd3bc120d85c0e81c41265ab6c9e86269915d1be8eae12fd
Instruction ID: aea61b579b12049da75c96bfe0ce68d4ce55fb0606cfa38e7b8f88c73018f3b7
Opcode Fuzzy Hash: 8b16d8c7a66d7a50bd3bc120d85c0e81c41265ab6c9e86269915d1be8eae12fd
Instruction Fuzzy Hash: 14115E726003449FC710DFAEC885A9AB7F8EF49315F10466EE509DB352DA74EC48CB95

Function 004EFE80 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 783COMMON

Download Yara Rule

Strings

jjj, xrefs: 004F0654

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: jjj
API String ID: 0-2289343631
Opcode ID: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction ID: 0e6e8520d3be3831dee58035f3478674022d586b9291955b557444e96a04ac11
Opcode Fuzzy Hash: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction Fuzzy Hash: CB723970600204CFDB29CF19D9C0B677BA2FB95315F14869AD9464F38BC738E856CB6A

Function 004F1FC4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 699COMMON

Download Yara Rule

Strings

9Q, xrefs: 004F22AF

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: 9Q
API String ID: 0-4141447236
Opcode ID: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction ID: 872c69647381f06e73c0189917d9e5469cc943f97499b4375cee1c22dc96545a
Opcode Fuzzy Hash: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction Fuzzy Hash: 40626D70900209DFDB19CF58C984BBEBBB1BF88304F15819ADD559B386C778D985CB89

Function 004B8000 Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(00000000,004B80BB), ref: 004B8032
RaiseException.KERNEL32(406D1388,00000000,00000004,00001000,00000000,004B808D,?,00000000,004B80BB), ref: 004B807E

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise
String ID:
API String ID: 1899633966-0
Opcode ID: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction ID: aa851b4e1d0f37632037c728c599de388d05abd6bc809da2430ac8adde4c7f7f
Opcode Fuzzy Hash: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction Fuzzy Hash: 7A11D671A14208AFD710EF65DC52ADEBBFCEB48704F61447BE500E3651EB785E04CA68

Function 004E5AA0 Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000,004EB33B,?,00000000,00000054,?,00000000,?), ref: 004E5AC0
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000), ref: 004E5AE6

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction ID: c91c4b4c8320e0c1e530085dddd9d5d25a400c360d6da16a75b1d286b8cd0c3b
Opcode Fuzzy Hash: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction Fuzzy Hash: 7401AC707147455FE721FB628D92F9977A8DB04709F5044BAF704E62C3EAB86D40891D

Function 004219D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 004219F9

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction ID: 0ac6486f21f903cb75f282dfc890b26380fbcd4d5ccfbab9b17402b0b1878633
Opcode Fuzzy Hash: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction Fuzzy Hash: 6011CCB5A00209AFDB04CF99C8819AFB7F9EFC8704B14C56AA509E7354E6319A41CBA4

Function 00425334 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction ID: 4ace5e9765896cc83d0c08b398fcb6cdb51b1f9deae2cd3a8e1490c56280457a
Opcode Fuzzy Hash: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction Fuzzy Hash: DEE0D87171071817D714A9599C86DFBB25CAB88340F4045BFBE05D7383EDB49E4446ED

Function 0042920C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00428FB4,00000002,?,?,0042958D,004257FD,?,00000000,0042583E,?,?,?,00000000,00000000), ref: 00429239

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction ID: 63fa091e9d080db82cecbc2cc5fa61dc70d90b6f989caf0edc4abe69f196ef62
Opcode Fuzzy Hash: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction Fuzzy Hash: A0E02662B415319BC120B7BA1E43B9A7A024F81BA4F08857BF498DF3C3EA6D0C0541FE

Function 00425380 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction ID: 9eed19484239e9ca95c0a1dfbed1db1bf7cda38a4e2fdab08b9ea4c2367ee6e5
Opcode Fuzzy Hash: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction Fuzzy Hash: 0BD05EA631922036E210915B7E45DBB5ADCDBC47B2F14483FBE48CA201D2A4CC059275

Function 00428FD0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,00429086,?,00000000,004291D3), ref: 00428FEB

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction ID: a303c1cb07ff97bfd8ef16a179b2a7490fc3f5062c6a27ca45c0f37d97ec2e54
Opcode Fuzzy Hash: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction Fuzzy Hash: F6D0A7E1B2420023E30426548C42B6722889B84704F10443C7784973C0EE7C591552BF

Function 00423868 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0042386C

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction ID: 8da0d5d7dce6a760fb6fb5968247694cf968f8d8edeffb1c78389c91dfcd4fca
Opcode Fuzzy Hash: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction Fuzzy Hash: 25A0125044582011814037190C0317570405840621FC40789B8F8403D1E91E026040D7

Function 004F6704 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F670A

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction ID: b43b3417401406a326c0658d495f7bfac22fcab4f87dfe3d4983a9788a7a34dd
Opcode Fuzzy Hash: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction Fuzzy Hash: 84814D77D105774BE7628E28C8043A17392AFDC39DF6B42B4ED04ABA42D536BD5386C0

Function 004F6444 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F644A

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction ID: 9cfbf6d39703a2f841c89ad7d8bc5bd644356b16f8883d5035a763e39ed3e34d
Opcode Fuzzy Hash: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction Fuzzy Hash: DB711877D204775BEB609E68C8043617392EF8925CF6B46B4DE04BBA42C636BD539AC0

Function 0043B4C4 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction ID: 0e1373ad738d05412743fbfe0b30fd2dda4791c2bd02ca1af8785a3d2d390580
Opcode Fuzzy Hash: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction Fuzzy Hash: 8702BE32910235DFDB96CF6AC040109B7B6FF8A72472A82D6D854AB229D370BE51DFD1

Function 004F5F80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction ID: 3b8a4b9bdbcbb050131b8f531c600d22b301e14a5b3c7c96b4b24d21a3266e97
Opcode Fuzzy Hash: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction Fuzzy Hash: 2871A53238978207E7288E7D9CE02B7EAD35FC531872EC97D95DAC3F42D979A4164248

Function 004B0F64 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: b7ad73d6065eefe40be1e3c61ddaa82719b5b59149f48ac65b38381fd691009e
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: F8418E31B002558BDB58EE2DC8D16A6B7A2AF94254B18C675DCA88F70BC938DD42C7A0

Function 004B10A8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: 9a75494c871b48b3840d49ff1b59f6b632724ee8b9803b4084a2a4f9b95828cd
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: 40419336A002559BDB48DE5DC8D1696B7A3BFC8314B19C675DCA88F70BC938DE02C7A0

Function 004E6918 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction ID: 2dc40e0aa77415d55bc0616e35fc77692ce9a422371aba29c42deb2143eb0115
Opcode Fuzzy Hash: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction Fuzzy Hash: EEE0016420010A8ED348BF38C1098A2B3E3EFECA1038BC4D0D44A9F23EF622C481C300

Function 004079E8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Function 004FABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 004FABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 004FABE7
SelectObject.GDI32(00000000,00000000), ref: 004FABEE
CreateCompatibleDC.GDI32(?), ref: 004FAC22
CreateCompatibleDC.GDI32(?), ref: 004FAC2E
CreateCompatibleDC.GDI32(?), ref: 004FAC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004FAC6B
SelectObject.GDI32(?,?), ref: 004FAC7B
SelectObject.GDI32(?,?), ref: 004FAC8B
SelectObject.GDI32(?,?), ref: 004FAC9B
SetBkColor.GDI32(00000000,?), ref: 004FACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 004FACCC
SetBkColor.GDI32(00000000,?), ref: 004FACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 004FACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FAD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 004FAD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 004FAD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 004FAD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004FAD90
SelectObject.GDI32(?,?), ref: 004FAD9D
DeleteObject.GDI32(00000000), ref: 004FADA3
SelectObject.GDI32(?,?), ref: 004FADB0
DeleteObject.GDI32(00000000), ref: 004FADB6
SelectObject.GDI32(?,?), ref: 004FADC3
DeleteObject.GDI32(00000000), ref: 004FADC9
SelectObject.GDI32(00000000,?), ref: 004FADD3
DeleteObject.GDI32(00000000), ref: 004FADD9
DeleteDC.GDI32(?), ref: 004FADE2
DeleteDC.GDI32(?), ref: 004FADEB
DeleteDC.GDI32(?), ref: 004FADF4
DeleteDC.GDI32(00000000), ref: 004FADFA

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: 825b2a03bc1370e51723bfade82acbff92c39003225e20d7aaefe19e3380dd92
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 82815BB2E40218BADB10DEE9CD85FDFBBBCAB09715F104459F604FB241D675AE408BA4

Function 0042EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0042EFA5

Part of subcall function 0042EF70: GetProcAddress.KERNEL32(00000000), ref: 0042EF89

Strings

VarIdiv, xrefs: 0042F04D
VarNeg, xrefs: 0042EFC9
VarR4FromStr, xrefs: 0042F0E7
VarNot, xrefs: 0042EFDF
VarMul, xrefs: 0042F021
VarOr, xrefs: 0042F08F
VarMod, xrefs: 0042F063
VarAnd, xrefs: 0042F079
oleaut32.dll, xrefs: 0042EFA0
VarR8FromStr, xrefs: 0042F0FD
VarCmp, xrefs: 0042F0BB
VarI4FromStr, xrefs: 0042F0D1
VariantChangeTypeEx, xrefs: 0042EFB3
VarAdd, xrefs: 0042EFF5
VarBoolFromStr, xrefs: 0042F13F
VarBstrFromCy, xrefs: 0042F155
VarSub, xrefs: 0042F00B
VarCyFromStr, xrefs: 0042F129
VarBstrFromDate, xrefs: 0042F16B
VarDiv, xrefs: 0042F037
VarDateFromStr, xrefs: 0042F113
VarXor, xrefs: 0042F0A5
VarBstrFromBool, xrefs: 0042F181

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction ID: 4d8a8b603ccf47e63391c59ab7cad31be334c78caf3acb6b5dd0fd78b8a56fbb
Opcode Fuzzy Hash: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction Fuzzy Hash: 15412761708239AA53046B6FBE0146677F8EA567103E1C4BBB404CBA69DB3CBC89573D

Function 004E5CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 004E5D2F
SelectObject.GDI32(?,?), ref: 004E5D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,004E5DB4,?,?), ref: 004E5D88
SelectObject.GDI32(?,?), ref: 004E5DA2
DeleteObject.GDI32(?), ref: 004E5DAE
CreateCompatibleDC.GDI32(00000000), ref: 004E5DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004E5DE3
SelectObject.GDI32(?,?), ref: 004E5DF8
SelectPalette.GDI32(?,24080E49,00000000), ref: 004E5E0C
SelectPalette.GDI32(?,?,00000000), ref: 004E5E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 004E5E33
SelectPalette.GDI32(?,24080E49,000000FF), ref: 004E5E49
RealizePalette.GDI32(?), ref: 004E5E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004E5E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 004E5E99
SetTextColor.GDI32(?,00000000), ref: 004E5EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 004E5EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 004E5EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 004E5F00
SetTextColor.GDI32(?,?), ref: 004E5F0A
SetBkColor.GDI32(?,?), ref: 004E5F14
SelectObject.GDI32(?,00000000), ref: 004E5F27
DeleteObject.GDI32(?), ref: 004E5F30
SelectPalette.GDI32(?,00000000,00000000), ref: 004E5F52
DeleteDC.GDI32(?), ref: 004E5F5B

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 118953fea359356e25d164f27b8e78a2380bae261493a7d6a12787465145b049
Instruction ID: d88ae2ed45a29931f472a69d662a1bc6b4062899916de74d0cc4df68cf7f53a5
Opcode Fuzzy Hash: 118953fea359356e25d164f27b8e78a2380bae261493a7d6a12787465145b049
Instruction Fuzzy Hash: B98192B2A00209AFDB50DEA9CC85EEF7BEDAB0D715F100559F618E7240C238AE408B65

Function 004EB140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EB163
GetDC.USER32(00000000), ref: 004EB191
CreateCompatibleDC.GDI32(?), ref: 004EB1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EB1BD
SelectObject.GDI32(?,00000000), ref: 004EB1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 004EB1F9
CreateCompatibleDC.GDI32(?), ref: 004EB207
SelectObject.GDI32(00000000,00000000), ref: 004EB24F
SelectPalette.GDI32(00000000,?,00000000), ref: 004EB262
RealizePalette.GDI32(00000000), ref: 004EB26B
SelectPalette.GDI32(?,?,00000000), ref: 004EB277
RealizePalette.GDI32(?), ref: 004EB280
SetBkColor.GDI32(00000000,00000000), ref: 004EB28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 004EB2AE
SetBkColor.GDI32(00000000,00000000), ref: 004EB2B8
SelectObject.GDI32(00000000,00000000), ref: 004EB2CB
DeleteObject.GDI32(00000000), ref: 004EB2D7
DeleteDC.GDI32(00000000), ref: 004EB2ED
SelectObject.GDI32(?,00000000), ref: 004EB308
DeleteDC.GDI32(00000000), ref: 004EB324
ReleaseDC.USER32(00000000,00000000), ref: 004EB335

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction ID: a297371bd76699a261ad6334b1a26cfdb4486747052644e0b66a5fa1a439e62f
Opcode Fuzzy Hash: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction Fuzzy Hash: 1E51FF72E00355BBDB10DAEACC56FEFB7BCEF09705F10445AB614E7281D6789A408B94

Function 004EC71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC9A4
CreateCompatibleDC.GDI32(00000001), ref: 004ECA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 004ECA1E
SelectObject.GDI32(?,00000000), ref: 004ECA28
SelectPalette.GDI32(?,?,00000000), ref: 004ECA58
RealizePalette.GDI32(?), ref: 004ECA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 004ECA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,004ECAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 004ECA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 004ECAC8
SelectObject.GDI32(?,?), ref: 004ECAD5
DeleteObject.GDI32(00000000), ref: 004ECADB

Strings

BM, xrefs: 004EC83D
(, xrefs: 004EC8D2

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: b348004fe9fbf0417900245b361256081c2891adbdc3e00ccd4f666a2d0ee84a
Instruction ID: 8ce06293ba12aceaa71df6670ee523447cf40af7f930d923d2d6c38dff7d997c
Opcode Fuzzy Hash: b348004fe9fbf0417900245b361256081c2891adbdc3e00ccd4f666a2d0ee84a
Instruction Fuzzy Hash: 61E16E70A002589FDF04DFAAC885BAEBBF5FF49305F10856AF904A7391D7389941CB58

Function 004EB698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB6DB
RealizePalette.GDI32(?), ref: 004EB6EA
GetStretchBltMode.GDI32(00000000), ref: 004EB6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB70D
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB74F
SetStretchBltMode.GDI32(?,00000004), ref: 004EB75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB775
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EB792
CreateCompatibleDC.GDI32(00000000), ref: 004EB7F3
SelectObject.GDI32(?,?), ref: 004EB808
SelectObject.GDI32(?,00000000), ref: 004EB867
DeleteDC.GDI32(00000000), ref: 004EB876

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction ID: 489584e9c4cd725b990482e09af51c0bca80148c9d3d35cd6fb0d49a7a8e8351
Opcode Fuzzy Hash: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction Fuzzy Hash: 76A1D8B1600245AFDB40EFAAC985F9AB7E8EF08305F504559F605E7652D738ED40CBA4

Function 00509470 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

BTMemoryLoadLibary: Can't attach library, xrefs: 005096B4
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 00509689
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 005094FD
MZ, xrefs: 005094AB
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 00509554
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 005094B8
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 0050963C
PE, xrefs: 005094EC

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: 4ce2000109e887657d05edab29ef2ccfbef66f63488f29521ede4e9d7b3c2602
Instruction ID: 8883b3f6359ced617986b7b02a1e2334b48a64b51fb60a8ec1faaf7ec5fca396
Opcode Fuzzy Hash: 4ce2000109e887657d05edab29ef2ccfbef66f63488f29521ede4e9d7b3c2602
Instruction Fuzzy Hash: 03718A71B04205AFDB14DFA9D881FAEBBF9FB88700F0484AAF504E7396DA74D9058B54

Function 004E5B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E5B6F
CreateCompatibleDC.GDI32(00000000), ref: 004E5B79
GetObjectW.GDI32(?,00000018,?), ref: 004E5B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004E5BB0
GetDC.USER32(00000000), ref: 004E5BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004E5BE9
ReleaseDC.USER32(00000000,00000000), ref: 004E5C0F
SelectObject.GDI32(?,?), ref: 004E5C2A
SelectObject.GDI32(?,00000000), ref: 004E5C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 004E5C65
SelectObject.GDI32(?,00000000), ref: 004E5C73
SelectObject.GDI32(?,00000000), ref: 004E5C81
DeleteDC.GDI32(?), ref: 004E5C97
DeleteDC.GDI32(?), ref: 004E5CA0

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction ID: 17c9c49937640a7ee63a15ab90711d013368aaab887e413720973401a1c3c297
Opcode Fuzzy Hash: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction Fuzzy Hash: 3D410C72E40754BFDB10EAE9C952FAFB7BCAB09705F50045AB600E7281D6789A4087A4

Function 004EB964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB9A7
RealizePalette.GDI32(?), ref: 004EB9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 004EBA0A
SetStretchBltMode.GDI32(?,00000004), ref: 004EBA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 004EBA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EBA4D
CreateCompatibleDC.GDI32(00000000), ref: 004EBAAE
SelectObject.GDI32(?,?), ref: 004EBAC3
SelectObject.GDI32(?,00000000), ref: 004EBB22
DeleteDC.GDI32(00000000), ref: 004EBB31

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction ID: 7ad90294f0dfa4864f0bea30e35c96d4e1fa41525923fe95d334a894f78dac22
Opcode Fuzzy Hash: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction Fuzzy Hash: 54912971604245AFDB50DFAAC981F9FBBE8AB08305F10455AF505E7651D738ED40CBA4

Function 004EE9A8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 004EE9B4
IsEqualGUID.OLE32(?,00512700), ref: 004EE9D5
IsEqualGUID.OLE32(?,00512710), ref: 004EE9EB

Strings

'Q, xrefs: 004EE9FA
P'Q, xrefs: 004EEA3C
0'Q, xrefs: 004EEA10
@'Q, xrefs: 004EEA26

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Equal
String ID: 'Q$0'Q$@'Q$P'Q
API String ID: 4016716531-2080303212
Opcode ID: 747f021721ff3c2f2f308c36154d945ae8afe7a775471791d2fc46d475a62721
Instruction ID: 668e9c56f971650c12da9d823aa5ee09c5d7c22914e8e6bdbce1990405fd9d8c
Opcode Fuzzy Hash: 747f021721ff3c2f2f308c36154d945ae8afe7a775471791d2fc46d475a62721
Instruction Fuzzy Hash: C21175710085849ADB61DB2BAD80BF72B9D6F5A305F04509BFD844F343D39D894E876E

Function 00425DC8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 00408887
Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 0040889F

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425E60
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425E6B
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EA6
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425F42
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425F4D
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F8A
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F95

Strings

B.C., xrefs: 00425EF0
[B, xrefs: 00425E21, 00425EDD, 00426014

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.$[B
API String ID: 1601775584-1960173975
Opcode ID: b9f31523b50e8965963b6383f5ca9665be2633660fdff367e64acbeb2a92b883
Instruction ID: 696a8cbb88cbf135683503293481ae752516e7a6c47e6b4c93b3b9376ce1ac3d
Opcode Fuzzy Hash: b9f31523b50e8965963b6383f5ca9665be2633660fdff367e64acbeb2a92b883
Instruction Fuzzy Hash: 9761F570B006129FE710EF69E885AAA77E5EF44724B51857EF400EB3E1C738AD41DB98

Function 004ED7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004ED0C0: DeleteObject.GDI32(00000000), ref: 004ED206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004ED865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 004ED8E3
GetIconInfo.USER32(00000000,?), ref: 004ED947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 004ED980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,004EDA2B), ref: 004ED9E9
DeleteObject.GDI32(?), ref: 004ED9FF
DeleteObject.GDI32(?), ref: 004EDA08

Strings

,, xrefs: 004ED86A
, xrefs: 004ED890

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction ID: 3b15df45811348dce314f71d9fb3896dfd83895a50164542f8512fd99f32aa23
Opcode Fuzzy Hash: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction Fuzzy Hash: F4913871B00145AFD700EFAAC885A9EBBF9FF48305F6041AAF505EB251DA34ED45CB94

Function 004253AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253D3
GetThreadLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253DC

Part of subcall function 00425380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Strings

AMPM, xrefs: 0042560A
mmmm d, yyyy, xrefs: 00425502
m/d/yy, xrefs: 004254DD
:mm:ss, xrefs: 00425644
:mm, xrefs: 00425629
AMPM , xrefs: 00425619
2, xrefs: 0042566D

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction ID: ae11f37f10c7c7cc2ece4aa2851bd9592c5e3db29736d4fa45ff2483457f4832
Opcode Fuzzy Hash: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction Fuzzy Hash: 597122307005699BDB01EBA5E881ADE72A6DF84344FD0807BF904EB646DB3CDE16879D

Function 004266A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004264A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
Part of subcall function 004264A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,004267C5), ref: 00426701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042674C
GetStdHandle.KERNEL32(000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00426760
WriteFile.KERNEL32(00000000,000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00426766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 0042678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 004267A4

Strings

tfB, xrefs: 00426711, 004267B9

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: tfB
API String ID: 135118572-130872579
Opcode ID: a0136f777ba58d895bd3e1e672c0e4a7f0cd4caa2196d966552b420903b0b10f
Instruction ID: 9c75294d96735c9fe687749e8061594f53467045c9bc451e3e63c88f9cd22533
Opcode Fuzzy Hash: a0136f777ba58d895bd3e1e672c0e4a7f0cd4caa2196d966552b420903b0b10f
Instruction Fuzzy Hash: B2317375644218BFEB10EB65DC83FDA73BCEB04704F9041A6B604E61D1DA74AE848B6C

Function 004E4AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

CreateCompatibleDC.GDI32(00000000), ref: 004E4B64
SelectObject.GDI32(?,?), ref: 004E4B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 004E4C70
SetTextColor.GDI32(?,00000000), ref: 004E4C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 004E4C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 004E4CC5
SetTextColor.GDI32(?,?), ref: 004E4CD5
SetBkColor.GDI32(?,?), ref: 004E4CE5
SelectObject.GDI32(?,00000000), ref: 004E4D15
DeleteDC.GDI32(?), ref: 004E4D1E

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction ID: 71bf14b9f78042d93af0d274de238ac5bd12102c0260bb26fb2fcf8b95af7db9
Opcode Fuzzy Hash: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction Fuzzy Hash: EE919375A00248AFCB40DFAAC981E9EBBF9EF4D315B10449AF505EB661C734EE41CB64

Function 004085C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 004085DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004085E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,00408676,?,00000000,?,GetLogicalProcessorInformation), ref: 0040862A

Strings

@, xrefs: 0040867D
kernel32.dll, xrefs: 004085D8
GetLogicalProcessorInformation, xrefs: 004085D3

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction ID: 500c6e41f31b7fdb6d34238680861789b78f08bdeabe16a24c436e355b3d89bb
Opcode Fuzzy Hash: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction Fuzzy Hash: E0116370D00208AADB10EBA5CA05B5EB7A4DF04304F1288BFE854B72C1DA7E8E508E59

Function 00410594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0041064C

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction ID: 0ce41ded5bccfca64fbac36b7d610e41f84856dd8e2a7bbc42b78d3b128abe8f
Opcode Fuzzy Hash: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction Fuzzy Hash: 0CA19075A013099FDB20DFA8D881BEEB7B5FF58310F14812AE915A7390DBB4A9C4CB54

Function 00430A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00430AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00430B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00430B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00430BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00430BD8
VariantCopy.OLEAUT32(?), ref: 00430C0D

Strings

, xrefs: 00430A6E

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: c5ac3e0bb315912875ce6d6a8b12eb4200af54bb65bf5f77a9b42e84e07fd96b
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 2C51227590022D9BCB25DB59CC91BDAB3BCAF4C304F0052DAF548E7252D634AF848F65

Function 004E9A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 004E9B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 004E9B43

Strings

`, xrefs: 004E9A8B

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction ID: e4881d64baec76ee9eafe246b21c5bc9d5a9281d976d74d65e8b275913b0d6f5
Opcode Fuzzy Hash: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction Fuzzy Hash: 8A412275D00248AFDB40DFA9C881AAEB7F9FF48711F50816AF904EB241E7389E40CB64

Function 004061E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406206
WriteFile.KERNEL32(00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040620C
GetStdHandle.KERNEL32(000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040622B
WriteFile.KERNEL32(00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?), ref: 00406248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000), ref: 0040624E

Strings

TS@, xrefs: 00406218, 00406223

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: TS@
API String ID: 3320372497-1941835897
Opcode ID: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction ID: 82cfcf8d63e4733cb96d407babe502fa205990dff362196b090b8b3cf9cfd937
Opcode Fuzzy Hash: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction Fuzzy Hash: 9D0162A16486147DE110F2BA9C8AF6F368CDB18724F10077E7618F60D2C5785C449B7A

Function 0040591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 004059D3
Sleep.KERNEL32(0000000A,00000000), ref: 004059E9
Sleep.KERNEL32(00000000), ref: 00405A17
Sleep.KERNEL32(0000000A,00000000), ref: 00405A2D

Strings

@., xrefs: 00405AB4, 00405AD6, 00405BEC, 00405C02

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction ID: a95b6186faaf28ee99436786a323c89c11953a43e3af36f3f78c15d8c677067a
Opcode Fuzzy Hash: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction Fuzzy Hash: 0DC16972601B118FD725CF28D884367BBA1EB95320F1882BFD4059B3D5C778A849DF88

Function 00405CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405912), ref: 00405D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405912), ref: 00405D50

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction ID: 4f935fbc936f4d5eb3d08406d1a455a3bc696dbd4939a17767f2164eefdcc051
Opcode Fuzzy Hash: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction Fuzzy Hash: 1371D231604B008FE725DB28D888B67BBD4EF95314F14C2BFD844AB3D2D67888459F59

Function 004E6084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E60B2
GetDeviceCaps.GDI32(?,00000068), ref: 004E60CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E60ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 004E6111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 004E612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 004E6143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E6163
ReleaseDC.USER32(00000000,?), ref: 004E617B

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction ID: 253042d8ae561a030da4b25cfcc59df415f83bc43ecdec077c49d488911ed581
Opcode Fuzzy Hash: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction Fuzzy Hash: 8F2156B1A40218BADB50DFA5DD86F9EB3BCEB08705F510496F704E71C1D679AF408B28

Function 00405E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction ID: 14c4d9104ddc23c6b9370c21b65e9a421d4bec3d23930416dd05d6dcb6f7df23
Opcode Fuzzy Hash: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction Fuzzy Hash: 01C12262710A014BD714AA7D9C8836FB286DBC4325F68823FE645EB3C6DA7CCC458B58

Function 00501CB0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00501CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 00501D28
SelectObject.GDI32(?,?), ref: 00501D38
DeleteObject.GDI32(?), ref: 00501F51
DeleteDC.GDI32(?), ref: 00501F5D

Strings

|O, xrefs: 00501FB6

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID: |O
API String ID: 2986811175-2178481767
Opcode ID: 6c9e4b10af4bfad90ba126e86e16a972fe858d81f26a95e6dc0d306ccf21b480
Instruction ID: a9caf1b8b984823daa7831576d509085e41825b3096970940d4218d7ea8d8843
Opcode Fuzzy Hash: 6c9e4b10af4bfad90ba126e86e16a972fe858d81f26a95e6dc0d306ccf21b480
Instruction Fuzzy Hash: 83B1C575E0060A9FCB04DF99C985AAEBBF5FF48300F2181A5E914A73A1D734AD41CF55

Function 004FC798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC40B
Part of subcall function 004FC400: DeleteDC.GDI32(?), ref: 004FC418
Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC434

CreateCompatibleDC.GDI32(00000000), ref: 004FC903
CreateHalftonePalette.GDI32(?,00000000), ref: 004FC93E
ResizePalette.GDI32(?,00000001), ref: 004FC973
SelectPalette.GDI32(?,?,00000000), ref: 004FC998
RealizePalette.GDI32(?), ref: 004FC9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 004FC9CE
SelectObject.GDI32(?,00000000), ref: 004FC9E1

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction ID: 4ba82757873bb3c143a4d1742f8b993ef62ffc4f5942cec004fa87537f0c0421
Opcode Fuzzy Hash: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction Fuzzy Hash: E67137756005289FDB04EF19C4D5F6637E5EF0A305F0541E6F2048F3AAC678E84ACB9A

Function 00408850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408CDC: GetCurrentThreadId.KERNEL32 ref: 00408CDF

GetTickCount.KERNEL32 ref: 00408887
GetTickCount.KERNEL32 ref: 0040889F
GetCurrentThreadId.KERNEL32 ref: 004088CE
GetTickCount.KERNEL32 ref: 004088F9
GetTickCount.KERNEL32 ref: 00408930
GetTickCount.KERNEL32 ref: 0040895A
GetCurrentThreadId.KERNEL32 ref: 004089CA

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction ID: 59fdbd664e4c2a787114e1462c869c0698e504600effbf6fb817d1e717bb5ab3
Opcode Fuzzy Hash: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction Fuzzy Hash: BB415E716083419EDB21BE79CA4032BBAD1AB91354F14893FD4D8A73C2EE798881D75B

Function 004EA090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0F9
GetDC.USER32(00000000), ref: 004EA110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,004EA1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 004EA134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,004EA1AB,?,?,00000000,00000000,00000008,?,00000000,004EA1CB), ref: 004EA167

Strings

`, xrefs: 004EA0C8

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction ID: 560aeff5e142fb22fc32d70ae3aa060d7ef4d96bf65ee7c2df06f2301dcbdb9f
Opcode Fuzzy Hash: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction Fuzzy Hash: AD318775A00248ABDB00DFD5C882BEEF7B8EF0D705F514496F904EB281D678AE50D7A9

Function 004EA974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004E62F0: GetObjectW.GDI32(00000000,00000004), ref: 004E6307
Part of subcall function 004E62F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 004E632A

GetDC.USER32(00000000), ref: 004EA9B2
CreateCompatibleDC.GDI32(?), ref: 004EA9BE
SelectObject.GDI32(?), ref: 004EA9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,004EAA23,?,?,?,?,00000000), ref: 004EA9EF
SelectObject.GDI32(?,?), ref: 004EAA09
DeleteDC.GDI32(?), ref: 004EAA12
ReleaseDC.USER32(00000000,?), ref: 004EAA1D

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction ID: a90b19bdd86dec3490e2a43e61abe2758ba6d863edaf7bda9a2135b5bf853f90
Opcode Fuzzy Hash: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction Fuzzy Hash: 54115172E00359BFDB10EFE9C851AEEB7BCEB09705F4044AAF504E7241E6789E5087A4

Function 004098D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?,?), ref: 00409909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?), ref: 0040990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?), ref: 0040992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E), ref: 00409930

Strings

Error, xrefs: 00409942
Runtime error at 00000000, xrefs: 00409902, 00409947

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction ID: 1cafd5f0b55deffaaa1a260c41e3c473f996b032a313f4f96ee96a2a81eb749b
Opcode Fuzzy Hash: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction Fuzzy Hash: FBF04491A4134479FA3077A55C56F6F2B589704B18F18893FB650782D3CAB84C889766

Function 004E65E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 004E662E
GetSystemMetrics.USER32(0000000C), ref: 004E663A
GetDC.USER32(00000000), ref: 004E6656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004E667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004E668A
ReleaseDC.USER32(00000000,00000000), ref: 004E66C3

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction ID: 4016dc568379c8c19e12672c107d27f7e339e6f7b848dc7462e147759cb92e24
Opcode Fuzzy Hash: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction Fuzzy Hash: BA318474E00244EFEB00DFA6C841AAEBBB5FF49751F11856AF414AB384C6749D41CB65

Function 004E6234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E6252
SelectObject.GDI32(00000000,00000000), ref: 004E625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,004EC367), ref: 004E626F
SelectObject.GDI32(00000000,00000000), ref: 004E627B
DeleteDC.GDI32(00000000), ref: 004E6281
CreatePalette.GDI32 ref: 004E62DC

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 687ba0588a677c063a35c7de7b30ba0b67179116ebe1a95d8b245445ea316819
Instruction ID: f9ac28f5a709015cd7dac8c2aac76fc79250ca92cd540129d47a5b8790f0b7a3
Opcode Fuzzy Hash: 687ba0588a677c063a35c7de7b30ba0b67179116ebe1a95d8b245445ea316819
Instruction Fuzzy Hash: 8511E73120434022D210BB679C43BAB72A89FD575AF01842FB64597382E67C8D4943DA

Function 004E6A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E6950: GetObjectW.GDI32(?,00000054), ref: 004E6964

CreateCompatibleDC.GDI32(00000000), ref: 004E6ABE
SelectPalette.GDI32(?,?,00000000), ref: 004E6ADF
RealizePalette.GDI32(?), ref: 004E6AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 004E6B02
SelectPalette.GDI32(?,00000000,00000000), ref: 004E6B2A
DeleteDC.GDI32(?), ref: 004E6B33

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction ID: ce5ef7bc2b447eaaf5ad7ea58a7014afe3a29db5ee430c20c38cefb41b0ea7be
Opcode Fuzzy Hash: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction Fuzzy Hash: EF114275E403047FDB10DFAA8C42F9EBBEDDB49701F51806AB514E7281D678AE408768

Function 004EEBA4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 004EECF4

Strings

pN, xrefs: 004EEC15, 004EED49
,, xrefs: 004EEC6A
p'Q, xrefs: 004EEC33
, xrefs: 004EEC8B

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$p'Q$pN
API String ID: 3573556081-239200797
Opcode ID: a36b2ce3a17e244dc4f48a37d014dc17d7f2724a355e9d27d7f455f90c6e9585
Instruction ID: d53bf33184dab82490b91a6833bcc49679d7d0a09c945659e93068311a5a786b
Opcode Fuzzy Hash: a36b2ce3a17e244dc4f48a37d014dc17d7f2724a355e9d27d7f455f90c6e9585
Instruction Fuzzy Hash: 4251C074A00208AFDB40DF9AD881E9EB7F9FB48314F5181A6F914EB362D735AE44CB54

Function 004EE3C8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 004EE4B2

Strings

,, xrefs: 004EE468
, xrefs: 004EE483
p'Q, xrefs: 004EE3FB
`'Q, xrefs: 004EE40A

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$`'Q$p'Q
API String ID: 3573556081-2603654308
Opcode ID: 0d623d8bb47bc937e364320cc812b0cbe733d440f62dbf9a7760e2fd883d3a9d
Instruction ID: e246d9ab9c4f828bb50ef93b5af18b126cefd7c0b660ce055d72d1820066ec98
Opcode Fuzzy Hash: 0d623d8bb47bc937e364320cc812b0cbe733d440f62dbf9a7760e2fd883d3a9d
Instruction Fuzzy Hash: B74144B1A00104AFDB40DF6AC885A9A77F9EF09318B2141A6FC04EB356D775ED45CB94

Function 004264A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

Strings

MZP, xrefs: 00426519

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: cda587d1c7dd51f7113a3f7c71fb8e2b8424f2d416027c9f8032f24ff1560667
Instruction ID: d456c73e7132c3c39710e872f0bf7d3f91ce4916627ab0d5e0b6c1b93b785b94
Opcode Fuzzy Hash: cda587d1c7dd51f7113a3f7c71fb8e2b8424f2d416027c9f8032f24ff1560667
Instruction Fuzzy Hash: 70416270A002289FDB20DF65DC81BDDB7F9AB59304F8140FAE508E7241D7799E948F59

Function 004ED0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004ED17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 004ED189
ReleaseDC.USER32(00000000,00000000), ref: 004ED198
DeleteObject.GDI32(00000000), ref: 004ED206

Strings

(, xrefs: 004ED133

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 1d5f83cd09711b1592fb3c5d187764f48b37c6155305721d3b2ac61fe98a51fc
Instruction ID: f8dc7fb0225e0007809e4ec85b127dd46c416083a4cfc2b17fa9816b101fd4e4
Opcode Fuzzy Hash: 1d5f83cd09711b1592fb3c5d187764f48b37c6155305721d3b2ac61fe98a51fc
Instruction Fuzzy Hash: C541AE70E04248EFCB10DFA6C885ADEFBB5EF49305F1480AAE404AB351D6789E45DB99

Function 004B7154 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004B722A,?,?,004B5444,00000001), ref: 004B71CC
GetCurrentThread.KERNEL32 ref: 004B7204
GetCurrentThreadId.KERNEL32 ref: 004B720C

Strings

pDA, xrefs: 004B71EB
BnK, xrefs: 004B7221, 004B71D1, 004B71DB

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread$ErrorLast
String ID: BnK$pDA
API String ID: 4172138867-3175749474
Opcode ID: 8db536c4902bcc63ec3ac8b9906052481f87a4bc473b60b0992f67eec6861494
Instruction ID: 29931ac111fce0eb9797ac9b0a9f0cd1aaf37b0830860b7779323239afbeb4a3
Opcode Fuzzy Hash: 8db536c4902bcc63ec3ac8b9906052481f87a4bc473b60b0992f67eec6861494
Instruction Fuzzy Hash: E62108709086456ED701DFB5C8817EABBE4BF89304F44857BE42497782DB389815C7B9

Function 0043690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction ID: 8d3459a469465bc4371695b4e367a65a38b978d34797e4c4e50731b7cb5a1aca
Opcode Fuzzy Hash: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction Fuzzy Hash: AFD1C235A00209AFCF00EF95C4918EEFBB9EF0D310F5590A6E840A7251D638AE46DB79

Function 004F0894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 004F08C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 004F08F3
memcpy.MSVCRT(00000000,?,?), ref: 004F0989
memcpy.MSVCRT(00000000,?,?), ref: 004F099F
memcpy.MSVCRT(00000000,?,?), ref: 004F09B5
memcpy.MSVCRT(00000000,?,?), ref: 004F09C9

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: bcd7db05d191351e9405a97d2655ef30d3ed96d280d6279a09f2b3dd0a47b8f8
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 965175B1600200AFDB14CF69CCC5E6677A8BF88314F08827AEE098F346E735E944CB94

Function 004EC31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 76c421ad3c698b7ff88da0f61c3aa7df07cb2880bcd4f869b6d47c825d99da29
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: 3D11D3315012D9AEEB20AF27C481BEF3B94AF55357F04505BFC005A281D7BC8DA2C7A9

Function 004E619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E61B4
GetDeviceCaps.GDI32(?,00000068), ref: 004E61D0
GetPaletteEntries.GDI32(24080E49,00000000,00000008,?), ref: 004E61E8
GetPaletteEntries.GDI32(24080E49,00000008,00000008,?), ref: 004E6200
ReleaseDC.USER32(00000000,?), ref: 004E621C

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction ID: fb62e25858754de89261d63ddcf899fc845c4e56b322bcc1c3ebe9d0414cdd2c
Opcode Fuzzy Hash: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction Fuzzy Hash: 191108716483447EEB00DFA6EC42FA97FACE719706F40849BF204DA1C1DABA5544C324

Function 0040904A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 0040911E

Strings

,qB, xrefs: 0040906B
hsB, xrefs: 004090F7

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: ,qB$hsB
API String ID: 3192549508-2187915683
Opcode ID: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction ID: 7df4318895a31e83b2a36aa030ba475ccd5b90e95bae95c0b52881597b1f7c6e
Opcode Fuzzy Hash: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction Fuzzy Hash: 834196717042029FE720DF14C888B6BB7E5EB85314F15857AE448AB393C739EC45CB59

Function 00423C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CB4

Strings

yyyy, xrefs: 00423C89
, xrefs: 00423C7A

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction ID: 4198a1d351d31b9a86c79895a928489856ad1452b39a35c365c2990c697424f4
Opcode Fuzzy Hash: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction Fuzzy Hash: F4217F35A046289BDB10EF95D842AAEB3F8EF08701F91406BF905F7281D63C9F00C76A

Function 0042D69C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(0041F85C,00000001), ref: 0042D6B8
GetCPInfo.KERNEL32(0042D79C,0042C1C5,0041F85C,00000001), ref: 0042D6D9

Strings

$CA, xrefs: 0042D6E2
\A, xrefs: 0042D6EA

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Info
String ID: $CA$\A
API String ID: 1807457897-218779800
Opcode ID: abee861911d58a7033e3eeafc2a9b4d2014ccc218f4630971ae3e286374dfac3
Instruction ID: 3a58187b64d27b69014b85d8f26f214572db709be5b8c621f2483908a4e5df52
Opcode Fuzzy Hash: abee861911d58a7033e3eeafc2a9b4d2014ccc218f4630971ae3e286374dfac3
Instruction Fuzzy Hash: D501C471B00A158FC720EF69A981997BBE4AF05364700852FEC99C7351EA3999048BA9

Function 004E3964 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,004E3BCC), ref: 004E39AC
LeaveCriticalSection.KERNEL32(?,004E3BA3,?,00000000,004E3BCC), ref: 004E3B96

Strings

-Q, xrefs: 004E3A80
Default, xrefs: 004E3A5A

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Default$-Q
API String ID: 3168844106-3821686248
Opcode ID: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction ID: 19d7f923896caa44bc4d2895c7d959a39db7ed687c0c5984d3f2fc8e9670fb4e
Opcode Fuzzy Hash: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction Fuzzy Hash: BA519470A083589FDB02DFA9C845AEEBBF5FF48305F51446AE404A7352D778AE44CB14

Function 004E3ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 004E3EF7
GetObjectW.GDI32(?,00000010,?), ref: 004E3F0A
GetObjectW.GDI32(?,00000000,?), ref: 004E3F63

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction ID: b9ca84249461113418995685c1b411e63f59ddf32e5f5f2b3ba05ad8a3118a75
Opcode Fuzzy Hash: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction Fuzzy Hash: 09319471A047849FD711CF5AC885EAABBF9EF49311F14846EF854DB741D234E9008B64

Function 0040C998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040CA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040CA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040CA97

Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040CA15), ref: 0040C96B
Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040CA15), ref: 0040C988

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction ID: 8d1cb3547ee4b9364daa38f1b6dc697d03ddbece5e120c74778344a30482e11a
Opcode Fuzzy Hash: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction Fuzzy Hash: DF313D70A0021E9BDB10DBA9C8C57AFB7B5EF04304F00427AE555E7291DB789A04CB95

Function 004EA788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

CreateCompatibleDC.GDI32(00000000), ref: 004EA7DD
SelectObject.GDI32(00000000,?), ref: 004EA7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 004EA81F
RealizePalette.GDI32(00000000), ref: 004EA82B

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction ID: 70351cf6032dbd0939f732d494bf93bb1b6777d92977e90662745986a4f58f41
Opcode Fuzzy Hash: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction Fuzzy Hash: E8310634A00684EFD704EF5AD981D5EB7F5FF48315B6241A6E804AB322C738EE82DB54

Function 004EDF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 004EDFAD
GetObjectW.GDI32(?,00000018,?), ref: 004EDFCE
DeleteObject.GDI32(?), ref: 004EDFFA
DeleteObject.GDI32(?), ref: 004EE003

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction ID: 1a97c13f3edbda2b3c1502a7d4827854aa80e6db8bf7018fb0a338cf34cd0894
Opcode Fuzzy Hash: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction Fuzzy Hash: 32119175A00208AFDB00DFABC982C9EB7F9EB48311B1085AAF904D7351DB75EE00DA94

Function 004EEDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EEDD9
SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction ID: a86a7c8164184303e7b2e3849245c9a5924fc7d8bd12fc902a680fb7c4b12911
Opcode Fuzzy Hash: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction Fuzzy Hash: 94E04F626027B032D551666B5D86BDB2A4C4F026ABF480116FD44997D1DA0DCE5083FA

Function 00427150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00427356), ref: 004271F0
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00427356), ref: 0042721C

Part of subcall function 0040EDD0: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040EE15

Strings

T@A, xrefs: 00427307

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: T@A
API String ID: 902310565-1700159869
Opcode ID: 284301953d1e6e481a532c393e6be836ac4b0c1abaafadd224fe03bf215fa2d0
Instruction ID: a7ef7301bc3d9c0cf40a5b8feecd3813e60ace2750a0d77308b08e3197a87419
Opcode Fuzzy Hash: 284301953d1e6e481a532c393e6be836ac4b0c1abaafadd224fe03bf215fa2d0
Instruction Fuzzy Hash: FA512934A08269DFDB10DF69DC88AD9B7F4EF48304F4045EAA808A7351D778AE84CF59

Function 00508C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 00508CDD
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 00508D62

Strings

FinalizeSections: VirtualProtect failed, xrefs: 00508D70

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: e04d921dbffd082d60e16cb08b2a2fbd95abfeb0e8b71fc7296c1e446617a803
Instruction ID: b15402602bc6531235802ab20509cc713fcf62e1bde5a129271f9d5553ca5200
Opcode Fuzzy Hash: e04d921dbffd082d60e16cb08b2a2fbd95abfeb0e8b71fc7296c1e446617a803
Instruction Fuzzy Hash: 0E3102767016159FD710DB58C989FAABBE8BF58380F144284FA94DB3E2DB30ED408B90

Function 00428748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,0042BB77,00000000,0042BCB7), ref: 00428707

Strings

A, xrefs: 0042875E
Z, xrefs: 00428763

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: b9253ecd29e492176c38fe4a03f9f14fb6b287faa95297cdab911eb37b575cf8
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 431136127466200BE720643FAC817FF958A87C63A4F99023FF505D73C1DC5C8C0142D9

Function 00408F1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00408F8A
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_00008F20), ref: 00408FC7

Strings

hsB, xrefs: 00408F45

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB
API String ID: 3192549508-625297667
Opcode ID: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction ID: a3b05377a8d17e60e07457b386e13646049d2c6927d33ce14a72d1f6f32e6c37
Opcode Fuzzy Hash: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction Fuzzy Hash: 1A3180B0604301AFD720DB24C984F2BB7EAEB88714F14857EF548972A2CB38EC45D719

Function 004D8F38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FBC
RegCloseKey.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FD4

Strings

0DA, xrefs: 004D8FEB

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CloseCreate
String ID: 0DA
API String ID: 2932200918-1323616133
Opcode ID: a0f19bf8ba203798a6f5818f865e535c35ea911850f269e47917751f477542a0
Instruction ID: 910bbd055cc1c9b7bf883b16012c4ce6209579456e96a1eab725512d80e55f5e
Opcode Fuzzy Hash: a0f19bf8ba203798a6f5818f865e535c35ea911850f269e47917751f477542a0
Instruction Fuzzy Hash: 82215171B04208ABDB11EFA5CC52BAE77F9EB48704F10407BB504E7381EB789E059659

Function 0040945E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 0040947F

Strings

ptB, xrefs: 004094DA
hsB, xrefs: 004094B8

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB$ptB
API String ID: 3192549508-579888589
Opcode ID: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction ID: 1c15842ca407df81533eab869cf356bb1e86fa8830085c109665a44f2841b22d
Opcode Fuzzy Hash: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction Fuzzy Hash: 722187742082059BDB24DF29D884B2B7391AB98710F14C53AA845973D7C73CEC46DB59

Function 004E9928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,004E99F3), ref: 004E99AB

Strings

l, xrefs: 004E9959
EMF, xrefs: 004E994B

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: e698fb15b61af49e9b524d0ae29f7f56cff305fd2a00deaa9503dc1a296ad3bc
Instruction ID: d8b59ccd57732e94ff2d5b122cdf495c560b21a665579054683b94a632da62f7
Opcode Fuzzy Hash: e698fb15b61af49e9b524d0ae29f7f56cff305fd2a00deaa9503dc1a296ad3bc
Instruction Fuzzy Hash: 84217F71A00244DFCB10EFAAC881A6EB7F5FF49714F55426EE405AB786DB38AD01CB58

Function 00433380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0043338D

Strings

U8C, xrefs: 004333D0
U8C, xrefs: 0043339E

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: U8C$U8C
API String ID: 1927566239-2794899156
Opcode ID: 2bf219fe34d9c24dc34974f115c002bebb6f59059a4f52b7f4042f9b4cd4a705
Instruction ID: b1e442c5de183a7aacccb02b0ee133ba8c43aa8bff35dacbda8296542432f51e
Opcode Fuzzy Hash: 2bf219fe34d9c24dc34974f115c002bebb6f59059a4f52b7f4042f9b4cd4a705
Instruction Fuzzy Hash: 6BF09C75E0421DEBCB40DF99D881AEEBBF8FB09710F008156EA54E7350E774AA44CB95

Function 004339A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004339AD

Strings

>C, xrefs: 004339F0
>C, xrefs: 004339BE

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: >C$>C
API String ID: 1927566239-3959820462
Opcode ID: 103049f0001b8704505cf99c79934eeb600d4499a48119106208599eb55162a0
Instruction ID: 5ed58aa5db09b4979a1c98424812f62d5ce122125df54411c221c3311fd6cc8b
Opcode Fuzzy Hash: 103049f0001b8704505cf99c79934eeb600d4499a48119106208599eb55162a0
Instruction Fuzzy Hash: 6DF0EC75E0020DABCB00DF99C881ADFB7F8FB08310F008156EA14E7350E774AA44CB95

Function 004289EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0050E4DB,00000000,0050E512), ref: 004289F2

Part of subcall function 004139B0: GetProcAddress.KERNEL32(0043C998,?), ref: 004139DA

Strings

kernel32.dll, xrefs: 004289ED
GetDiskFreeSpaceExW, xrefs: 004289FD

Memory Dump Source

Source File: 00000004.00000002.1993876633.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1993851995.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993957214.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993978391.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1993997552.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994015628.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994035035.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994053772.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994150230.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994177183.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1994246873.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction ID: 8ccd786351900723a36e45e0a3bb3a683afe0fdfe4abf5b7f5dbba0d790a7421
Opcode Fuzzy Hash: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction Fuzzy Hash: 24D05EB07123624AD760ABA1B882B1E2288A320F06F80013FB20145B26CFFD8848534C

Analysis Process: rundll32.exePID: 7428, Parent PID: 1456COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	334
Total number of Limit Nodes:	36

Executed Functions

Function 0436D2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0436D3BC,?,?), ref: 0436D32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0436D3BC,?,?), ref: 0436D337

Part of subcall function 0436D1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,0436D222,?,00000001), ref: 0436D1F7
Part of subcall function 0436D1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,0436D222,?,00000001), ref: 0436D207

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 6aba2c7f8fd0351b71d558e109bb2552bd35bc876c6e86578761530eb0f4243b
Instruction ID: 2eac13111836aaad300701e43f0cc00c23d15fb72f1c92010a5f4ab246ab8ff0
Opcode Fuzzy Hash: 6aba2c7f8fd0351b71d558e109bb2552bd35bc876c6e86578761530eb0f4243b
Instruction Fuzzy Hash: 871172B0B0020A9BEF00EFA4D881AAEB7F8EF49304F609475D506E7348D7747E04CA61

Function 0436D1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0436D222,?,00000001), ref: 0436D1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,0436D222,?,00000001), ref: 0436D207

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9a7bd42f133bbc1daf39ab9cd697c861e42b40da83cce0fcaeacb14d5314efa4
Instruction ID: b989a229daab0ca6e2fdd6d8b1dfb8fe707cac2d48282de4c749a78b0bea4fc5
Opcode Fuzzy Hash: 9a7bd42f133bbc1daf39ab9cd697c861e42b40da83cce0fcaeacb14d5314efa4
Instruction Fuzzy Hash: FCF0BEB160020AAFEB20FBB4EC4188EB7FCEF0821079095B1A405E3188EA30AE009964

Function 0436CDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0436D00D,?,?), ref: 0436CE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0436D00D,?,?), ref: 0436CE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0436D00D,?,?), ref: 0436CE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0436CEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0436CEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0436CEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0436CF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0436CFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0436D00D), ref: 0436CF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0436CFF0,?,80000001), ref: 0436CF6F
RegCloseKey.ADVAPI32(?,0436CFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0436CFF0,?,80000001,Software\Embarcadero\Locales), ref: 0436CFEA

Strings

Software\Borland\Delphi\Locales, xrefs: 0436CEFA
Software\Embarcadero\Locales, xrefs: 0436CE60, 0436CE82
Software\CodeGear\Locales, xrefs: 0436CEA0, 0436CEBE
Software\Borland\Locales, xrefs: 0436CEDC

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 5f91ecfab8a6d2bbd6cd5ecf76ea44e297e9d0e11ef2ac2b34127d7258a8d565
Instruction ID: d5dff0c92f57a0484bf4ff30e8f6e6840c1d9b3a07c78f028372c4a75c80d222
Opcode Fuzzy Hash: 5f91ecfab8a6d2bbd6cd5ecf76ea44e297e9d0e11ef2ac2b34127d7258a8d565
Instruction Fuzzy Hash: B5515875B4020ABEEB10DBA4DC42FAEB7BCDF09708F50A075B616F6585D6B4B9008B54

Function 0436CAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0447AC10,00000000,0436CBB8,?,?,?,00000000,?,0436D480,00000000,0436D4DF,?,?,00000000,00000000,00000000), ref: 0436CAD2
LeaveCriticalSection.KERNEL32(0447AC10,0447AC10,00000000,0436CBB8,?,?,?,00000000,?,0436D480,00000000,0436D4DF,?,?,00000000,00000000), ref: 0436CAF6
LeaveCriticalSection.KERNEL32(0447AC10,0447AC10,00000000,0436CBB8,?,?,?,00000000,?,0436D480,00000000,0436D4DF,?,?,00000000,00000000), ref: 0436CB05
IsValidLocale.KERNEL32(00000000,00000002,0447AC10,0447AC10,00000000,0436CBB8,?,?,?,00000000,?,0436D480,00000000,0436D4DF), ref: 0436CB17
EnterCriticalSection.KERNEL32(0447AC10,00000000,00000002,0447AC10,0447AC10,00000000,0436CBB8,?,?,?,00000000,?,0436D480,00000000,0436D4DF), ref: 0436CB74
LeaveCriticalSection.KERNEL32(0447AC10,0447AC10,00000000,00000002,0447AC10,0447AC10,00000000,0436CBB8,?,?,?,00000000,?,0436D480,00000000,0436D4DF), ref: 0436CB9D

Strings

en-GB,en,en-US,, xrefs: 0436CAE2, 0436CB89

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 68f6daddda2a899bd4753cab7acc538b32922bc45157cf61db9cbcb84a095ed5
Instruction ID: c1696055e2e3302fe34cd352750fa3ae014683246d1473cfd304dc3852cf5d49
Opcode Fuzzy Hash: 68f6daddda2a899bd4753cab7acc538b32922bc45157cf61db9cbcb84a095ed5
Instruction Fuzzy Hash: 9A2193603002477BFF10BB68D81175D2A9C9F85A0CF60F432E183A728DDEB4BC428A96

Function 0444EE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0444EE3A

Part of subcall function 0444EDD0: GetDC.USER32(00000000), ref: 0444EDD9
Part of subcall function 0444EDD0: SelectObject.GDI32(00000000,058A00B4), ref: 0444EDEB
Part of subcall function 0444EDD0: GetTextMetricsW.GDI32(00000000), ref: 0444EDF6
Part of subcall function 0444EDD0: ReleaseDC.USER32(00000000,00000000), ref: 0444EE07

Strings

MS Shell Dlg 2, xrefs: 0444EEA4
Tahoma, xrefs: 0444EE5C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 0444EE90

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 16ea08bc71e10b418aa49972d45982e372da5c7a9861e3a368d35f978929d2ae
Instruction ID: d9b986513cc8e9e829be50d57efec72765a77b9f682f1eca9768b2e553e9bec4
Opcode Fuzzy Hash: 16ea08bc71e10b418aa49972d45982e372da5c7a9861e3a368d35f978929d2ae
Instruction Fuzzy Hash: D4118F70A00109EFFF11EFA5C85199EBBE5FB8AA09FB144A6E400A7741D775BE01CB10

Function 0436961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 04369653

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0b41ef86f9a6c23173570cee3173cb06537dc3df646871a0d349dad9d00b5eb3
Instruction ID: 845594844ac6703ce1316c493c83158d814e6d08c2d0957734d91fe83bd6760d
Opcode Fuzzy Hash: 0b41ef86f9a6c23173570cee3173cb06537dc3df646871a0d349dad9d00b5eb3
Instruction Fuzzy Hash: 9751BFB0600306DFFB20EF28D48475A7BE1AF09328F14E42AD90B8B249D774F885CB61

Function 0446E000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,0446E0D7), ref: 0446E02D

Part of subcall function 0436C520: InitializeCriticalSection.KERNEL32(0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C525
Part of subcall function 0436C520: GetVersion.KERNEL32(0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C533
Part of subcall function 0436C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C55A
Part of subcall function 0436C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0436C560
Part of subcall function 0436C520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C574
Part of subcall function 0436C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0436C57A
Part of subcall function 0436C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C58E
Part of subcall function 0436C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0436C594

Part of subcall function 0436EE84: GetSystemInfo.KERNEL32 ref: 0436EE88

GetCommandLineW.KERNEL32(00000400,00000000,0446E0D7), ref: 0446E092

Part of subcall function 04365244: GetStartupInfoW.KERNEL32 ref: 04365255

GetACP.KERNEL32(00000400,00000000,0446E0D7), ref: 0446E0A6
GetCurrentThreadId.KERNEL32 ref: 0446E0BA

Part of subcall function 0436EE98: GetVersion.KERNEL32(0446E0C9,00000400,00000000,0446E0D7), ref: 0436EE98

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: 18483dabb6daae1f9cfd6623039b005e767ca7dd2181706c22a9d420ea7ca212
Instruction ID: 5c0a7400d732aef754037860aa9f9c8f07eed0f3f73388247c33419eea6321d2
Opcode Fuzzy Hash: 18483dabb6daae1f9cfd6623039b005e767ca7dd2181706c22a9d420ea7ca212
Instruction Fuzzy Hash: 08115EB8400392EAFB01FF75B40D1053BA4FF0661CB51E829C1464A605DB7DA806CFB7

Function 0443915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,0443931F), ref: 044391D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,0443931F), ref: 0443924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 044392BC

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9c94832787736a4325eceae3f78d940c5911c8ebc86e4ced59dbb2620b4814ab
Instruction ID: 9ba8d4b372d651867c677f04551f1b1420b93982e2761b79de8dbbad0eba97a3
Opcode Fuzzy Hash: 9c94832787736a4325eceae3f78d940c5911c8ebc86e4ced59dbb2620b4814ab
Instruction Fuzzy Hash: 1951A270B00208BFEF11EBA5C841B9EB7FAAF4CB04F21846AA445E3351DA74BF059751

Function 04387884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,04387984), ref: 043878C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,04387967,?,00000000,?,00000000,04387984), ref: 04387902
VerQueryValueW.VERSION(?,04387998,?,?,00000000,?,00000000,?,00000000,04387967,?,00000000,?,00000000,04387984), ref: 0438791C

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: fc75f972adfde169cde710ae3cb6009d497833a5af6ed8eeb02484eb5fe0657f
Instruction ID: 07271dd75fbfbc1e119f6009324c0224f7dcfc8d8152aa21e7fd902e18a2b223
Opcode Fuzzy Hash: fc75f972adfde169cde710ae3cb6009d497833a5af6ed8eeb02484eb5fe0657f
Instruction Fuzzy Hash: 03314F71A0430AAFEB10EFA9CD81DAEB7F9EF49604B6154B9E844E3200D774ED00DB60

Function 0436D3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0436D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0436D566,00000000,?,00000105), ref: 0436D473
GetSystemDefaultUILanguage.KERNEL32(00000000,0436D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0436D566,00000000,?,00000105), ref: 0436D49B

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 7205fc9286f95cad413f8b6dfad43b835af30d0ec235f7de535aab2cfa8e1804
Instruction ID: d664616160f1ee8b3b29bc91fb1369f81bc5dd3aa12dc2f3e4758a99189f396c
Opcode Fuzzy Hash: 7205fc9286f95cad413f8b6dfad43b835af30d0ec235f7de535aab2cfa8e1804
Instruction Fuzzy Hash: C2312E70B1420A9BEF11EF98C880BAEB7B5EF49304F20E465D412A7658DB74BD40CB51

Function 0436D4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0436D5A6,?,04360000,0446FC1C), ref: 0436D528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0436D5A6,?,04360000,0446FC1C), ref: 0436D579

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 3f72077bd8c330c7381427d6148d3a5d85b782ae9d74da3add70474e9f1bf194
Instruction ID: fcd5343a00ad53456636741383db0099fc8ef2fa083759d78898a158b180d78b
Opcode Fuzzy Hash: 3f72077bd8c330c7381427d6148d3a5d85b782ae9d74da3add70474e9f1bf194
Instruction Fuzzy Hash: F6119170A4021EABEB10EB54DC85FDD73B9DF05308F5180B6E509A3284EB706F808E94

Function 04365600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,04365C17), ref: 04365617

Strings

@., xrefs: 04365652, 04365670

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: abbbeee9a876112c2f51c758ea488d224d0b90bc105611ae9275dead063b79a9
Instruction ID: 845d9d6e7442b6ce549a3bcde6adbe747350492395ffca0f44393431edd750a9
Opcode Fuzzy Hash: abbbeee9a876112c2f51c758ea488d224d0b90bc105611ae9275dead063b79a9
Instruction Fuzzy Hash: 8BF04FF2B003115FFB14AF78A9487427AE5EB49354F15827EE949DB788D7B89C028B90

Function 04438EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,04438F0C,?,?,00000000,04439123,00000000,00000000,00000000,?,?,00000000,04439139), ref: 04438EB1
RegCloseKey.ADVAPI32(00000000,?,04438F0C,?,?,00000000,04439123,00000000,00000000,00000000,?,?,00000000,04439139), ref: 04438EBA

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 2e58b0a35d07d2350c50b5028d4194b1fdc75d516a1b9ed0e2e4dd485edb2dab
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: A4D067E1A042099AEF61EE79C9C5B47BBDC6F08615B08D4A6AC58CF24AD638E4449B21

Function 04439EDC Relevance: 1.6, APIs: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,04439BB9), ref: 04439F07

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: dee24e677fab9670f65f46a16c9ea6d59e1963191bfe6fa46603cc8ddf04e968
Instruction ID: 0be307dd42a6f3b8fe3c1ebba2581fb85b03edebf06c080ab6f84abfbc0b7c37
Opcode Fuzzy Hash: dee24e677fab9670f65f46a16c9ea6d59e1963191bfe6fa46603cc8ddf04e968
Instruction Fuzzy Hash: 2E017576600208AFEB00EFA9DC80ADEB7ECDF49618F008166F914D7341D674AE0597A0

Function 044398DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,04439AE0,00000000,04439C1C), ref: 0443990D

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction ID: 32f291c7517caa7db8ab271c0045ac0dec8d62f36ee873e6ea898b18a510b512
Opcode Fuzzy Hash: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction Fuzzy Hash: 14F030623051046FF754FAAD9C80F6BA6DCDF8C615F10843EB28DC7241D964EC0983B1

Function 0436C278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(04360000,?,0000020A), ref: 0436C296

Part of subcall function 0436D4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0436D5A6,?,04360000,0446FC1C), ref: 0436D528
Part of subcall function 0436D4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0436D5A6,?,04360000,0446FC1C), ref: 0436D579

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: a6dfb1cff2ccc42dcff73e4f47b34e8800d89bdd2b150e3c312a6ff24adddf51
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 0EE0ED71A003119BDF10DF98D9C5A4637E8AF08658F0495A1AD65CF34AD771E9108BD1

Function 0436EE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0436EE88

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 95f704643eaf68c483f5bb7ebbb9c9dab31b1e3fc06de4f6849a19949e24aacd
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 5CA012104084011EC808A7185C4240F31801D4101CFC40720686D95281E605956506DB

Non-executed Functions

Function 0436CBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0437A5A8,?,?), ref: 0436CC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0436CC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0437A5A8,?,?), ref: 0436CD26
FindClose.KERNEL32(?,?,?,kernel32.dll,0437A5A8,?,?), ref: 0436CD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0437A5A8,?,?), ref: 0436CD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0437A5A8,?,?), ref: 0436CD89

Strings

kernel32.dll, xrefs: 0436CC10
\, xrefs: 0436CD56
GetLongPathNameW, xrefs: 0436CC20

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: f7e3dca9f8b25944c7c99ba1648df914f569ef27bea57a68b14f640eac860644
Instruction ID: 18a94caf5592b098f1754d477e1cbc5a4c624e4d94d560a60d684340d4108c72
Opcode Fuzzy Hash: f7e3dca9f8b25944c7c99ba1648df914f569ef27bea57a68b14f640eac860644
Instruction Fuzzy Hash: A541E531E0061A9BDB10EFA8CC84ADDB7B5AF44304F04F5B58586E7288E774BE41DB84

Function 0445ABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 0445ABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0445ABE7
SelectObject.GDI32(00000000,00000000), ref: 0445ABEE
CreateCompatibleDC.GDI32(?), ref: 0445AC22
CreateCompatibleDC.GDI32(?), ref: 0445AC2E
CreateCompatibleDC.GDI32(?), ref: 0445AC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0445AC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0445AC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0445AC6B
SelectObject.GDI32(?,?), ref: 0445AC7B
SelectObject.GDI32(?,?), ref: 0445AC8B
SelectObject.GDI32(?,?), ref: 0445AC9B
SetBkColor.GDI32(00000000,?), ref: 0445ACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0445ACCC
SetBkColor.GDI32(00000000,?), ref: 0445ACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 0445ACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0445AD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 0445AD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 0445AD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 0445AD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0445AD90
SelectObject.GDI32(?,?), ref: 0445AD9D
DeleteObject.GDI32(00000000), ref: 0445ADA3
SelectObject.GDI32(?,?), ref: 0445ADB0
DeleteObject.GDI32(00000000), ref: 0445ADB6
SelectObject.GDI32(?,?), ref: 0445ADC3
DeleteObject.GDI32(00000000), ref: 0445ADC9
SelectObject.GDI32(00000000,?), ref: 0445ADD3
DeleteObject.GDI32(00000000), ref: 0445ADD9
DeleteDC.GDI32(?), ref: 0445ADE2
DeleteDC.GDI32(?), ref: 0445ADEB
DeleteDC.GDI32(?), ref: 0445ADF4
DeleteDC.GDI32(00000000), ref: 0445ADFA

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: afeed509babeb9d6e23fc3d575a92ba4cbe982ca9a4bcef4abe8308a10035477
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 11816CB2E40219BBEB60EAE8CD85FDFBBBCAF09614F105414F644FB240C675AD109B65

Function 0438EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0438EFA5

Part of subcall function 0438EF70: GetProcAddress.KERNEL32(00000000), ref: 0438EF89

Strings

VarNot, xrefs: 0438EFDF
VarXor, xrefs: 0438F0A5
VarBoolFromStr, xrefs: 0438F13F
VarMul, xrefs: 0438F021
VariantChangeTypeEx, xrefs: 0438EFB3
VarR4FromStr, xrefs: 0438F0E7
VarI4FromStr, xrefs: 0438F0D1
oleaut32.dll, xrefs: 0438EFA0
VarAnd, xrefs: 0438F079
VarR8FromStr, xrefs: 0438F0FD
VarMod, xrefs: 0438F063
VarCmp, xrefs: 0438F0BB
VarIdiv, xrefs: 0438F04D
VarDateFromStr, xrefs: 0438F113
VarBstrFromCy, xrefs: 0438F155
VarNeg, xrefs: 0438EFC9
VarBstrFromDate, xrefs: 0438F16B
VarSub, xrefs: 0438F00B
VarOr, xrefs: 0438F08F
VarBstrFromBool, xrefs: 0438F181
VarCyFromStr, xrefs: 0438F129
VarAdd, xrefs: 0438EFF5
VarDiv, xrefs: 0438F037

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 710bf281e7f87eb7b91e0d68d81b59c9f7f09bd1c558f4c62a22d8dc9e4eb53d
Instruction ID: fbe153248e4385be4787e3d5bc4427fe06183be976ac8212415f7e8d6c37d2e1
Opcode Fuzzy Hash: 710bf281e7f87eb7b91e0d68d81b59c9f7f09bd1c558f4c62a22d8dc9e4eb53d
Instruction Fuzzy Hash: 6C4128ADA183495FB2047B6D7C02426F7D8EF46A1C361741EB414EB359DA38FC825B2D

Function 04445CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 04445D2F
SelectObject.GDI32(?,?), ref: 04445D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,04445DB4,?,?), ref: 04445D88
SelectObject.GDI32(?,?), ref: 04445DA2
DeleteObject.GDI32(?), ref: 04445DAE
CreateCompatibleDC.GDI32(00000000), ref: 04445DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 04445DE3
SelectObject.GDI32(?,?), ref: 04445DF8
SelectPalette.GDI32(?,04080E9D,00000000), ref: 04445E0C
SelectPalette.GDI32(?,?,00000000), ref: 04445E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 04445E33
SelectPalette.GDI32(?,04080E9D,000000FF), ref: 04445E49
RealizePalette.GDI32(?), ref: 04445E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 04445E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 04445E99
SetTextColor.GDI32(?,00000000), ref: 04445EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 04445EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 04445EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 04445F00
SetTextColor.GDI32(?,?), ref: 04445F0A
SetBkColor.GDI32(?,?), ref: 04445F14
SelectObject.GDI32(?,00000000), ref: 04445F27
DeleteObject.GDI32(?), ref: 04445F30
SelectPalette.GDI32(?,00000000,00000000), ref: 04445F52
DeleteDC.GDI32(?), ref: 04445F5B

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 8253b1ba40f854cd797ac9275c099d6b39166e015d9d39064e5e4c5526410be0
Instruction ID: 2533b6fed67bba134b1cfbe5d0d02b4db07d71d6aef2cc6645feffbb3f1d0449
Opcode Fuzzy Hash: 8253b1ba40f854cd797ac9275c099d6b39166e015d9d39064e5e4c5526410be0
Instruction Fuzzy Hash: F68170B2A00209BFEB50DEA8CD85EAFB7ECEF4D614F111555FA58E7240C639AD009B61

Function 0444B140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 0444B163
GetDC.USER32(00000000), ref: 0444B191
CreateCompatibleDC.GDI32(?), ref: 0444B1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0444B1BD
SelectObject.GDI32(?,00000000), ref: 0444B1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 0444B1F9
CreateCompatibleDC.GDI32(?), ref: 0444B207
SelectObject.GDI32(00000000,00000000), ref: 0444B24F
SelectPalette.GDI32(00000000,?,00000000), ref: 0444B262
RealizePalette.GDI32(00000000), ref: 0444B26B
SelectPalette.GDI32(?,?,00000000), ref: 0444B277
RealizePalette.GDI32(?), ref: 0444B280
SetBkColor.GDI32(00000000,00000000), ref: 0444B28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0444B2AE
SetBkColor.GDI32(00000000,00000000), ref: 0444B2B8
SelectObject.GDI32(00000000,00000000), ref: 0444B2CB
DeleteObject.GDI32(00000000), ref: 0444B2D7
DeleteDC.GDI32(00000000), ref: 0444B2ED
SelectObject.GDI32(?,00000000), ref: 0444B308
DeleteDC.GDI32(00000000), ref: 0444B324
ReleaseDC.USER32(00000000,00000000), ref: 0444B335

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 1ab76874e62f51d2a3af23d00875e6a90012c27419a7e65a8d3b35a5455e1742
Instruction ID: 0f78a67cc159bec279b08fe7babf334f51e53f3b237102354d906e504db6bc72
Opcode Fuzzy Hash: 1ab76874e62f51d2a3af23d00875e6a90012c27419a7e65a8d3b35a5455e1742
Instruction Fuzzy Hash: 4E510A72E00249BBEF20DAE98C55BAFB7BCEF49704F104456B654E7680DA78B940DB60

Function 0444C71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0444C9A4
CreateCompatibleDC.GDI32(00000001), ref: 0444CA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 0444CA1E
SelectObject.GDI32(?,00000000), ref: 0444CA28
SelectPalette.GDI32(?,?,00000000), ref: 0444CA58
RealizePalette.GDI32(?), ref: 0444CA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 0444CA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,0444CAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 0444CA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 0444CAC8
SelectObject.GDI32(?,?), ref: 0444CAD5
DeleteObject.GDI32(00000000), ref: 0444CADB

Strings

BM, xrefs: 0444C83D
(, xrefs: 0444C8D2

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: eb6c4e4cb18f14d382dc065ac4f727bdae3643a6867da281d1ef9667e187bf04
Instruction ID: cc1ad4123f5cbff0cfc82307dc4a7c819b7b4230fc07221fdafd033899cd5830
Opcode Fuzzy Hash: eb6c4e4cb18f14d382dc065ac4f727bdae3643a6867da281d1ef9667e187bf04
Instruction Fuzzy Hash: B6E16271A01218AFEF14DFA9C884BAEBBF5FF89304F158466E944E7395D734A840CB51

Function 0444B698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0444C31C: GetDC.USER32(00000000), ref: 0444C372
Part of subcall function 0444C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0444C387
Part of subcall function 0444C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0444C391
Part of subcall function 0444C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0444A7DB,00000000,0444A867), ref: 0444C3B5
Part of subcall function 0444C31C: ReleaseDC.USER32(00000000,00000000), ref: 0444C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 0444B6DB
RealizePalette.GDI32(?), ref: 0444B6EA
GetStretchBltMode.GDI32(00000000), ref: 0444B6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 0444B70D
GetDeviceCaps.GDI32(?,0000000E), ref: 0444B71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 0444B74F
SetStretchBltMode.GDI32(?,00000004), ref: 0444B75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 0444B775
SetStretchBltMode.GDI32(00000000,00000003), ref: 0444B792
CreateCompatibleDC.GDI32(00000000), ref: 0444B7F3
SelectObject.GDI32(?,?), ref: 0444B808
SelectObject.GDI32(?,00000000), ref: 0444B867
DeleteDC.GDI32(00000000), ref: 0444B876

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: afe9aa366fcf2f5c6d492b8e807370bd9bc7efa482d3df80ee7cecf557fd1c2b
Instruction ID: 688b22cef467d2b4e55ad35691ef5062150ec51686f3eb2fbc48d8709b94003f
Opcode Fuzzy Hash: afe9aa366fcf2f5c6d492b8e807370bd9bc7efa482d3df80ee7cecf557fd1c2b
Instruction Fuzzy Hash: 76A1F371A00245AFEB50EBA9C980F9EBBE8EF48204F105559FA45EB691D734FD40DB60

Function 04469470 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

BTMemoryLoadLibary: BuildImportTable failed, xrefs: 0446963C
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 044694FD
PE, xrefs: 044694EC
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 04469554
BTMemoryLoadLibary: Can't attach library, xrefs: 044696B4
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 044694B8
MZ, xrefs: 044694AB
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 04469689

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: f4e9b86c14b517185a4e13fb6166cfb536da5571136c8ec9b2a39971555d482e
Instruction ID: bfcb4eef354d871702873e3aaeec90e94c6db564d31e7c9d77ecd98e5235ae3e
Opcode Fuzzy Hash: f4e9b86c14b517185a4e13fb6166cfb536da5571136c8ec9b2a39971555d482e
Instruction Fuzzy Hash: 237182B1B04205AFFB14EFA9C881BAEB7E5EF89704F0484AAE505E7344D6B4FD058B51

Function 04445B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 04445B6F
CreateCompatibleDC.GDI32(00000000), ref: 04445B79
GetObjectW.GDI32(?,00000018,?), ref: 04445B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 04445BB0
GetDC.USER32(00000000), ref: 04445BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 04445BE9
ReleaseDC.USER32(00000000,00000000), ref: 04445C0F
SelectObject.GDI32(?,?), ref: 04445C2A
SelectObject.GDI32(?,00000000), ref: 04445C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 04445C65
SelectObject.GDI32(?,00000000), ref: 04445C73
SelectObject.GDI32(?,00000000), ref: 04445C81
DeleteDC.GDI32(?), ref: 04445C97
DeleteDC.GDI32(?), ref: 04445CA0

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: b473d5d79330d53d5a12aa48eb2e57419f7b8045587843fd3262883370bc5504
Instruction ID: f5b3995f044a9c504e24f6a745af39b6fbd6a766adc73c55eac9ea4d6dadb8a9
Opcode Fuzzy Hash: b473d5d79330d53d5a12aa48eb2e57419f7b8045587843fd3262883370bc5504
Instruction Fuzzy Hash: 1041C772E00209BFEF50EAE8C945FAFB7F8EF49704F500455FA14E7680D678A9409BA1

Function 0436C520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C525
GetVersion.KERNEL32(0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0436C560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0436C57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0447AC10,0446E037,00000400,00000000,0446E0D7), ref: 0436C58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0436C594

Strings

GetThreadUILanguage, xrefs: 0436C584
SetThreadPreferredUILanguages, xrefs: 0436C56A
GetThreadPreferredUILanguages, xrefs: 0436C550
kernel32.dll, xrefs: 0436C555, 0436C56F, 0436C589

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: c834d4c18f91cbf850805898191555cb7952b4b061107655b42a1a968138b802
Instruction ID: 74ea02714a2eea45e4c94403b34695392546bcac1dfb20e30c20d5b7d8e27178
Opcode Fuzzy Hash: c834d4c18f91cbf850805898191555cb7952b4b061107655b42a1a968138b802
Instruction Fuzzy Hash: 40F098E15843837BFE107772BD0591E2A86DE8550CB14F836E2A3A910DDEACB9858E19

Function 0444B964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0444C31C: GetDC.USER32(00000000), ref: 0444C372
Part of subcall function 0444C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0444C387
Part of subcall function 0444C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0444C391
Part of subcall function 0444C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0444A7DB,00000000,0444A867), ref: 0444C3B5
Part of subcall function 0444C31C: ReleaseDC.USER32(00000000,00000000), ref: 0444C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 0444B9A7
RealizePalette.GDI32(?), ref: 0444B9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 0444B9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 0444B9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 0444BA0A
SetStretchBltMode.GDI32(?,00000004), ref: 0444BA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 0444BA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 0444BA4D
CreateCompatibleDC.GDI32(00000000), ref: 0444BAAE
SelectObject.GDI32(?,?), ref: 0444BAC3
SelectObject.GDI32(?,00000000), ref: 0444BB22
DeleteDC.GDI32(00000000), ref: 0444BB31

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 2b2e6b47d249e736c43c55475bcd5e514de7e4d75186be88c97ee8706f582e95
Instruction ID: 4fd3d0952c8e28e8592de77f055bd5280a80cca735509e271179a8581702dc72
Opcode Fuzzy Hash: 2b2e6b47d249e736c43c55475bcd5e514de7e4d75186be88c97ee8706f582e95
Instruction Fuzzy Hash: 15913671A00285AFEB50EBA9C980F9EBBF8EF49204F105559FA45EB691D734FD40CB60

Function 0444D7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0444D0C0: DeleteObject.GDI32(00000000), ref: 0444D206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0444D865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 0444D8E3
GetIconInfo.USER32(00000000,?), ref: 0444D947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 0444D980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,0444DA2B), ref: 0444D9E9
DeleteObject.GDI32(?), ref: 0444D9FF
DeleteObject.GDI32(?), ref: 0444DA08

Strings

,, xrefs: 0444D86A
, xrefs: 0444D890

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: b3a79262f7f7cfa02462e44fb0a3205ba94f568b66a351d7e1c31a2af9cc8e39
Instruction ID: 9ad7dbc5e89b566d2237e6a77e68ce8e789d90fb5fdb0315014fe903d711f0fb
Opcode Fuzzy Hash: b3a79262f7f7cfa02462e44fb0a3205ba94f568b66a351d7e1c31a2af9cc8e39
Instruction Fuzzy Hash: 53911A71B00105AFEB10EFA9C884A9EBBF9FF88304F5041A9E519EB351DA30ED05CB91

Function 043853AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,04385691,?,?,?,?,00000000,00000000), ref: 043853D3
GetThreadLocale.KERNEL32(?,00000001,00000000,04385691,?,?,?,?,00000000,00000000), ref: 043853DC

Part of subcall function 04385380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,04385482,?,00000001,00000000,04385691), ref: 04385393

Part of subcall function 04385334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 04385352

Strings

AMPM, xrefs: 0438560A
mmmm d, yyyy, xrefs: 04385502
AMPM , xrefs: 04385619
:mm:ss, xrefs: 04385644
2, xrefs: 0438566D
m/d/yy, xrefs: 043854DD
:mm, xrefs: 04385629

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 214bb4b7fafe5bdb71918975b48b4d88cb348adff31790955019196dba603361
Instruction ID: f15d036c1e082784f4f3a6a6331b15c98f119d72a81ecc1c7779bb2be6157fe9
Opcode Fuzzy Hash: 214bb4b7fafe5bdb71918975b48b4d88cb348adff31790955019196dba603361
Instruction Fuzzy Hash: 7D714634700249ABFB01FBA4D880BDEF6AADF84308F94B069E501AF644D774FD068755

Function 04385DC8 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 04368850: GetTickCount.KERNEL32 ref: 04368887
Part of subcall function 04368850: GetTickCount.KERNEL32 ref: 0436889F

Part of subcall function 04385334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 04385352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 04385E60
EnumCalendarInfoW.KERNEL32(04385C8C,00000000,00000000,00000004), ref: 04385E6B
GetThreadLocale.KERNEL32(00000000,00000003,04385C8C,00000000,00000000,00000004), ref: 04385EA6
EnumCalendarInfoW.KERNEL32(04385D30,00000000,00000000,00000003,04385C8C,00000000,00000000,00000004), ref: 04385EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 04385F42
EnumCalendarInfoW.KERNEL32(04385C8C,00000000,00000000,00000004), ref: 04385F4D
GetThreadLocale.KERNEL32(00000000,00000003,04385C8C,00000000,00000000,00000004), ref: 04385F8A
EnumCalendarInfoW.KERNEL32(04385D30,00000000,00000000,00000003,04385C8C,00000000,00000000,00000004), ref: 04385F95

Strings

B.C., xrefs: 04385EF0

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: 6e5db85cd1002592ad42e71ce166abd01c57ebd5896b3d3cda06a0eb40a66f1e
Instruction ID: d6a86466ed4c9e702f7543882bf38380d8b1a65d2f59d9b671f9a9d88c54c280
Opcode Fuzzy Hash: 6e5db85cd1002592ad42e71ce166abd01c57ebd5896b3d3cda06a0eb40a66f1e
Instruction Fuzzy Hash: 4561B374A00346AFF711EF68D884AAAB7A9EF48718B10616DE901EB395C734FD46CB50

Function 04444AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04444778: EnterCriticalSection.KERNEL32(0447DE34,?,04444858,?,?,?,?,?,?,?,?,00000000,04444870,?,0447DE34), ref: 04444780
Part of subcall function 04444778: LeaveCriticalSection.KERNEL32(0447DE34,0447DE34,?,04444858,?,?,?,?,?,?,?,?,00000000,04444870,?,0447DE34), ref: 0444478D
Part of subcall function 04444778: EnterCriticalSection.KERNEL32(?,0447DE34,0447DE34,?,04444858,?,?,?,?,?,?,?,?,00000000,04444870), ref: 04444796

CreateCompatibleDC.GDI32(00000000), ref: 04444B64
SelectObject.GDI32(?,?), ref: 04444B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 04444C70
SetTextColor.GDI32(?,00000000), ref: 04444C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 04444C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 04444CC5
SetTextColor.GDI32(?,?), ref: 04444CD5
SetBkColor.GDI32(?,?), ref: 04444CE5
SelectObject.GDI32(?,00000000), ref: 04444D15
DeleteDC.GDI32(?), ref: 04444D1E

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: e51bba49ae8a5eafc9ab68bc95bba31fb16c34b92299ed9a45735408f69060ed
Instruction ID: 68c4f286558b3496422938ca9d7042b3a850cf487e168d9c1e2b3a992beac24b
Opcode Fuzzy Hash: e51bba49ae8a5eafc9ab68bc95bba31fb16c34b92299ed9a45735408f69060ed
Instruction Fuzzy Hash: EE91A1B5A00108AFEB50DFA9C980E9EB7F9EF4D204B144599F954EB721C634FD41DB60

Function 043685C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 043685DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 043685E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 043685F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 043685FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,04368676,?,00000000,?,GetLogicalProcessorInformation), ref: 0436862A

Strings

@, xrefs: 0436867D
kernel32.dll, xrefs: 043685D8
GetLogicalProcessorInformation, xrefs: 043685D3

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 0d3afeb4ee18ef988cad1d785cb9126d5bcddb1a1e4065f81b46d7f6de1e6e66
Instruction ID: 57138daecc684dfab808553d55c369826b42f604cf7d5a2cf0c098133d8cc09c
Opcode Fuzzy Hash: 0d3afeb4ee18ef988cad1d785cb9126d5bcddb1a1e4065f81b46d7f6de1e6e66
Instruction Fuzzy Hash: 0F118470D0120AAFFF14FFA4D905A9DB7F8EF08604F10E8A6D616D7148D674AA80CF51

Function 04370594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0437064C

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 554ffd5f41d7090f9edfd4bc90a9ba419c3c9016faa806f9a5ee24ad7f240359
Instruction ID: dbec9d86f897e3d783f66d99e4d768d2a0f4c4a3f2f7a9cb3a4f05808c456af0
Opcode Fuzzy Hash: 554ffd5f41d7090f9edfd4bc90a9ba419c3c9016faa806f9a5ee24ad7f240359
Instruction Fuzzy Hash: 91A19075A013499FEB28CFA8D8C0BAEBBF5FF48314F109119E545A7280D778B945CB50

Function 04468FA8 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,0446920D,?,00000000,?,00000000), ref: 0446902A
IsBadReadPtr.KERNEL32(?,00000014), ref: 044691DE

Strings

BuildImportTable: ReallocMemory failed, xrefs: 044690BC
BuildImportTable: GetProcAddress failed, xrefs: 044691B1
BuildImportTable: can't load library: , xrefs: 04469071

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: 67213af6ba8bfbbf472e5acadf342f80f83ba1970de2cb45af21e930b047c0bc
Instruction ID: 02ff1e0af8453bde1493b539cefa3e787b82feb14b33bac9a7ba94c182aeac0d
Opcode Fuzzy Hash: 67213af6ba8bfbbf472e5acadf342f80f83ba1970de2cb45af21e930b047c0bc
Instruction Fuzzy Hash: D1716FB0A00205AFEF14DB69CC84BEAB7F9EF89314F00846AE546DB254D7B4BD45CB52

Function 04390A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 04390AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 04390B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 04390B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 04390BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 04390BD8
VariantCopy.OLEAUT32(?), ref: 04390C0D

Strings

, xrefs: 04390A6E

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: 79b4a52d182da4868f214a24ba83a4427d2390ee01a8853ade41f6b468223105
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 5051F875A0062D9BDF66EF58CC80BDAB3FCAF49214F0051D9E649E7251D630AF848F61

Function 04449A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 04449AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 04449AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 04449AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 04449B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 04449B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 04449B43

Strings

`, xrefs: 04449A8B

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 85580796e5f6d06e2d2c2d3e64679314e7c428a25e5c12baeb180d1d3d1841c5
Instruction ID: f206fef04a0a9c4b89ccba80b3e6d29f3ab3489e3381576f63f5f981453b82bc
Opcode Fuzzy Hash: 85580796e5f6d06e2d2c2d3e64679314e7c428a25e5c12baeb180d1d3d1841c5
Instruction Fuzzy Hash: 7B41FBB5D00208AFEF50DFA9C881AAEB7F9EF48710F50855AE944EB241D734AD40DB65

Function 0436591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 043659D3
Sleep.KERNEL32(0000000A,00000000), ref: 043659E9
Sleep.KERNEL32(00000000), ref: 04365A17
Sleep.KERNEL32(0000000A,00000000), ref: 04365A2D

Strings

@., xrefs: 04365AB4, 04365AD6, 04365BEC, 04365C02

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: 82f53be9ada7c0f9be5ea4058cb643e7895b0c1f6a78ce77f18141dea64672de
Instruction ID: 173692870f4c9b42eba6abdf7d2240020d5bbdfc35840625066986c9397b88b1
Opcode Fuzzy Hash: 82f53be9ada7c0f9be5ea4058cb643e7895b0c1f6a78ce77f18141dea64672de
Instruction Fuzzy Hash: F1C134726016429FEB15DF68F888716BBE5EF85320F08C2BED4468B389C774E842C790

Function 04365CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 04365D36
Sleep.KERNEL32(0000000A,00000000,?), ref: 04365D50

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 36e9a36ea4d6388d6aa2673390b8f45eb2f2646a09365b1cff1ed8bc9d9c95dc
Instruction ID: 0ffccbbf0fce1b69fad73c57449ea09e7246c62ad4a0b3dc8a5370f8d864804c
Opcode Fuzzy Hash: 36e9a36ea4d6388d6aa2673390b8f45eb2f2646a09365b1cff1ed8bc9d9c95dc
Instruction Fuzzy Hash: 97710531604342AFE715DF28E988B16BBD4AF85314F18D2B9D8868B3DED7B4E841CB51

Function 043866A0 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 043864A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,04386654), ref: 043864DB
Part of subcall function 043864A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 043864FF
Part of subcall function 043864A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0438651A
Part of subcall function 043864A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 043865B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,043867C5), ref: 04386701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 04386734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 04386746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0438674C
GetStdHandle.KERNEL32(000000F4,043867E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 04386760
WriteFile.KERNEL32(00000000,000000F4,043867E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 04386766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 0438678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 043867A4

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: f55563ab0ea1dfd92011564ea46c11dfcb88baac1e5972d24440ecd5ac1a8ff8
Instruction ID: 17b350e3e8a64beafe4900383cd39d89b161f8e0244b1f767f4a6dce5a9e8b61
Opcode Fuzzy Hash: f55563ab0ea1dfd92011564ea46c11dfcb88baac1e5972d24440ecd5ac1a8ff8
Instruction Fuzzy Hash: F6316471644204BFFB10EAA4DC83FAAB3ACEF08714F505165BA45E61D0DEB47E40CBA5

Function 04446084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 044460B2
GetDeviceCaps.GDI32(?,00000068), ref: 044460CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 044460ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 04446111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 0444612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 04446143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 04446163
ReleaseDC.USER32(00000000,?), ref: 0444617B

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: f6b4795d3a8c2d7483b4e27e1ed507b77cf33f501f7a2b3d8334d28cd3c7e126
Instruction ID: 5ccd0178beeaecce7077a14993c8f111ea463a82dbae4bd0bca26534f6b8bcfb
Opcode Fuzzy Hash: f6b4795d3a8c2d7483b4e27e1ed507b77cf33f501f7a2b3d8334d28cd3c7e126
Instruction Fuzzy Hash: 4D217FB1A40208BBEB50DBA4CD81FAE72ACEF49709F514495FB44E61C0D678BE40EB20

Function 04365E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b92e75d2ea68f8f77ad763dafe479f8889c267761c01aa7a7d2e9065f6b8ea3
Instruction ID: a1284155649ec7ff26d176c061ef9ab9da3cb7a4bebb01ae2cb9975d732c9acf
Opcode Fuzzy Hash: 4b92e75d2ea68f8f77ad763dafe479f8889c267761c01aa7a7d2e9065f6b8ea3
Instruction Fuzzy Hash: DCC145727206026BE714AE7CEC8536EB6C69FC0325F68D63DE256CB38DDA74E8458350

Function 0445C798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0445C400: DeleteObject.GDI32(?), ref: 0445C40B
Part of subcall function 0445C400: DeleteDC.GDI32(?), ref: 0445C418
Part of subcall function 0445C400: DeleteObject.GDI32(?), ref: 0445C434

CreateCompatibleDC.GDI32(00000000), ref: 0445C903
CreateHalftonePalette.GDI32(?,00000000), ref: 0445C93E
ResizePalette.GDI32(?,00000001), ref: 0445C973
SelectPalette.GDI32(?,?,00000000), ref: 0445C998
RealizePalette.GDI32(?), ref: 0445C9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 0445C9CE
SelectObject.GDI32(?,00000000), ref: 0445C9E1

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: 1e90f9efb5682652efdcd073ddf8882f257e034590b9fe1eb1f5f0c086eaa649
Instruction ID: 6e2cfd129918d4204790ef8dc2fe023a92ad4a77d26ce4aefcbe2ca62630943f
Opcode Fuzzy Hash: 1e90f9efb5682652efdcd073ddf8882f257e034590b9fe1eb1f5f0c086eaa649
Instruction Fuzzy Hash: 207121752006219FEF44DB28C4D4F6637E5EF4A309F4541E6EA048F36ADA34F84ACB96

Function 04368850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 04368CDC: GetCurrentThreadId.KERNEL32 ref: 04368CDF

GetTickCount.KERNEL32 ref: 04368887
GetTickCount.KERNEL32 ref: 0436889F
GetCurrentThreadId.KERNEL32 ref: 043688CE
GetTickCount.KERNEL32 ref: 043688F9
GetTickCount.KERNEL32 ref: 04368930
GetTickCount.KERNEL32 ref: 0436895A
GetCurrentThreadId.KERNEL32 ref: 043689CA

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 9502cfce474bfdaee870cc7a426b36ed2cbabb4eefe43f1e11fc01d9851b0d3b
Instruction ID: 55f02a673da45622cba0a0ad45e3f32d0b8491ce952ad6e6de54c98cf103bc2c
Opcode Fuzzy Hash: 9502cfce474bfdaee870cc7a426b36ed2cbabb4eefe43f1e11fc01d9851b0d3b
Instruction Fuzzy Hash: 6D41833020A7439EE725FF3CC44431EBAD1AF89358F04D92DD4DA87289E675A480C753

Function 0444A090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 0444A0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 0444A0F9
GetDC.USER32(00000000), ref: 0444A110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,0444A1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 0444A134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,0444A1AB,?,?,00000000,00000000,00000008,?,00000000,0444A1CB), ref: 0444A167

Strings

`, xrefs: 0444A0C8

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: d3bfbfc00712969d3a3a1c214e8cc781c48ff69221f0de8a67c112ce09af9933
Instruction ID: e63569118b669c48ff924f2f71ae5d5bd0399d04711dbda7acbda4bcb388895e
Opcode Fuzzy Hash: d3bfbfc00712969d3a3a1c214e8cc781c48ff69221f0de8a67c112ce09af9933
Instruction Fuzzy Hash: 9D315075A40208ABEF10DFE4D881AAEB7B8EF48704F504456E904FB281D679AE00DBA5

Function 0444E9A8 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 0444E9B4
IsEqualGUID.OLE32(?,04472700), ref: 0444E9D5
IsEqualGUID.OLE32(?,04472710), ref: 0444E9EB

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Equal
String ID:
API String ID: 4016716531-0
Opcode ID: 696b9a9b280f2edcaa27f105a59ef26acda4c33f14e4bce8d02b6f1eff1b987a
Instruction ID: 6a7e76cac7ac56902dbf90d51a84e8fdab2d5cb78af8489b808bc417236787de
Opcode Fuzzy Hash: 696b9a9b280f2edcaa27f105a59ef26acda4c33f14e4bce8d02b6f1eff1b987a
Instruction Fuzzy Hash: E8115731104590DEFF61DA249D80BB7278DBF82248F5C5083ED446F3C2E395BD468BA5

Function 0444A974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 044462F0: GetObjectW.GDI32(00000000,00000004), ref: 04446307
Part of subcall function 044462F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 0444632A

GetDC.USER32(00000000), ref: 0444A9B2
CreateCompatibleDC.GDI32(?), ref: 0444A9BE
SelectObject.GDI32(?), ref: 0444A9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,0444AA23,?,?,?,?,00000000), ref: 0444A9EF
SelectObject.GDI32(?,?), ref: 0444AA09
DeleteDC.GDI32(?), ref: 0444AA12
ReleaseDC.USER32(00000000,?), ref: 0444AA1D

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: 1184bd0681bd8668c983b6ec4da30eea4e1e0f416aa825385a01a703af46b8a1
Instruction ID: a6848d9498bf0f7dc9704ce536c95acdf36868e464e9d46c6a86e958f25ad284
Opcode Fuzzy Hash: 1184bd0681bd8668c983b6ec4da30eea4e1e0f416aa825385a01a703af46b8a1
Instruction Fuzzy Hash: 62111273E44219BFEB10EBE8C851AAEF7BCEF49604F4044A5EA04F7640D674AA509B51

Function 043698D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0436998E,?,?,?,?,04369AA2,04366F13,04366F5A,?,?), ref: 04369909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0436998E,?,?,?,?,04369AA2,04366F13,04366F5A,?), ref: 0436990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0436998E,?,?,?), ref: 0436992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0436998E), ref: 04369930

Strings

Error, xrefs: 04369942
Runtime error at 00000000, xrefs: 04369902, 04369947

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 966bfdb9f26d03f488f6f6d23149648e37fccb233c3816c5ac98435dfa145f2a
Instruction ID: 87589a9caa39efcee2109b166206a4ff9408184e9a35a78b0a01a7625fd4e9c7
Opcode Fuzzy Hash: 966bfdb9f26d03f488f6f6d23149648e37fccb233c3816c5ac98435dfa145f2a
Instruction Fuzzy Hash: D7F068E1640342B9FA207FB47C0AF6A275C9F04A1CF14F516B356690CDD6B5B4898A62

Function 044465E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0444662E
GetSystemMetrics.USER32(0000000C), ref: 0444663A
GetDC.USER32(00000000), ref: 04446656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0444667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0444668A
ReleaseDC.USER32(00000000,00000000), ref: 044466C3

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 85c61ab472d5a30473353fc6aa015db68288724f3e30007ffa841695c775d5b1
Instruction ID: 4b7b39cd18a4ad14a770a1ff9d4238312ab841eee38a3b8f7ca0bdc80250b791
Opcode Fuzzy Hash: 85c61ab472d5a30473353fc6aa015db68288724f3e30007ffa841695c775d5b1
Instruction Fuzzy Hash: C2315074A00208EFFF10DFA4C981AAEBBB5FF89750F118565E914AB784D674A940CF61

Function 04446234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 04446252
SelectObject.GDI32(00000000,00000000), ref: 0444625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,0444C367), ref: 0444626F
SelectObject.GDI32(00000000,00000000), ref: 0444627B
DeleteDC.GDI32(00000000), ref: 04446281
CreatePalette.GDI32 ref: 044462DC

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 571d6240f30256287f05d32a7d56b597236302be5aac529e421f73f2eaa1340b
Instruction ID: 50e12adf6fca160fa5567a8087ad6e5b972613c5980424381ebebb28d5f9a0c6
Opcode Fuzzy Hash: 571d6240f30256287f05d32a7d56b597236302be5aac529e421f73f2eaa1340b
Instruction Fuzzy Hash: 6911A77120431032FB24B6659C41B6BB2A8DFC6719F01942EF989D7381E67CA8499392

Function 04446A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04446950: GetObjectW.GDI32(?,00000054), ref: 04446964

CreateCompatibleDC.GDI32(00000000), ref: 04446ABE
SelectPalette.GDI32(?,?,00000000), ref: 04446ADF
RealizePalette.GDI32(?), ref: 04446AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 04446B02
SelectPalette.GDI32(?,00000000,00000000), ref: 04446B2A
DeleteDC.GDI32(?), ref: 04446B33

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: dfdbd286aaceb53cfeea04888a42dc4959c979da34c3d280eb9be2b4ad39ceb5
Instruction ID: 6c62d62b0aad0bf3a6019d14ce7ac152213797d034ea01cd3127abc414cccedc
Opcode Fuzzy Hash: dfdbd286aaceb53cfeea04888a42dc4959c979da34c3d280eb9be2b4ad39ceb5
Instruction Fuzzy Hash: 08115176A046047FEB10DBA9CC91F9EBBFCEF49700F518065BA14E7280DA78A900CB61

Function 043661E4 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,04365358,00000000,?,00000000,?,?,00000000,04366B8F), ref: 04366206
WriteFile.KERNEL32(00000000,000000F4,04365358,00000000,?,00000000,?,?,00000000,04366B8F), ref: 0436620C
GetStdHandle.KERNEL32(000000F4,04365354,00000000,?,00000000,00000000,000000F4,04365358,00000000,?,00000000,?,?,00000000,04366B8F), ref: 0436622B
WriteFile.KERNEL32(00000000,000000F4,04365354,00000000,?,00000000,00000000,000000F4,04365358,00000000,?,00000000,?,?,00000000,04366B8F), ref: 04366231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,04365354,00000000,?,00000000,00000000,000000F4,04365358,00000000,?), ref: 04366248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,04365354,00000000,?,00000000,00000000,000000F4,04365358,00000000), ref: 0436624E

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 69ea58dbb6b00e2b1a8dff6a6de803123c96f848fd60c5b44d0883f9fc8ec1da
Instruction ID: 3a5d6a990a48c41cc0491eb6fdf91d591187a97dcb42896f78b83360ec15b006
Opcode Fuzzy Hash: 69ea58dbb6b00e2b1a8dff6a6de803123c96f848fd60c5b44d0883f9fc8ec1da
Instruction Fuzzy Hash: 5A0192A12482127EF650F7B9BC88F5F378CDF49669F10E721B25AE20C9C954BC449771

Function 043864A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,04386654), ref: 043864DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 043864FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0438651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 043865B5

Strings

MZP, xrefs: 04386519

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: cbd67bcd25df9a7d85c37a4a16cd938ccea68921fa1e847119926578239afead
Instruction ID: 7a03afe7757b584d970e74d64438528831b06909911c0572cbb15be2febbd50c
Opcode Fuzzy Hash: cbd67bcd25df9a7d85c37a4a16cd938ccea68921fa1e847119926578239afead
Instruction Fuzzy Hash: A0412AB0A003589FEB20EF68CD81BD9B7F9AF99304F4054E9E548E7244D776AE948F10

Function 0444D0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0444D17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 0444D189
ReleaseDC.USER32(00000000,00000000), ref: 0444D198
DeleteObject.GDI32(00000000), ref: 0444D206

Strings

(, xrefs: 0444D133

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 508e70f4e2681ee7c6ac23dc8cce3b75947980b12f78e6444f1132fdfbaf7a02
Instruction ID: 900a586a9995c13bbe4bb2767054b07bbb095f132286b698ee1e0b025705352d
Opcode Fuzzy Hash: 508e70f4e2681ee7c6ac23dc8cce3b75947980b12f78e6444f1132fdfbaf7a02
Instruction Fuzzy Hash: 71418EB0E04208AFFF10DBA4C884A9DFBB5FF89305F5480A6E805AB751D674AA45DB51

Function 0439690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e9b046b47e357d70cf5eba39aea8f6b8878c32102f06c605477e51a742381d
Instruction ID: 3b8dd381d058f7ad0c152bd243e2cb4f9bbad34ef128f46670c1d7c15dfb4028
Opcode Fuzzy Hash: f0e9b046b47e357d70cf5eba39aea8f6b8878c32102f06c605477e51a742381d
Instruction Fuzzy Hash: 89D19E35A01249AFDF00EFA4C4828EDFBF9EF49714F4464A6E841A7250E734BE46DB61

Function 04461CB0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 04461CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 04461D28
SelectObject.GDI32(?,?), ref: 04461D38
DeleteObject.GDI32(?), ref: 04461F51
DeleteDC.GDI32(?), ref: 04461F5D

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID:
API String ID: 2986811175-0
Opcode ID: 64637603967fc5e7254d0001bc60d412c0ac714a5f4c9c955b9db084ee21ed6f
Instruction ID: 59610b07df97214a4d9e0becfcd04eea03ad2c7959e6ec7a8ee36d71455c9b4f
Opcode Fuzzy Hash: 64637603967fc5e7254d0001bc60d412c0ac714a5f4c9c955b9db084ee21ed6f
Instruction Fuzzy Hash: E2B1A0B4E002099FDF44DFA9C984AAEBBF5FF48304F2081A6E815AB365D730AD41CB51

Function 04450894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 044508C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 044508F3
memcpy.MSVCRT(00000000,?,?), ref: 04450989
memcpy.MSVCRT(00000000,?,?), ref: 0445099F
memcpy.MSVCRT(00000000,?,?), ref: 044509B5
memcpy.MSVCRT(00000000,?,?), ref: 044509C9

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: c37fe8687f1d85a6cc0c16396de5f1a05f7cbf8d9c160fe2ae69fda329e210b1
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: E45170B1600600AFDF14DF69D8C5E9677A8BF88314F08866AED0D8F35AE731E954CB94

Function 04468B90 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,0446A2C1,?,?,?,?,?,00000000,00000000), ref: 04468C00
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,0446A2C1,?,?,?,?,?,00000000,00000000), ref: 04468C2F
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,0446A2C1,?,?,?,?,?,00000000,00000000), ref: 04468C3A
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,0446A2C1,?,?,?,?,?,00000000,00000000), ref: 04468C40
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,0446A2C1,?,?,?,?,?,00000000,00000000), ref: 04468C80

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: ca0df7278506564d0c6b1e946eb028f664a0d50b180114d4227ac47c3dd1d0a4
Instruction ID: 66bed1a43c5e43b2d85f14df00faee9043ccbc26912ce64aca81bef263774aff
Opcode Fuzzy Hash: ca0df7278506564d0c6b1e946eb028f664a0d50b180114d4227ac47c3dd1d0a4
Instruction Fuzzy Hash: 70316BB1202605AFEB20EF69CC84F27B3A8FF84714F14865AE956CB351C764F849C7A1

Function 0444C31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0444C372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0444C387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0444C391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0444A7DB,00000000,0444A867), ref: 0444C3B5
ReleaseDC.USER32(00000000,00000000), ref: 0444C3C0

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: b9f2eab95b069503e8fd6e55c9af8504bd128a962d7b7235522fd4e875a58472
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: 3711B932502299AEFF30AF75C4807AF3694AFC5355F091116FD409A2C0DBB9B9A1D7A1

Function 0444619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 044461B4
GetDeviceCaps.GDI32(?,00000068), ref: 044461D0
GetPaletteEntries.GDI32(04080E9D,00000000,00000008,?), ref: 044461E8
GetPaletteEntries.GDI32(04080E9D,00000008,00000008,?), ref: 04446200
ReleaseDC.USER32(00000000,?), ref: 0444621C

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: fbfdbd3dfcfc986d44d73a8a740d13a83ed9d7a3cd8046fc53d72981fb390a82
Instruction ID: e07b0538a87c65ec4c3cbb1e4b7ba4f279448c493c4e41a0efab0b14a7de651e
Opcode Fuzzy Hash: fbfdbd3dfcfc986d44d73a8a740d13a83ed9d7a3cd8046fc53d72981fb390a82
Instruction Fuzzy Hash: 9C112B7194C304BEFB11EBE4E841F6DBBA8FB49704F508496F644DA5C0DABE6404C720

Function 04383C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,04383D0B), ref: 04383CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,04383D0B), ref: 04383CB4

Strings

, xrefs: 04383C7A
yyyy, xrefs: 04383C89

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 246bbab18dcf14933355880b1caaa3c73c030251e745fe03c971c6397fc2f35f
Instruction ID: 08b777040221d368557ad7ff0ac9b3b3a23da7ac879360c4814ffe202aefd926
Opcode Fuzzy Hash: 246bbab18dcf14933355880b1caaa3c73c030251e745fe03c971c6397fc2f35f
Instruction Fuzzy Hash: D3218175A04619ABEB10FF94C881AADF3F8EF09B00F416069EC05E7344E634BE14C7A5

Function 04443ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 04443EF7
GetObjectW.GDI32(?,00000010,?), ref: 04443F0A
GetObjectW.GDI32(?,00000000,?), ref: 04443F63

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: c95e716c5b9afb1e0b09db9413ed2e3cc0ed85a042466ad0763747b1ecb1bbb9
Instruction ID: 2ef75fd48739c9c4aa47d19b94aaa242da4190b376e895bc88d49db1a23c1464
Opcode Fuzzy Hash: c95e716c5b9afb1e0b09db9413ed2e3cc0ed85a042466ad0763747b1ecb1bbb9
Instruction Fuzzy Hash: CC31AE71704744AFEB20DF69C980D6ABBF9EF89610B1484AAFD95DB741D230F800DB20

Function 0436C998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0436C9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0436CA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0436CA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0436CA97

Part of subcall function 0436C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0436CA15), ref: 0436C96B
Part of subcall function 0436C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0436CA15), ref: 0436C988

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 08d49b2c7752aed6f7bb6284e70036a348e5da7ecaaec51b30b61809e6cd0bf0
Instruction ID: f4442f3a3045ed7f6b125af2067c80990ab68b2c7963604caf48b16cbc362b4d
Opcode Fuzzy Hash: 08d49b2c7752aed6f7bb6284e70036a348e5da7ecaaec51b30b61809e6cd0bf0
Instruction Fuzzy Hash: 20316F70E0011BABEB10DFE8C884AAFB7F5FF04314F40A565D5A6E7285DB74AA05CB90

Function 0444A788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04444778: EnterCriticalSection.KERNEL32(0447DE34,?,04444858,?,?,?,?,?,?,?,?,00000000,04444870,?,0447DE34), ref: 04444780
Part of subcall function 04444778: LeaveCriticalSection.KERNEL32(0447DE34,0447DE34,?,04444858,?,?,?,?,?,?,?,?,00000000,04444870,?,0447DE34), ref: 0444478D
Part of subcall function 04444778: EnterCriticalSection.KERNEL32(?,0447DE34,0447DE34,?,04444858,?,?,?,?,?,?,?,?,00000000,04444870), ref: 04444796

Part of subcall function 0444C31C: GetDC.USER32(00000000), ref: 0444C372
Part of subcall function 0444C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0444C387
Part of subcall function 0444C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0444C391
Part of subcall function 0444C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0444A7DB,00000000,0444A867), ref: 0444C3B5
Part of subcall function 0444C31C: ReleaseDC.USER32(00000000,00000000), ref: 0444C3C0

CreateCompatibleDC.GDI32(00000000), ref: 0444A7DD
SelectObject.GDI32(00000000,?), ref: 0444A7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 0444A81F
RealizePalette.GDI32(00000000), ref: 0444A82B

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: f25f81c7b56ac9718203c5c3c1c2983bbbaf3d3c2cdea717c530bb2e7e193013
Instruction ID: 63469519d1d47ae60800bf2b892960f7f9d73efc25ec1b1afbfd82c2a4d888b8
Opcode Fuzzy Hash: f25f81c7b56ac9718203c5c3c1c2983bbbaf3d3c2cdea717c530bb2e7e193013
Instruction Fuzzy Hash: 57310C34A04A44EFEB14DF59C980D5DB7F5EF88724B6640A6E804AB362D734FE41EB50

Function 0444DF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 0444DFAD
GetObjectW.GDI32(?,00000018,?), ref: 0444DFCE
DeleteObject.GDI32(?), ref: 0444DFFA
DeleteObject.GDI32(?), ref: 0444E003

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 5c0bea55b6b38dfb12575c5fde07187bf89424217b03c02e30d7243bd077f4ca
Instruction ID: c63bcaa64b382a81c0d27d22566d456a2124bc8971967f03886fe21549f02b82
Opcode Fuzzy Hash: 5c0bea55b6b38dfb12575c5fde07187bf89424217b03c02e30d7243bd077f4ca
Instruction Fuzzy Hash: 20112175A00218AFEB14DFA9D981CAEF7F9FF88310B6484A6AD14D7750DB35EE00DA50

Function 0440A910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,0440A7FE,00000000,?), ref: 0440A927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,0440A7FE,00000000,?), ref: 0440A941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,0440A7FE,00000000,?), ref: 0440A95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,0440A7FE,00000000), ref: 0440A965

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: f18237762eae191929920ceb7a19136858b20a43e500f5286dbeb1770120e2c4
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 47F069B36046047F6B58EEADA880D6B77ECEF99164310412AFD08E7246DA34ED118379

Function 0444EDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0444EDD9
SelectObject.GDI32(00000000,058A00B4), ref: 0444EDEB
GetTextMetricsW.GDI32(00000000), ref: 0444EDF6
ReleaseDC.USER32(00000000,00000000), ref: 0444EE07

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: df1324d43c4a3ee688f178630044f3bde4c38ca3b815be0362db5fb7bc598468
Instruction ID: 3c488e149b8efffa12e6193df07d6035733fa4b2a82f4dfedcf584f1d9fe534b
Opcode Fuzzy Hash: df1324d43c4a3ee688f178630044f3bde4c38ca3b815be0362db5fb7bc598468
Instruction Fuzzy Hash: 1BE0866260657132F96161651D85BDB264CCF425E9F581151FD84D97C0EA09EE10D3F3

Function 0444EBA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 0444ECF4

Strings

,, xrefs: 0444EC6A
, xrefs: 0444EC8B

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: ff0c0a100229a0fc89933c6873d62dceb3096c0a85e6eb237105a811c5ae8392
Instruction ID: 33290e3be11f3fbb33a800e065199604c116541af1dae3b24b716f367fb423f8
Opcode Fuzzy Hash: ff0c0a100229a0fc89933c6873d62dceb3096c0a85e6eb237105a811c5ae8392
Instruction Fuzzy Hash: 1A51D1B4A00208AFEB40DF99D880E9EB7F9FF48314F5181A6E915DB761D735AE44CB10

Function 0444E3C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 0444E4B2

Strings

, xrefs: 0444E483
,, xrefs: 0444E468

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: 4c070abd6cf22073d5b50ec972454d149e24f288ae287a2299fafa3ad8c79ba6
Instruction ID: dd02b7a0da8d037826693463d4d4f9518db4cffc33d3a9e084a24e2670559f9b
Opcode Fuzzy Hash: 4c070abd6cf22073d5b50ec972454d149e24f288ae287a2299fafa3ad8c79ba6
Instruction Fuzzy Hash: 9B4133B1A00204AFEB40DF68C884A9A77F9FF49314B6251A5EC09EB316D771FD45CB90

Function 04468C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 04468CDD
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 04468D62

Strings

FinalizeSections: VirtualProtect failed, xrefs: 04468D70

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: c3f07bf99f3f2a4e8552f0e6db805f19187ec16016db10541e78a87c83718e3c
Instruction ID: 8064e6a433e8010cf6ea7ebc04e97e066943e36f33cd563dab2eb5ae82b04804
Opcode Fuzzy Hash: c3f07bf99f3f2a4e8552f0e6db805f19187ec16016db10541e78a87c83718e3c
Instruction Fuzzy Hash: D43117747022059FEB10EF5CC984F5AB7E8BF18384F144186EA56DB3A2C374F9418BA2

Function 04388748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,0438BB77,00000000,0438BCB7), ref: 04388707

Strings

Z, xrefs: 04388763
A, xrefs: 0438875E

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: 46a12440cb7ff23e6630851182f7841b24d799175317f3639d85155a8a905eb3
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 01115612745B111BF738747F5C817FAE68ADF862A4F89623EF646C72C0E804AC015291

Function 04449928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,044499F3), ref: 044499AB

Strings

l, xrefs: 04449959
EMF, xrefs: 0444994B

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: 6178f71b7bb1ce775a2cc364039edd3739786ba516c040573bec73230d3efca8
Instruction ID: ea61646c86fc7fa12364e2199ebfc4c74cb89ba7f0d8c37c6b9330e02d54c256
Opcode Fuzzy Hash: 6178f71b7bb1ce775a2cc364039edd3739786ba516c040573bec73230d3efca8
Instruction Fuzzy Hash: CF216871A00208DFEF10EFF8C891A6EB7B5FF89214F10816AE405AB749DA34BD01DB95

Function 043889EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0446E4DB,00000000,0446E512), ref: 043889F2

Part of subcall function 043739B0: GetProcAddress.KERNEL32(0439C998,?), ref: 043739DA

Strings

kernel32.dll, xrefs: 043889ED
GetDiskFreeSpaceExW, xrefs: 043889FD

Memory Dump Source

Source File: 0000001E.00000002.1961315375.0000000004361000.00000020.00000001.01000000.00000003.sdmp, Offset: 04360000, based on PE: true

Associated: 0000001E.00000002.1961298685.0000000004360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961397895.000000000446F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961415827.0000000004470000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961433202.0000000004471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961453112.0000000004475000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961469884.0000000004476000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961487469.000000000447F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961520207.0000000004480000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961537063.0000000004481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.1961552703.0000000004484000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_4360000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: db8fb5dffa198d44a8e112c559de248fff1b79271f5cef3d8658eb856b27620e
Instruction ID: f9e2b76c9bccd66bcb07febd896727a9b579b863d3af2825a42218883637e43f
Opcode Fuzzy Hash: db8fb5dffa198d44a8e112c559de248fff1b79271f5cef3d8658eb856b27620e
Instruction Fuzzy Hash: 15D05E606003428BF764BBB0B4C0B126A84EF00929B80312EE28155643C7BEBC089A82

Analysis Process: rundll32.exePID: 7464, Parent PID: 1456COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	222
Total number of Limit Nodes:	14

Executed Functions

Function 041DD2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,041DD3BC,?,?), ref: 041DD32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,041DD3BC,?,?), ref: 041DD337

Part of subcall function 041DD1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,041DD222,?,00000001), ref: 041DD1F7
Part of subcall function 041DD1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,041DD222,?,00000001), ref: 041DD207

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: b479476da793b90f338c953f71f6ac9fb61fa1cb3e973e3b6cf142f6cdb93d26
Instruction ID: 71c68170a9c12b5c87d635779f879f98f496fe8f66a8a8f83ba233d5aaec5ac7
Opcode Fuzzy Hash: b479476da793b90f338c953f71f6ac9fb61fa1cb3e973e3b6cf142f6cdb93d26
Instruction Fuzzy Hash: D11151F0A04219ABEF04EFA8D9C1AAEB3B9EF48308F504475E904E7340DB747E05CA65

Function 041DD1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,041DD222,?,00000001), ref: 041DD1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,041DD222,?,00000001), ref: 041DD207

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8ff3ba5d4f8d50f833b0376e6806d2e6790531872228958be50f07b06494c176
Instruction ID: 2a96d89e9b47193db638086573a5d979d2a9a6a354d6cf7631f0c0ebf30613c1
Opcode Fuzzy Hash: 8ff3ba5d4f8d50f833b0376e6806d2e6790531872228958be50f07b06494c176
Instruction Fuzzy Hash: 00F082F1550608AFEB20FFB4ECD1C9EB7FCEB4821479405A1A404E3190EB35BE009954

Function 041DCDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041DD00D,?,?), ref: 041DCE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041DD00D,?,?), ref: 041DCE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041DD00D,?,?), ref: 041DCE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 041DCEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 041DCEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 041DCEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 041DCF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,041DCFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041DD00D), ref: 041DCF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,041DCFF0,?,80000001), ref: 041DCF6F
RegCloseKey.ADVAPI32(?,041DCFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,041DCFF0,?,80000001,Software\Embarcadero\Locales), ref: 041DCFEA

Strings

Software\Embarcadero\Locales, xrefs: 041DCE60, 041DCE82
Software\Borland\Locales, xrefs: 041DCEDC
Software\Borland\Delphi\Locales, xrefs: 041DCEFA
Software\CodeGear\Locales, xrefs: 041DCEA0, 041DCEBE

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: cfb62123f0e94f37b3a213caae4916cb078e2d11929472969deeb796bd009209
Instruction ID: d523585795d1a0fdedafde7e08e630ba388625fea8171270a083e24fc855cc04
Opcode Fuzzy Hash: cfb62123f0e94f37b3a213caae4916cb078e2d11929472969deeb796bd009209
Instruction Fuzzy Hash: C75117F5B40209BEEB20DAA4DCC1FEEF7BCDB48708F504465B604E6181E771B944CA94

Function 041DCAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(042EAC10,00000000,041DCBB8,?,?,?,00000000,?,041DD480,00000000,041DD4DF,?,?,00000000,00000000,00000000), ref: 041DCAD2
LeaveCriticalSection.KERNEL32(042EAC10,042EAC10,00000000,041DCBB8,?,?,?,00000000,?,041DD480,00000000,041DD4DF,?,?,00000000,00000000), ref: 041DCAF6
LeaveCriticalSection.KERNEL32(042EAC10,042EAC10,00000000,041DCBB8,?,?,?,00000000,?,041DD480,00000000,041DD4DF,?,?,00000000,00000000), ref: 041DCB05
IsValidLocale.KERNEL32(00000000,00000002,042EAC10,042EAC10,00000000,041DCBB8,?,?,?,00000000,?,041DD480,00000000,041DD4DF), ref: 041DCB17
EnterCriticalSection.KERNEL32(042EAC10,00000000,00000002,042EAC10,042EAC10,00000000,041DCBB8,?,?,?,00000000,?,041DD480,00000000,041DD4DF), ref: 041DCB74
LeaveCriticalSection.KERNEL32(042EAC10,042EAC10,00000000,00000002,042EAC10,042EAC10,00000000,041DCBB8,?,?,?,00000000,?,041DD480,00000000,041DD4DF), ref: 041DCB9D

Strings

en-GB,en,en-US,, xrefs: 041DCAE2, 041DCB89

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 35491e7ab650d6e0f2853da1015ce97dc5808bffdc5c46ebc306d68a201a28b9
Instruction ID: 943b0328e6593e42ddc9044a012a79e52154f5be1a963fe8011ff5145e12c19e
Opcode Fuzzy Hash: 35491e7ab650d6e0f2853da1015ce97dc5808bffdc5c46ebc306d68a201a28b9
Instruction Fuzzy Hash: 7221A2E035064067FB10BBAA98D176E26999F95B48F915C61E04097244EFB4FC41C6EA

Function 041D961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 041D9653

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: bdf057c2af644d7a06a5140028faa52417bf52df01b84e6d5c4e4874def0375f
Instruction ID: 980a49a18841d6cf4b8b59e59a0d97df9306a92ce2ef6460e6181654fa54f880
Opcode Fuzzy Hash: bdf057c2af644d7a06a5140028faa52417bf52df01b84e6d5c4e4874def0375f
Instruction Fuzzy Hash: 65517FF16203049FEB24EF6DD4C876A7BE1EF49318F1485AAE8498B245D774F884CB61

Function 041F7884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,041F7984), ref: 041F78C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,041F7967,?,00000000,?,00000000,041F7984), ref: 041F7902
VerQueryValueW.VERSION(?,041F7998,?,?,00000000,?,00000000,?,00000000,041F7967,?,00000000,?,00000000,041F7984), ref: 041F791C

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: ad64131108cd33191ec0e4009530eaff02cd1de2102cb7df3f122bb5e32219ff
Instruction ID: 5a814d55aeda75b30a83e5309e05892b05b5d8e85d1407fffc50aeb9b08401f2
Opcode Fuzzy Hash: ad64131108cd33191ec0e4009530eaff02cd1de2102cb7df3f122bb5e32219ff
Instruction Fuzzy Hash: D23149B5A00209AFEB00DFA9CCC1DAEB7F8FB49614B9144B5E954E3640DB74EE01CB20

Function 041DD3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,041DD4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,041DD566,00000000,?,00000105), ref: 041DD473
GetSystemDefaultUILanguage.KERNEL32(00000000,041DD4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,041DD566,00000000,?,00000105), ref: 041DD49B

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 45fed28ca08959ae4662fa5ec14b23c7338631c5806adaf84ea1a269dc8b5873
Instruction ID: 569d0a853aceb616387e12f806279909d8d8687ad34cef6729c3d643d72605cc
Opcode Fuzzy Hash: 45fed28ca08959ae4662fa5ec14b23c7338631c5806adaf84ea1a269dc8b5873
Instruction Fuzzy Hash: E0311EF0A142199FEB10EFA8D8D0AAEB7F5EF48304F5084A5D404A7A50DBB4BD45CB91

Function 041DD4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041DD5A6,?,041D0000,042DFC1C), ref: 041DD528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,041DD5A6,?,041D0000,042DFC1C), ref: 041DD579

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 89a2629a09cfeb4d340e9266ce031f8c937aaddaae640a8414bcd67f89caea18
Instruction ID: bb2d6cd24b5a374adbf076e73ddf213e229cd3d742f0067d24bad1bca3f9628a
Opcode Fuzzy Hash: 89a2629a09cfeb4d340e9266ce031f8c937aaddaae640a8414bcd67f89caea18
Instruction Fuzzy Hash: 621151B0A4021CABEB20EB54DCC5BDE73B9DB08308F5141E5E508A3290EB746F858E95

Function 041D5600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,041D5C17), ref: 041D5617

Strings

@., xrefs: 041D5652, 041D5670

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: 3775ab1930d408594732592e07ec266b4c98894817b23a15eba797db823f3aa2
Instruction ID: 3f835f27847d089fd8e6f9f37a3f2cfd45472f4a101b80f74dbcd0a30f844f96
Opcode Fuzzy Hash: 3775ab1930d408594732592e07ec266b4c98894817b23a15eba797db823f3aa2
Instruction Fuzzy Hash: A8F08CF2B002005FE714AF7EA9447026AE5EB49358F10427EE988EF784EB749C009B80

Function 041DC278 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(041D0000,?,0000020A), ref: 041DC296

Part of subcall function 041DD4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041DD5A6,?,041D0000,042DFC1C), ref: 041DD528
Part of subcall function 041DD4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,041DD5A6,?,041D0000,042DFC1C), ref: 041DD579

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: 69f9f1059d988acb930b0797a082d3f6913d2af2ca87529788d58d0e4f99d859
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 05E0EDB1A003109BDB10DE98D9C5A4637D8AB08658F044A91AD14CF34AE771EA10C7D1

Non-executed Functions

Function 041DCBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,041EA5A8,?,?), ref: 041DCC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 041DCC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,041EA5A8,?,?), ref: 041DCD26
FindClose.KERNEL32(?,?,?,kernel32.dll,041EA5A8,?,?), ref: 041DCD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,041EA5A8,?,?), ref: 041DCD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,041EA5A8,?,?), ref: 041DCD89

Strings

GetLongPathNameW, xrefs: 041DCC20
\, xrefs: 041DCD56
kernel32.dll, xrefs: 041DCC10

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 4fc79272322e3da79829a825682d53cf4e1c494de7dbfd7f08e850634ab55121
Instruction ID: a343134d611f6c55316f8c58eba56cd0a75ce6b564e721e0fcb5337d12c89d4c
Opcode Fuzzy Hash: 4fc79272322e3da79829a825682d53cf4e1c494de7dbfd7f08e850634ab55121
Instruction Fuzzy Hash: 3D416FB1E00A189BDB10EEA8CCC4ADEB7B6AF84314F1489A5C505E7244FB74BE44DBC5

Function 041FEF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 041FEFA5

Part of subcall function 041FEF70: GetProcAddress.KERNEL32(00000000), ref: 041FEF89

Strings

VarBoolFromStr, xrefs: 041FF13F
VarSub, xrefs: 041FF00B
VarR4FromStr, xrefs: 041FF0E7
VarCyFromStr, xrefs: 041FF129
VarBstrFromCy, xrefs: 041FF155
VarAdd, xrefs: 041FEFF5
VarXor, xrefs: 041FF0A5
VarDiv, xrefs: 041FF037
VarBstrFromBool, xrefs: 041FF181
VariantChangeTypeEx, xrefs: 041FEFB3
VarMul, xrefs: 041FF021
VarR8FromStr, xrefs: 041FF0FD
VarAnd, xrefs: 041FF079
VarI4FromStr, xrefs: 041FF0D1
VarDateFromStr, xrefs: 041FF113
VarNot, xrefs: 041FEFDF
VarCmp, xrefs: 041FF0BB
VarNeg, xrefs: 041FEFC9
VarIdiv, xrefs: 041FF04D
VarMod, xrefs: 041FF063
VarBstrFromDate, xrefs: 041FF16B
VarOr, xrefs: 041FF08F
oleaut32.dll, xrefs: 041FEFA0

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 74ba9be1fdc7c95a0fd2b9fc86ba0225d7d5bc2ab440c1e80c355645ea0da6b7
Instruction ID: 3eb3bd213c78320bde9f4cdd3fd141e05cf08f5b6963d36f6fe31fc60792d070
Opcode Fuzzy Hash: 74ba9be1fdc7c95a0fd2b9fc86ba0225d7d5bc2ab440c1e80c355645ea0da6b7
Instruction Fuzzy Hash: 7141E96165830A5F7304ABAE7EC442A77DAEA45618360441BB708FF768DB74FC834B2D

Function 042D9470 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

PE, xrefs: 042D94EC
MZ, xrefs: 042D94AB
BTMemoryLoadLibary: Can't attach library, xrefs: 042D96B4
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 042D9554
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 042D9689
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 042D94B8
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 042D94FD
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 042D963C

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: fab44818a1f1d6f52a41cc7d6cd0fcd591187a16b9be8ecebc17591464f03c7b
Instruction ID: b3751bda0b4bcf83c849b0b1f4ec0ca8ba3cf75793a56a0e3483f57aaed33700
Opcode Fuzzy Hash: fab44818a1f1d6f52a41cc7d6cd0fcd591187a16b9be8ecebc17591464f03c7b
Instruction Fuzzy Hash: C471AEB1B14205AFEB14EFA9DC80BAEB7E9EF88704F0084A5F514E7280D674FD458B90

Function 041F53AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,041F5691,?,?,?,?,00000000,00000000), ref: 041F53D3
GetThreadLocale.KERNEL32(?,00000001,00000000,041F5691,?,?,?,?,00000000,00000000), ref: 041F53DC

Part of subcall function 041F5380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,041F5482,?,00000001,00000000,041F5691), ref: 041F5393

Part of subcall function 041F5334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 041F5352

Strings

:mm:ss, xrefs: 041F5644
AMPM, xrefs: 041F560A
2, xrefs: 041F566D
AMPM , xrefs: 041F5619
:mm, xrefs: 041F5629
m/d/yy, xrefs: 041F54DD
mmmm d, yyyy, xrefs: 041F5502

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 278f65c5436768e568ba2afd537949044b0461667d643ee149b59d33c4eeb921
Instruction ID: 3678941f7891052e004abe18c43c47aaade52a1cc00d24ecaeba6631982e65d6
Opcode Fuzzy Hash: 278f65c5436768e568ba2afd537949044b0461667d643ee149b59d33c4eeb921
Instruction Fuzzy Hash: 22714E70700549ABFB01EBA4CDC0ADE76ABEF88348F918161E604EB346DB35FA078755

Function 041F5DC8 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 041D8850: GetTickCount.KERNEL32 ref: 041D8887
Part of subcall function 041D8850: GetTickCount.KERNEL32 ref: 041D889F

Part of subcall function 041F5334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 041F5352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 041F5E60
EnumCalendarInfoW.KERNEL32(041F5C8C,00000000,00000000,00000004), ref: 041F5E6B
GetThreadLocale.KERNEL32(00000000,00000003,041F5C8C,00000000,00000000,00000004), ref: 041F5EA6
EnumCalendarInfoW.KERNEL32(041F5D30,00000000,00000000,00000003,041F5C8C,00000000,00000000,00000004), ref: 041F5EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 041F5F42
EnumCalendarInfoW.KERNEL32(041F5C8C,00000000,00000000,00000004), ref: 041F5F4D
GetThreadLocale.KERNEL32(00000000,00000003,041F5C8C,00000000,00000000,00000004), ref: 041F5F8A
EnumCalendarInfoW.KERNEL32(041F5D30,00000000,00000000,00000003,041F5C8C,00000000,00000000,00000004), ref: 041F5F95

Strings

B.C., xrefs: 041F5EF0

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: c6c1016e06667e497746e5f186cd58494783126f8ba471f4745b46b977fb6304
Instruction ID: 233cc35b9e2d1e76c1317e27bb481a210c076ff71a944bb6116d694703e2f5f1
Opcode Fuzzy Hash: c6c1016e06667e497746e5f186cd58494783126f8ba471f4745b46b977fb6304
Instruction Fuzzy Hash: 4961C275B00605AFF710EF6DDCC4AAA7BA6EF48714B1141A8EA15EB791C734BC428F90

Function 041D85C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 041D85DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041D85E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 041D85F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 041D85FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,041D8676,?,00000000,?,GetLogicalProcessorInformation), ref: 041D862A

Strings

@, xrefs: 041D867D
kernel32.dll, xrefs: 041D85D8
GetLogicalProcessorInformation, xrefs: 041D85D3

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 6efccc7f15b0397c861538d3c93ae4be06fb386f50c6787b4955df2bee706015
Instruction ID: 8e458b27b4457d40347dff5877805c723bdcbac389f147db866c357fbb2b1615
Opcode Fuzzy Hash: 6efccc7f15b0397c861538d3c93ae4be06fb386f50c6787b4955df2bee706015
Instruction Fuzzy Hash: 56117FF1D00208BFEF10FFA5CCC5A9DB7B5EB05628F1488E5D424A7541E778BA44CA51

Function 041E0594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 041E064C

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a7ba549fd67dee473970c8ec672976d19f70ae61f280bb05e0b27e141e28d32b
Instruction ID: 03932de5990d1951e3138f5e7b9b599666fa7965470b61f2d5915519a3267c37
Opcode Fuzzy Hash: a7ba549fd67dee473970c8ec672976d19f70ae61f280bb05e0b27e141e28d32b
Instruction Fuzzy Hash: 70A18C79E01619DFDB14CFA9D8C4BAEBBB5EF8C310F154129E915AB280D7B0B941CB50

Function 042D8FA8 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,042D920D,?,00000000,?,00000000), ref: 042D902A
IsBadReadPtr.KERNEL32(?,00000014), ref: 042D91DE

Strings

BuildImportTable: GetProcAddress failed, xrefs: 042D91B1
BuildImportTable: ReallocMemory failed, xrefs: 042D90BC
BuildImportTable: can't load library: , xrefs: 042D9071

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: 3523a71755763fb7e9fccb68b42b1fbf033ac2da9094825b8c3d1697dbaa93e0
Instruction ID: 7015862ae7edf370c6d4d225fd2cb466bbc3ea2fd76d5e8a421b254c263ee5a8
Opcode Fuzzy Hash: 3523a71755763fb7e9fccb68b42b1fbf033ac2da9094825b8c3d1697dbaa93e0
Instruction Fuzzy Hash: 14713DB1B10205AFEB10EB68CC85BAAB7F9EF89314F0484A4B555DB250D774FD85CB50

Function 04200A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 04200AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 04200B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 04200B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 04200BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 04200BD8
VariantCopy.OLEAUT32(?), ref: 04200C0D

Strings

, xrefs: 04200A6E

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: 9c9e07a02248a40d94a2d2f560d2ea7c50e692c3897430b4394280946212b10d
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 48510A75A1062D9BEB22DF58DC80BD9B3FCAF48304F0081D5E649E7296D634AF858F61

Function 041D591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 041D59D3
Sleep.KERNEL32(0000000A,00000000), ref: 041D59E9
Sleep.KERNEL32(00000000), ref: 041D5A17
Sleep.KERNEL32(0000000A,00000000), ref: 041D5A2D

Strings

@., xrefs: 041D5AB4, 041D5AD6, 041D5BEC, 041D5C02

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: 70f3c62d725a1a0d8cdb22b409e79960a82bd46cc2c8142a6c2b67892cb57eea
Instruction ID: 7e13dbf4e862439665b64caa4a103fb4eade33e34c18774f82fe60a4f2df2c08
Opcode Fuzzy Hash: 70f3c62d725a1a0d8cdb22b409e79960a82bd46cc2c8142a6c2b67892cb57eea
Instruction Fuzzy Hash: DFC125B27012119FD719DF6EE8C8316BBE2EF85321F1982ADD4998F385C774A841C794

Function 041D5CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,041D5912), ref: 041D5D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,041D5912), ref: 041D5D50

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f18ca403fbcbacc9f6ddc7757a5fff14471b72d26b409ec5af1f15d675fdd6ec
Instruction ID: 79ad40f6a12fb8d9da81aa9a1014e6244bd97186eab099882ea04e95befc7816
Opcode Fuzzy Hash: f18ca403fbcbacc9f6ddc7757a5fff14471b72d26b409ec5af1f15d675fdd6ec
Instruction Fuzzy Hash: 8A7125B2704700AFE715DF68D8C8B16BBD6EF85314F2882AED4858B391D774E885C761

Function 041F66A0 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 041F64A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,041F6654), ref: 041F64DB
Part of subcall function 041F64A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 041F64FF
Part of subcall function 041F64A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 041F651A
Part of subcall function 041F64A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 041F65B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,041F67C5), ref: 041F6701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041F6734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041F6746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041F674C
GetStdHandle.KERNEL32(000000F4,041F67E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 041F6760
WriteFile.KERNEL32(00000000,000000F4,041F67E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 041F6766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 041F678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 041F67A4

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: 4e31f30b7cddbfc54819861d461983a41a0e626feb739bd6eb0f31915f97f78e
Instruction ID: 518ce80b9e4f26ea10e84938b5de256ef5e0f91e75773e6b47d41751f4dc7c1e
Opcode Fuzzy Hash: 4e31f30b7cddbfc54819861d461983a41a0e626feb739bd6eb0f31915f97f78e
Instruction Fuzzy Hash: 0E31C4B5640608BFFB10EAA5DCC2FAA73ACEB04704F5041A1BA15E71C0DF747E818B64

Function 041D5E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fc9bf596f93ac1abdc3db91584dff2a0058315a607af07fd4af44379e65c79
Instruction ID: 52faf18caf3d2401a44b6e60c347f10f8708c3f87148c3140d70466b98494f38
Opcode Fuzzy Hash: 05fc9bf596f93ac1abdc3db91584dff2a0058315a607af07fd4af44379e65c79
Instruction Fuzzy Hash: 58C104E27102106BE718AA7DDCC476EB7879BC4326F58867EE254CF385EB74E8458350

Function 041D8850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 041D8CDC: GetCurrentThreadId.KERNEL32 ref: 041D8CDF

GetTickCount.KERNEL32 ref: 041D8887
GetTickCount.KERNEL32 ref: 041D889F
GetCurrentThreadId.KERNEL32 ref: 041D88CE
GetTickCount.KERNEL32 ref: 041D88F9
GetTickCount.KERNEL32 ref: 041D8930
GetTickCount.KERNEL32 ref: 041D895A
GetCurrentThreadId.KERNEL32 ref: 041D89CA

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: f5f914ed4183b0c320111c08d43937ee4088285cc0647bfc1cc0b1fdcbc37a83
Instruction ID: 299182e13f94102d839ffda826ce437d3c10e85e6bc58ab927e9cd0b443afa2f
Opcode Fuzzy Hash: f5f914ed4183b0c320111c08d43937ee4088285cc0647bfc1cc0b1fdcbc37a83
Instruction Fuzzy Hash: A0417DB12083419EE725FE3CC8C432EBAD1AFC5354F05896DD4E88B285EB75A484D753

Function 041D98D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041D998E,?,?,?,?,041D9AA2,041D6F13,041D6F5A,?,?), ref: 041D9909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041D998E,?,?,?,?,041D9AA2,041D6F13,041D6F5A,?), ref: 041D990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041D998E,?,?,?), ref: 041D992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041D998E), ref: 041D9930

Strings

Runtime error at 00000000, xrefs: 041D9902, 041D9947
Error, xrefs: 041D9942

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: f7ae4adc04a356f3174c3686dccc21e20abdcfa0c7ee15e6921175607a2d8c2e
Instruction ID: 3a7f361ddf2e7434dfad1d2235c1570affeac5a73e44bc8b55885a4d284c25d3
Opcode Fuzzy Hash: f7ae4adc04a356f3174c3686dccc21e20abdcfa0c7ee15e6921175607a2d8c2e
Instruction Fuzzy Hash: A2F0F6D1BA0340B9FB20BBB8EDCAF6A2B5C8704A1CF145505B3506E0C8C7A878808662

Function 041D61E4 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,041D5358,00000000,?,00000000,?,?,00000000,041D6B8F), ref: 041D6206
WriteFile.KERNEL32(00000000,000000F4,041D5358,00000000,?,00000000,?,?,00000000,041D6B8F), ref: 041D620C
GetStdHandle.KERNEL32(000000F4,041D5354,00000000,?,00000000,00000000,000000F4,041D5358,00000000,?,00000000,?,?,00000000,041D6B8F), ref: 041D622B
WriteFile.KERNEL32(00000000,000000F4,041D5354,00000000,?,00000000,00000000,000000F4,041D5358,00000000,?,00000000,?,?,00000000,041D6B8F), ref: 041D6231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,041D5354,00000000,?,00000000,00000000,000000F4,041D5358,00000000,?), ref: 041D6248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,041D5354,00000000,?,00000000,00000000,000000F4,041D5358,00000000), ref: 041D624E

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: db98321d6c8308ba7a60149829eeb0b3d288a5a47bf95126f61ddf118a42678e
Instruction ID: 95ba67024e87713772296b2e7d63063c0bf78d8f362bbe09bf8a392ded9972e3
Opcode Fuzzy Hash: db98321d6c8308ba7a60149829eeb0b3d288a5a47bf95126f61ddf118a42678e
Instruction Fuzzy Hash: 74014FE17882207DF650FAB8ACC8F6B3B8D9F4D669F104B11B218E60C1CB64BC448375

Function 041F64A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,041F6654), ref: 041F64DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 041F64FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 041F651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 041F65B5

Strings

MZP, xrefs: 041F6519

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 15e3e04525a54f580d04741677cd672cea5612d979400681c8ebd1b561d5ef7d
Instruction ID: dee0b9f57f6dbea06594f64066afbfcdca373ad7ee8aacda2f7a90799cff950f
Opcode Fuzzy Hash: 15e3e04525a54f580d04741677cd672cea5612d979400681c8ebd1b561d5ef7d
Instruction Fuzzy Hash: 73413DB0A002589FEB20EF69CDC0BD9B7F9AB59354F4044E5E608E7250D776BE968F10

Function 0420690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9251b23f7d2878eead16e5a8783ae3c1e0d73000b7c9842bd584e2ca02467009
Instruction ID: 58190c40135f3ee918ea9afbd2ed4545189fcb7bee4be0a7ecb192aa63079a79
Opcode Fuzzy Hash: 9251b23f7d2878eead16e5a8783ae3c1e0d73000b7c9842bd584e2ca02467009
Instruction Fuzzy Hash: A7D18F35B202499FDB00EF94C4809FDFBF9EF49714F4484A5E840A7292DB34BA66DB61

Function 042D8B90 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,042DA2C1,?,?,?,?,?,00000000,00000000), ref: 042D8C00
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,042DA2C1,?,?,?,?,?,00000000,00000000), ref: 042D8C2F
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,042DA2C1,?,?,?,?,?,00000000,00000000), ref: 042D8C3A
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,042DA2C1,?,?,?,?,?,00000000,00000000), ref: 042D8C40
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,042DA2C1,?,?,?,?,?,00000000,00000000), ref: 042D8C80

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: 42aca3790e332ab44d0fa6b6a17d463ad8292fd351c377455896040c8dfe4b42
Instruction ID: 02a7d7ce0fe3040ff61afdce6a80561250b78c37a6fc2a5cf47d11428d84a732
Opcode Fuzzy Hash: 42aca3790e332ab44d0fa6b6a17d463ad8292fd351c377455896040c8dfe4b42
Instruction Fuzzy Hash: CD316BB5301A0AAFE725EE69CC84F36B3A8FF84714F144658E965CB290C760F849C7A0

Function 041F3C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,041F3D0B), ref: 041F3CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,041F3D0B), ref: 041F3CB4

Strings

yyyy, xrefs: 041F3C89
, xrefs: 041F3C7A

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 72501760595be4b787f284d56567ea6b66ff8040066d797b1e39dcd6f4a14b40
Instruction ID: 9adb09c176d5a06d188cdef4634ac17c7a9646f4218121f1ec380984d79bd5ad
Opcode Fuzzy Hash: 72501760595be4b787f284d56567ea6b66ff8040066d797b1e39dcd6f4a14b40
Instruction Fuzzy Hash: E8216275A0061CABEB10EFA4C9C5AADB3F8EF09754F5140A6ED05E7240E734BE41C765

Function 041DC998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 041DC9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 041DCA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 041DCA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 041DCA97

Part of subcall function 041DC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,041DCA15), ref: 041DC96B
Part of subcall function 041DC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,041DCA15), ref: 041DC988

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 8804640980b26c705934949ab265ab770ef00676f27f00228286e01eb5c0bc97
Instruction ID: 8f2dae951854245499782b41868f74fd0e43eb0dcd5b2382d87df8d1d17dbcdb
Opcode Fuzzy Hash: 8804640980b26c705934949ab265ab770ef00676f27f00228286e01eb5c0bc97
Instruction Fuzzy Hash: 18314EB0E0011A9BDB10DFE9D8C4AAEB3B5FF44304F0055A5D569E7284FB74AA05CB90

Function 042D8C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 042D8CDD
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 042D8D62

Strings

FinalizeSections: VirtualProtect failed, xrefs: 042D8D70

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: db50efb6acad1b4b4d01d995b201da01453b192c3a058b26af20b995e78690a4
Instruction ID: cdaf3b66df0e9b63b103fc823e0c63d6738665bf8c1b80a0095c2e8917ecc708
Opcode Fuzzy Hash: db50efb6acad1b4b4d01d995b201da01453b192c3a058b26af20b995e78690a4
Instruction Fuzzy Hash: 1631D275721206AFE754EB68C984F69B7E8BF18784F144180EA66DB3A1C370F944CB90

Function 041F8748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,041FBB77,00000000,041FBCB7), ref: 041F8707

Strings

Z, xrefs: 041F8763
A, xrefs: 041F875E

Memory Dump Source

Source File: 00000020.00000002.1978155385.00000000041D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041D0000, based on PE: true

Associated: 00000020.00000002.1978137801.00000000041D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978234807.00000000042DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978253948.00000000042E0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978270945.00000000042E1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978289123.00000000042E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978312614.00000000042E6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978334260.00000000042EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978370800.00000000042F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978388241.00000000042F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1978405197.00000000042F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41d0000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: 858e65e2900969923f50259d97d4e2aa1828c51a2f95f1a3c1e1e120ea9a53cc
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 2D112612745E101BF724747F9CC57FE958ADB862A4F49073AE645C72C0EB64BC039291

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nCBC3f6tz1.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_9d3e772da6c0c3b2ba98571a98f1ccb5316d883_7522e4b5_b13a919c-48d8-47a8-ac20-04e70e997bbc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c66a12a3cf7201bf6f31cc259909e9e2c78f020_7522e4b5_7d002d39-5284-4d12-ae4d-a51d443037c3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_c66a12a3cf7201bf6f31cc259909e9e2c78f020_7522e4b5_8c7c462f-9bf7-41c5-b513-6f865a843684\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1905.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER19E1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A11.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4390.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43CE.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER445C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER448B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER449B.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44BA.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
nCBC3f6tz1.dll