Edit tour

Windows Analysis Report
y2WSfG9g8W.dll

Overview

General Information

Sample name:	y2WSfG9g8W.dll renamed because original name is a hash value
Original sample name:	05884233de3164cda3779ae210a035589963e511f799a9eb7cff84601d0904cb.dll
Analysis ID:	1544793
MD5:	a6a8702a8bd53d99580c6d411c513304
SHA1:	7a14e098d700e6e38bf9915b875ba6a3f4ea09e8
SHA256:	05884233de3164cda3779ae210a035589963e511f799a9eb7cff84601d0904cb
Tags:	2024bankerdllgolangloadermekotiouser-johnk3r
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7588 cmdline: loaddll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7652 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7676 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7756 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7660 cmdline: rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7888 cmdline: rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7944 cmdline: rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8000 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8008 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8016 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8024 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8040 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8056 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeResize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8076 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkePaint2 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8088 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeKillFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8100 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeIsDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8112 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeInitialize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8132 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeGetCaretRect MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8140 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseWheelEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8148 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8156 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyUpEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8172 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyPressEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8180 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyDownEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8188 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireContextMenuEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7212 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFinalize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7236 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeDestroyWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7280 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeCreateWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6496 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",dbkFCallWrapperAddr MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6132 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7328 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7340 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",TMethodImplementationIntercept MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 1412 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 6636 cmdline: rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarRecognize MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: y2WSfG9g8W.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: y2WSfG9g8W.dll

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: y2WSfG9g8W.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0040D1C4 FindFirstFileW,FindClose,	5_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041AD1C4 FindFirstFileW,FindClose,	32_2_041AD1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041ACBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_041ACBF8

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e0abdff3bd5dbbcc6e35e11a1c7aa362b1b4caa9_7522e4b5_791ed9c4-594e-4462-b830-7a8b482104f0\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2129def29827316c53fa9262167235f70c4ed97_7522e4b5_8e2d9f83-882f-46d0-afb1-35170efa58d3\

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_004EA1D8 GetClipboardData,CopyEnhMetaFileW,GetEnhMetaFileHeader,

5_2_004EA1D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_004EAA7C GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

5_2_004EAA7C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004F6444	5_2_004F6444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004F6704	5_2_004F6704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004E6918	5_2_004E6918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004B0F64	5_2_004B0F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004B10A8	5_2_004B10A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0043B4C4	5_2_0043B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004FFD00	5_2_004FFD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004EFE80	5_2_004EFE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004F1FC4	5_2_004F1FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004F5F80	5_2_004F5F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_04296444	32_2_04296444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_04296704	32_2_04296704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_04250F64	32_2_04250F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_04286918	32_2_04286918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041DB4C4	32_2_041DB4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_042510A8	32_2_042510A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_0429FD00	32_2_0429FD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_0428FE80	32_2_0428FE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_04295F80	32_2_04295F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_04291FC4	32_2_04291FC4

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 648

Source: y2WSfG9g8W.dll

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: y2WSfG9g8W.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal60.winDLL@63/13@2/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_004E5AA0 GetLastError,FormatMessageW,

5_2_004E5AA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_004219D8 GetDiskFreeSpaceW,

5_2_004219D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_004AA910 FindResourceW,LoadResource,SizeofResource,LockResource,

5_2_004AA910

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7340
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6496
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7676

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2f198e26-1f8b-4fdd-b950-c8de8d0b5f99

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarCreate

Source: y2WSfG9g8W.dll

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarCreate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 648
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarCreate
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeResize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkePaint2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeKillFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeIsDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeInitialize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeGetCaretRect
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseWheelEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyUpEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyPressEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyDownEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireContextMenuEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFinalize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeDestroyWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeCreateWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",TMethodImplementationIntercept
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarRecognize
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 648
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 640
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeResize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkePaint2	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeKillFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeIsDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeInitialize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeGetCaretRect	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseWheelEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyUpEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyPressEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyDownEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireContextMenuEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFinalize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeDestroyWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeCreateWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",dbkFCallWrapperAddr	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",__dbk_fcall_wrapper	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",TMethodImplementationIntercept	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarRecognize	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: y2WSfG9g8W.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: y2WSfG9g8W.dll

Static file information: File size 1270272 > 1048576

Source: y2WSfG9g8W.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10ca00

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_0050966C LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

5_2_0050966C

Source: y2WSfG9g8W.dll

Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0050E000 push 0050E0DEh; ret	5_2_0050E0D6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0050E47C push 0050E519h; ret	5_2_0050E511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00460068 push ecx; mov dword ptr [esp], edx	5_2_00460069
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00504014 push 0050403Ah; ret	5_2_00504032
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004380A4 push ecx; mov dword ptr [esp], eax	5_2_004380A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_005041A4 push 005041CAh; ret	5_2_005041C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00466248 push ecx; mov dword ptr [esp], ecx	5_2_0046624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00464264 push ecx; mov dword ptr [esp], ecx	5_2_00464268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0050A23C push 0050A2B0h; ret	5_2_0050A2A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004BE2E4 push ecx; mov dword ptr [esp], edx	5_2_004BE2E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004BA2F8 push ecx; mov dword ptr [esp], edx	5_2_004BA2FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004C42F4 push ecx; mov dword ptr [esp], edx	5_2_004C42F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004682FC push ecx; mov dword ptr [esp], ecx	5_2_00468300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004C0340 push ecx; mov dword ptr [esp], edx	5_2_004C0341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00502340 push 00502398h; ret	5_2_00502390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0043A3D0 push ecx; mov dword ptr [esp], eax	5_2_0043A3D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0050239C push ecx; mov dword ptr [esp], ecx	5_2_005023A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00464450 push ecx; mov dword ptr [esp], ecx	5_2_00464454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0050E540 push 0050E5F6h; ret	5_2_0050E5EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004C460C push ecx; mov dword ptr [esp], edx	5_2_004C460D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0050E610 push 0050E671h; ret	5_2_0050E669
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0050E740 push 0050E7DCh; ret	5_2_0050E7D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0046670C push ecx; mov dword ptr [esp], edx	5_2_0046670D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0046671C push ecx; mov dword ptr [esp], edx	5_2_0046671D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004827C4 push 00482826h; ret	5_2_0048281E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004648E4 push ecx; mov dword ptr [esp], eax	5_2_004648E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0042E970 push 0042EA60h; ret	5_2_0042EA58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_004C2A30 push ecx; mov dword ptr [esp], edx	5_2_004C2A31
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00468B60 push ecx; mov dword ptr [esp], edx	5_2_00468B61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00462CE0 push ecx; mov dword ptr [esp], ecx	5_2_00462CE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_00466CFC push ecx; mov dword ptr [esp], ecx	5_2_00466D00

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.5 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.6 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0040D1C4 FindFirstFileW,FindClose,	5_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041AD1C4 FindFirstFileW,FindClose,	32_2_041AD1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_041ACBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_041ACBF8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_0040EE84 GetSystemInfo,

5_2_0040EE84

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e0abdff3bd5dbbcc6e35e11a1c7aa362b1b4caa9_7522e4b5_791ed9c4-594e-4462-b830-7a8b482104f0\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2129def29827316c53fa9262167235f70c4ed97_7522e4b5_8e2d9f83-882f-46d0-afb1-35170efa58d3\

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_5-48073
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_32-47315

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_004B8000 IsDebuggerPresent,RaiseException,

5_2_004B8000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_0050966C LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

5_2_0050966C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00509C34 FreeLibrary,VirtualFree,GetProcessHeap,HeapFree,VirtualFree,

5_2_00509C34

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_004079E8 cpuid

5_2_004079E8

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	5_2_0040D2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_0040C79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	5_2_00428FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	5_2_0042920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	5_2_00425334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	5_2_00425380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	32_2_041AD2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	32_2_041AC79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_041C8FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	32_2_041C920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_041C5334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_041C5380

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_00423868 GetLocalTime,

5_2_00423868

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_0040C520 InitializeCriticalSection,GetVersion,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

5_2_0040C520

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
y2WSfG9g8W.dll	53%	ReversingLabs	Win32.Trojan.Midie
y2WSfG9g8W.dll	100%	Avira	TR/Redcap.sqgur

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
time.windows.com	unknown	unknown	false		unknown
206.23.85.13.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544793
Start date and time:	2024-10-29 18:51:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	y2WSfG9g8W.dll renamed because original name is a hash value
Original Sample Name:	05884233de3164cda3779ae210a035589963e511f799a9eb7cff84601d0904cb.dll
Detection:	MAL
Classification:	mal60.winDLL@63/13@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 34 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 13.89.179.12, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, twc.trafficmanager.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: y2WSfG9g8W.dll

Simulations

Behavior and APIs

Time	Type	Description
13:52:30	API Interceptor	1x Sleep call for process: loaddll32.exe modified
13:52:48	API Interceptor	3x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2129def29827316c53fa9262167235f70c4ed97_7522e4b5_8e2d9f83-882f-46d0-afb1-35170efa58d3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.864313241693838
Encrypted:	false
SSDEEP:	192:K9TVdiyOMLc0BU/wjeT/zuiFqZ24IO8dci:WLiTMLXBU/wjeLzuiFqY4IO8dci
MD5:	04A75087850BAA013E4DB09FB203682E
SHA1:	5FEA7B0C683FD73EFED403A3DD855BBBE73EC25E
SHA-256:	BE6DB3E271DF0347B1A94BCC844BD2A7692B3C5A9C61D3E3650B37C63CA0245C
SHA-512:	2560114743C4CEAEA66F2CD834F2DAF7666C844DA7DDAA144B838D65BEAFB2B5F61778977A9501FD2DF4F6936E1ABB7564DA4DE2293649265FE31A07597D7A4B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.7.9.5.1.9.1.3.5.0.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.7.9.5.2.5.5.4.1.3.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.2.d.9.f.8.3.-.8.8.2.f.-.4.6.d.0.-.a.f.b.1.-.3.5.1.7.0.e.f.a.5.8.d.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.8.0.4.e.3.8.-.9.f.6.a.-.4.2.b.f.-.a.5.e.2.-.f.7.d.e.e.d.9.9.7.2.5.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.c.-.0.0.0.1.-.0.0.1.4.-.7.a.0.e.-.f.7.5.2.2.b.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e0abdff3bd5dbbcc6e35e11a1c7aa362b1b4caa9_7522e4b5_791ed9c4-594e-4462-b830-7a8b482104f0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8701406812962393
Encrypted:	false
SSDEEP:	192:cflimxOvLG0BU/wjeT/zuiFqZ24IO84ci:SivvLtBU/wjeLzuiFqY4IO84ci
MD5:	8FCE4863D8965A5CEBF84091856FA5A2
SHA1:	7635C761A2DD915EC26DB1C22BA99F1EB96BFDA3
SHA-256:	8B1853CE94D2F21948C3270937F861642AC1B94497316F7AB2A5A310967C2919
SHA-512:	685038208B82E67072314A0D1F77544CBC222EB75358EBBA1ECC21EE3F2CC2324040BCC7FEAFA13BA1B9FF4504EEB5DF0FF31D767B2B2D1CDD02B9B60345D219
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.7.9.4.0.9.0.1.0.1.3.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.7.9.4.2.2.7.6.0.1.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.1.e.d.9.c.4.-.5.9.4.e.-.4.4.6.2.-.b.8.3.0.-.7.a.8.b.4.8.2.1.0.4.f.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.e.6.f.2.d.8.-.e.b.0.6.-.4.8.e.b.-.b.b.9.1.-.8.e.4.2.8.0.6.d.f.1.a.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.f.c.-.0.0.0.1.-.0.0.1.4.-.2.2.6.c.-.2.6.4.d.2.b.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e0abdff3bd5dbbcc6e35e11a1c7aa362b1b4caa9_7522e4b5_9c1f6d5c-8190-42b3-9ff4-ecf9ba67352f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8699705589341051
Encrypted:	false
SSDEEP:	192:KJ0iEOpLG0BU/wjeT/zuiFqZ24IO84ci:TiVpLtBU/wjeLzuiFqY4IO84ci
MD5:	68E41C4853807BAE49F772F075EF2D61
SHA1:	D21C0FA5307DDD116EAAF17DA4F55C970A918DFE
SHA-256:	1BD09B69E704FC138D611E57203D6E2B92ABFC8E305529AD8707ACFDF8D475BB
SHA-512:	1010073D5DE9AAD7527A3A754173D90467BF54F6393209B2B3CEC436D6FDC6B46F22DA0BE445C68EA6BBC283BA46A0A7F950C069D9710F3FB6B6D1CA5384337F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.7.9.5.1.9.3.4.5.0.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.7.9.5.2.6.0.6.3.6.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.1.f.6.d.5.c.-.8.1.9.0.-.4.2.b.3.-.9.f.f.4.-.e.c.f.9.b.a.6.7.3.5.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.e.a.1.0.d.8.e.-.0.2.5.8.-.4.c.1.8.-.9.f.8.a.-.6.6.1.2.2.d.a.9.7.f.6.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.0.-.0.0.0.1.-.0.0.1.4.-.6.7.3.f.-.e.3.5.2.2.b.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A59.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:52:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	44792
Entropy (8bit):	1.8902310175273376
Encrypted:	false
SSDEEP:	96:5l8wZTQV/6UyuVqs71ytgsSfq2w08XuS4J9oi75I4v4kGevt729A3ULg+4GG56bP:swru3+Si2YX/O5H4q33ULmq/5Ux2cRQ
MD5:	6EB54F33C666FEB649D99D817D0E76DB
SHA1:	93C3F47B18A26594B965446CAF81E0A05EDB0180
SHA-256:	E49958EC63AAEE86072924F691EE5ECA0B64B86E89BAEC0DB04FFCB8EF8C3B14
SHA-512:	255DA0185F5F50466A6073C2E760C922E7E9339DC485F3A6577A166E5994E27F59FDA4DC13B416553F4EC37E15CC5B7360AEBCD4B37CF4BFB489C4843D8C588C
Malicious:	false
Preview:	MDMP..a..... ........ !g.........................................)..........T.......8...........T............... .......................................................................................................eJ......,.......GenuineIntel............T............ !g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EA0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.692089746628308
Encrypted:	false
SSDEEP:	192:R6l7wVeJte6IUF6Y9e6ggmf8XHprB89b9Nsf8z/m:R6lXJk6IUF6Y06ggmf8XE9Gfd
MD5:	A3C77BF37027E8B2BD680AF4CE267F7E
SHA1:	CD09AE17ED16381017BE4E959426AFE381DE6DD2
SHA-256:	3A74A0FAE9E489C63081115F01ABFABBB9B0FDAEBAB363336BF636F708AFDBF0
SHA-512:	CC1D5399F6A031EAE1EA88D02C14DBC543D4DD23D4FB3BCB9A45B83EC2D514092284D8A96FCDECB087598BCA0992AD41F53B310CA709E70158E5D78BF6BDF4C6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EC0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.456441602979573
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9XsWpW8VYZYm8M4JCdPMQnFx+q8vjPMQNsGScSgd:uIjfsI7VF7VRJmrKtNsJ3gd
MD5:	F4D1728F70F4D1DB40D746609D3B50D9
SHA1:	9118196771AF58AE7CBDA919D2B0400335BEAD0C
SHA-256:	3E615D278E29C36E7D1B0B0AECEF90FA55F18170F753556637F8B8979B9B202F
SHA-512:	6A5C414C2BC46E5ECA6D5885DE9362685C57CE2AA75BAEDB2F7CEA20F3047ADFCCEA8CFA311FD5DDB63624DFB47A6B6308E36A2F2F96EDA850C4D02D79739426
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565015" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC513.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:52:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42692
Entropy (8bit):	2.022339155588813
Encrypted:	false
SSDEEP:	192:C/Tu3ji2YX9IfO5H4i377UfbqHsPh/IXx2exU:dtW5HV77sbqHsPhHea
MD5:	110920D1145D807E8D19FC59B6FE182A
SHA1:	D5B81EA3AFAA9F843E694AEDA4176C74EAD846F9
SHA-256:	ACD6DA7327F82413026D3CD1A20E90106318CB1FF51BB4A03E50EE448017DF98
SHA-512:	E76445E242E66879D290FE8E145B6949693A7D1EAF2B8177059C192AC6F7B3F98C396B2361A1A6785B66EE4549B0EE70797BF70BAFFF677F307E64F452F5EE51
Malicious:	false
Preview:	MDMP..a..... ........ !g....................................$....)..........T.......8...........T...............<.......................................................................................................eJ......,.......GenuineIntel............T............ !g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC551.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:52:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43980
Entropy (8bit):	1.9163657353732058
Encrypted:	false
SSDEEP:	192:Cw03u3KiIYXHkO5H4Uoe1HWDFW+32yHnJd:sRYr5H0wYFWs
MD5:	6CD15F8ECF12F8B48B6838AB35B4D6B5
SHA1:	82D4B726C2991A86A4407305DEDE1EBB6E7EDE24
SHA-256:	EB21AE0415E4165B8E9AE9BFE56F84E9ED369972FEA8AE4FFFEAEB280EE3C76D
SHA-512:	0FEE522B7DBF0491BBE40CB2A72F7454BFF4497632C32C6B2EA0E8DD2A6D24AE958337C3CDA9B9447E91221FAA22A709B5CD7F1F4D6B63CE09AF844855396BC2
Malicious:	false
Preview:	MDMP..a..... ........ !g.........................................)..........T.......8...........T...............D.......................................................................................................eJ......,.......GenuineIntel............T.......`.... !g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5FE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8282
Entropy (8bit):	3.694437401275697
Encrypted:	false
SSDEEP:	192:R6l7wVeJV16IUI6Ywh6NgmfTEHprp89bMgsfkBEm:R6lXJn6IUI6Ye6NgmfTEMMzfkX
MD5:	F8558234B679B2306C433549D4B7D8A4
SHA1:	64FB4D8CB70FF58FB04B64AB7810E0D57B8C026B
SHA-256:	F84BC224C9C0249D887D0BDADD9FD6406CF5B148E12E958D07F503DFB9122E8E
SHA-512:	A9EC1E3480E21607FB32EE69AC66CC3590CF3C5A8E6AB3F313AE0CACB71F2FBDE8997E044A24F84CCB6EE1258C26798844AA0741D8781B0821346C09523DB549
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC64C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8354
Entropy (8bit):	3.691466627197517
Encrypted:	false
SSDEEP:	192:R6l7wVeJwx6IUwXy6Yw66zgmf8XHpra89bMrsfBEm:R6lXJ26IUwXy6YF6zgmf8XpMwfX
MD5:	9165754CABF9CBAB2247623D780D3B88
SHA1:	D8B3CC28CCE1378A2BD80983BFAE2BDD0D15D45E
SHA-256:	11EDE2AB55AF5AA71A29ECDB015E0AF472B92F019E73729139191EC39B8ED4C2
SHA-512:	2B5CF1735003DA8633CCA3B50D440B40C4E82CE0EAB4780E51F786758BA20E332D2A19726245F95CB5345247F9397743FE01C206B7CF2C0E4A4340876D657863
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC65D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.46916182021601
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9XsWpW8VYfYm8M4JCdPMQFD+q8/qt3GScSZd:uIjfsI7VF7VnJszJ3Zd
MD5:	2114A214FB0A06AE70B08419BD762A8A
SHA1:	2947031ED8AB1B2D1D52E23EA0A8E56939987C9B
SHA-256:	95B0133AE031762F9BC0A2F1668CC5BD66B8F679DF5B7848E19D73CADD248656
SHA-512:	5F55809B058A540E845B7B7CA807EEFE8C898583B3E2541C9862C696F26C879E611D67CC8F52E6007609929F892D518761DC371038D021FBA808DD8CB6E861FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565015" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6BA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.455754455738042
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9XsWpW8VYRYm8M4JCdPMQnF9+q8vjPMQWpGScS26d:uIjfsI7VF7VhJmbKtsJ326d
MD5:	91E20A97BDFCEA0960D71AACC1AD3FC9
SHA1:	383628575B6C9D0FC839147A3B7CD395DFCA3469
SHA-256:	ED692D649DC3B70B4045BEE2CC1D9560AB324E431D63D2AAD496477FFEBB066E
SHA-512:	7AA6AE8DCEABCBFF552CA282A4962639D8219D3ED26F66B1AC5568553BB9180E82FBBA0080ABC1055A9D5C3DAA52C43276512547A0802669F13598213C4B7833
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565015" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417468044730204
Encrypted:	false
SSDEEP:	6144:xcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNo5+:Oi58oSWIZBk2MM6AFBWo
MD5:	D08380082EE6E39A76B24E2B1BF5F091
SHA1:	BD130F459338B3F6B4D1F71FE75E23F5586AB2DD
SHA-256:	7314498542FF1CECB6394F185502A5065A326CC0AD08D591DAABB6D68B7C7BFB
SHA-512:	5BE2991AB26AA985E49E9C82554C3231F64598F17BA5027B260BDF2783AC87436D25752DB2E03B212B889DFD949FD6B5318ACC99A6F78495E4D97BC13CEB9D44
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm&YbM+*................................................................................................................................................................................................................................................................................................................................................uy........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.648556572974388
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 95.46% Win32 EXE PECompact compressed (generic) (41571/9) 3.96% Win16/32 Executable Delphi generic (2074/23) 0.20% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19%
File name:	y2WSfG9g8W.dll
File size:	1'270'272 bytes
MD5:	a6a8702a8bd53d99580c6d411c513304
SHA1:	7a14e098d700e6e38bf9915b875ba6a3f4ea09e8
SHA256:	05884233de3164cda3779ae210a035589963e511f799a9eb7cff84601d0904cb
SHA512:	fcc3c83635575581fcf8a0af1f2ac4b0ba92620e23803424cee8da76cd90cad2c11c72dfe7aee08f46866ae3dd2b8d19cc37616f180f7290389b254559a2510f
SSDEEP:	24576:GG4DAx8F+hyEA681zAGMwA2DzfYTsVKh:osDhAxPM6DzATsVK
TLSH:	F7455C62F245A43EC4AA0A364973AD54583FB7A2755AEC1E57F4088CCE395802F3E74F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x50eec8
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x66F49512 [Wed Sep 25 22:56:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6327992c879b906e750778c69d550fed

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC0h
mov eax, 0050A310h
call 00007F90047F1185h
call 00007F90047EA5A0h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x122000	0x2a5	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11f000	0x1c46	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13d000	0x4600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x1850c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11f5a4	0x464	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x121000	0x366	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10c8e4	0x10ca00	67274dffe775253794233ceeec641ebf	False	0.3667876046998604	data	6.492465849835906	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x10e000	0xee0	0x1000	ba75b363c3102e56bdafd56dcb29717b	False	0.534423828125	data	6.065737583770974	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10f000	0x8f68	0x9000	e429e582c5cc12bfcee40c55f064ba85	False	0.6358235677083334	data	6.621568043770408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x118000	0x6324	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x11f000	0x1c46	0x1e00	bd166391d3b2991897d3f90ec0b419cb	False	0.32083333333333336	data	4.974350011480841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x121000	0x366	0x400	9c7b1e6fd492c18332b403fa3ad29c2e	False	0.3544921875	data	3.0967012674854977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x122000	0x2a5	0x400	87fe5abfbbb236084735fb5e3e0d7b1f	False	0.416015625	data	4.023005511195226	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x123000	0x44	0x200	c9f8bfa36b2dc5163b75d3196d251b45	False	0.15625	data	1.1660636886017055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0x1850c	0x18600	eae5fd1b79ba23a7e44d8d6892786cde	False	0.5805188301282052	data	6.710461663619879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x13d000	0x4600	0x4600	7d72f3cda30945a7a31daedf5b00ab73	False	0.27310267857142856	data	3.6858915450436784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x13d460	0x31c	DOS executable (COM, 0x8C-variant)			0.4258793969849246
RT_STRING	0x13d77c	0xb5c	data			0.2548143053645117
RT_STRING	0x13e2d8	0x428	data			0.37406015037593987
RT_STRING	0x13e700	0x3c4	data			0.37655601659751037
RT_STRING	0x13eac4	0x3cc	data			0.2757201646090535
RT_STRING	0x13ee90	0x394	data			0.4334061135371179
RT_STRING	0x13f224	0x4e4	data			0.35303514376996803
RT_STRING	0x13f708	0x374	data			0.3563348416289593
RT_STRING	0x13fa7c	0x454	data			0.38898916967509023
RT_STRING	0x13fed0	0x1ec	data			0.3983739837398374
RT_STRING	0x1400bc	0xc4	data			0.6428571428571429
RT_STRING	0x140180	0x170	data			0.5597826086956522
RT_STRING	0x1402f0	0x334	data			0.41585365853658535
RT_STRING	0x140624	0x408	data			0.3168604651162791
RT_STRING	0x140a2c	0x36c	data			0.4018264840182648
RT_STRING	0x140d98	0x2b8	data			0.4367816091954023
RT_RCDATA	0x141050	0x10	data			1.5
RT_RCDATA	0x141060	0x374	data			0.5961538461538461
RT_RCDATA	0x1413d4	0x2	data	English	United States	5.0
RT_VERSION	0x1413d8	0x1f4	data	English	United States	0.476

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc, FreeLibrary
user32.dll	ReleaseDC, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, LoadImageW, LoadIconW, GetSystemMetrics, GetSysColor, GetIconInfo, GetDC, GetClipboardData, FrameRect, FillRect, DrawTextExW, DrawIconEx, DrawFocusRect, DestroyIcon, CreateIcon, CopyIcon, CharUpperBuffW, CharUpperW, CharLowerBuffW
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, SetWinMetaFileBits, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, RoundRect, ResizePalette, Rectangle, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixel, GetPaletteEntries, GetObjectW, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutW, ExtFloodFill, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, Chord, BitBlt, ArcTo, Arc, AngleArc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReadFile, RaiseException, IsDebuggerPresent, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, IsBadReadPtr, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVersionExW, GetTickCount, GetThreadPriority, GetThreadLocale, GetStdHandle, GetProcessHeap, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateFileW, CreateEventW, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	CoCreateInstance, IsEqualGUID
msvcrt.dll	memset, memcpy

Exports

Name	Ordinal	Address
BarCreate	4	0x50a304
BarDestroy	5	0x50a300
BarFreeRec	6	0x50a2fc
BarRecognize	7	0x50a2f8
TMethodImplementationIntercept	3	0x45f330
__dbk_fcall_wrapper	2	0x41041c
dbkFCallWrapperAddr	1	0x51b630
wkeCreateWebView	13	0x50a2e0
wkeDestroyWebView	8	0x50a2f4
wkeFinalize	9	0x50a2f0
wkeFireContextMenuEvent	16	0x50a2d4
wkeFireKeyDownEvent	12	0x50a2e4
wkeFireKeyPressEvent	14	0x50a2dc
wkeFireKeyUpEvent	23	0x50a2b8
wkeFireMouseEvent	15	0x50a2d8
wkeFireMouseWheelEvent	17	0x50a2d0
wkeGetCaretRect	20	0x50a2c4
wkeInitialize	22	0x50a2bc
wkeIsDirty	21	0x50a2c0
wkeKillFocus	19	0x50a2c8
wkePaint2	24	0x50a2b4
wkeResize	11	0x50a2e8
wkeSetDirty	10	0x50a2ec
wkeSetFocus	18	0x50a2cc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 18:52:11.886198997 CET	62872	53	192.168.2.7	1.1.1.1
Oct 29, 2024 18:52:48.306982040 CET	53	60403	162.159.36.2	192.168.2.7
Oct 29, 2024 18:52:48.971415043 CET	52609	53	192.168.2.7	1.1.1.1
Oct 29, 2024 18:52:48.987734079 CET	53	52609	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 18:52:11.886198997 CET	192.168.2.7	1.1.1.1	0x726c	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 18:52:48.971415043 CET	192.168.2.7	1.1.1.1	0x722d	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 18:52:11.894695997 CET	1.1.1.1	192.168.2.7	0x726c	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 18:52:48.987734079 CET	1.1.1.1	192.168.2.7	0x722d	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	1
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll"
Imagebase:	0x440000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarCreate
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",#1
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 648
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:52:23
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarDestroy
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:52:26
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\y2WSfG9g8W.dll,BarFreeRec
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarCreate
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarDestroy
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarFreeRec
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetFocus
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeSetDirty
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeResize
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkePaint2
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeKillFocus
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeIsDirty
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeInitialize
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeGetCaretRect
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseWheelEvent
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireMouseEvent
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyUpEvent
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyPressEvent
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireKeyDownEvent
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFireContextMenuEvent
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeFinalize
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeDestroyWebView
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:52:30
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",wkeCreateWebView
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:52:30
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",dbkFCallWrapperAddr
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:52:30
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",__dbk_fcall_wrapper
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:52:30
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",TMethodImplementationIntercept
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:52:30
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\y2WSfG9g8W.dll",BarRecognize
Imagebase:	0x30000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:52:31
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 648
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:52:31
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 640
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.6%
Total number of Nodes:	332
Total number of Limit Nodes:	36

Executed Functions

Function 0040D2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D337

Part of subcall function 0040D1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
Part of subcall function 0040D1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction ID: 31cc6c2f53d714b9faa06a3b986118d36ba9187928ad3646f11bb52bdd509fcd
Opcode Fuzzy Hash: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction Fuzzy Hash: DD113670E042099BDF00EFA5D952AAEB3B4EF45304F50447EB904B73C2D7785E098669

Function 0040D1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction ID: f2706f95e4b90df003fff4208de2c5c05cd5cdeba3f5e8022b992bb7b9acb03d
Opcode Fuzzy Hash: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction Fuzzy Hash: 80F08271944608BEDB20FBB5DC5299EB7FCEB48314BA005BAB404F31D2EB389E14995D

Function 0040EE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040EE88

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 4e8efc271a9064b51e8e7fb51594f2112b3c6a5914667696f4d1ddbf71e3eb2d
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 72A012208088000EC408A7194C4350F31805941118FC40624785CA92C2E619896546EF

Function 0040CDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D00D,?,?), ref: 0040CE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040CEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040CEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040CEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040CF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D), ref: 0040CF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001), ref: 0040CF6F
RegCloseKey.ADVAPI32(?,0040CFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales), ref: 0040CFEA

Strings

Software\Borland\Delphi\Locales, xrefs: 0040CEFA
Software\Borland\Locales, xrefs: 0040CEDC
Software\CodeGear\Locales, xrefs: 0040CEA0, 0040CEBE
Software\Embarcadero\Locales, xrefs: 0040CE60, 0040CE82

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction ID: 80583e44c54d8f6c8431ac525ce0e8cce3f8a82ce7c118a8e5b64ed8406c3328
Opcode Fuzzy Hash: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction Fuzzy Hash: DC512675A40609BEEB20DBA5CC82FAFB7BCDB08704F504077BA04F61C1D6789D059A5D

Function 0040CAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000,00000000), ref: 0040CAD2
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CAF6
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CB05
IsValidLocale.KERNEL32(00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB17
EnterCriticalSection.KERNEL32(0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB74
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB9D

Strings

en-GB,en,en-US,, xrefs: 0040CAE2, 0040CB89

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction ID: dbd07ac227d82710da470fa0a9828874cbe6fbb8e5c29b4c0eb771d3e90eaa4c
Opcode Fuzzy Hash: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction Fuzzy Hash: 59214220740744D7EA12B77AA85376E36A4EB45718F50853BB000B72C2D9BD9D418ADF

Function 004EEE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 004EEE3A

Part of subcall function 004EEDD0: GetDC.USER32(00000000), ref: 004EEDD9
Part of subcall function 004EEDD0: SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
Part of subcall function 004EEDD0: GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
Part of subcall function 004EEDD0: ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 004EEE90
MS Shell Dlg 2, xrefs: 004EEEA4
Tahoma, xrefs: 004EEE5C

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: d2bcd2deef6eb559d64add552246956aa2ec45d3fe0922e4718ce2347d479668
Instruction ID: 9666196dba4feeb41e25a5e53062c5388affdd73144829a0af6ece6f2ecaceee
Opcode Fuzzy Hash: d2bcd2deef6eb559d64add552246956aa2ec45d3fe0922e4718ce2347d479668
Instruction Fuzzy Hash: 4911D030600149AFC711EF6BCC12A9E7BB5EB45705F90847BF400A7791DB39AD01CB18

Function 0040961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00409653

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction ID: 57d564f7514a768ac0d6b140dc1e0ae383663f7c9c7dd69698fd604fdf563357
Opcode Fuzzy Hash: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction Fuzzy Hash: FF516B706002449BDB25EF6AC88479B7BE1AF59314F14843FE809AA3D3D779DC88CB59

Function 0050E000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E02D

Part of subcall function 0040C520: InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
Part of subcall function 0040C520: GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Part of subcall function 0040EE84: GetSystemInfo.KERNEL32 ref: 0040EE88

GetCommandLineW.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E092

Part of subcall function 00405244: GetStartupInfoW.KERNEL32 ref: 00405255

GetACP.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E0A6
GetCurrentThreadId.KERNEL32 ref: 0050E0BA

Part of subcall function 0040EE98: GetVersion.KERNEL32(0050E0C9,00000400,00000000,0050E0D7), ref: 0040EE98

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction ID: b63630b870325ab19e945f9b7a74bc4420f07e9680e2ed97b13d29786ef075bf
Opcode Fuzzy Hash: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction Fuzzy Hash: 3411217040478889D720FF72AC1A2693AA4FB19308710C87ED1006A2E2DFBD540CEF6E

Function 004D915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D91D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004D92BC

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction ID: ad3af0877aad2f918cc60e01b05eab59aa261d8504b712c7e441bbb361f6d9d3
Opcode Fuzzy Hash: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction Fuzzy Hash: 87515431B00208BFDB11EBA5C852B9EB7FAAB48304F15446FB444E3382DA7D9F069759

Function 00427884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00427984), ref: 004278C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 00427902
VerQueryValueW.VERSION(?,00427998,?,?,00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 0042791C

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction ID: c637f2b1f86e41ba3c57f6c02bd3706f471a10e856d15e50b91235f572eefc7d
Opcode Fuzzy Hash: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction Fuzzy Hash: BC3141B5A04319AFEB00DFA9D881DAEB7F8EB48704B9144BAF544E3241D778DE40CB65

Function 004D9EDC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,004D9BB9), ref: 004D9F07

Strings

8DA, xrefs: 004D9F26

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: 8DA
API String ID: 3660427363-1089967677
Opcode ID: 4b8f109ffa458af5b80d3f600e29b6dd852a44268165187a87c0d92eeb6d53c5
Instruction ID: 5c6f9e54e9a39c42fa8f0f82047cbc0cda9d7a51aa0df00bfa0a0535877037b1
Opcode Fuzzy Hash: 4b8f109ffa458af5b80d3f600e29b6dd852a44268165187a87c0d92eeb6d53c5
Instruction Fuzzy Hash: 72015271600208AFDB00EFA9DC81ADAB7A89B59314F0081ABF914DB342DA759E0587A5

Function 0040D3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D473
GetSystemDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D49B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction ID: 914cf1b0947d833fcc03ff50d5076885400eec8b7426a2207ce03941fa5f7576
Opcode Fuzzy Hash: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction Fuzzy Hash: DB31EB30E142099BDB10EFA9C891BAEB7B5EF44304F50457BE400B72D2D778AD498A59

Function 0040D4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction ID: 258510d9c4dee0299c5f3f79c4fbca46c564eaaadbdb9c5c4e3057b0bb4fa4ad
Opcode Fuzzy Hash: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction Fuzzy Hash: 3F114F70E4461CABDB10EB94CC86BDE73B8DB04304F5144BAB508B72D1EA785F858A99

Function 00405600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00405C17), ref: 00405617

Strings

@., xrefs: 00405652, 00405670

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction ID: 7dac567e4a07de2f06f580edb35680116b9bdba5c2a0860377bbd693bdd19f0d
Opcode Fuzzy Hash: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction Fuzzy Hash: 49F0AFF2B003004FD7248F789D407A67AD4FB08324F10827FE908EB798DBB488048B84

Function 004D8EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EB1
RegCloseKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EBA

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 6f4c2654893a1a96a1da4be1dd0c350b83e18a7e628d6434c516513760379d46
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 40D067B1E042049ADF60EF7AC9C5A577BDC6F44315B08C4ABB808DF247DA3CD9409B28

Function 004D98DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,004D9AE0,00000000,004D9C1C), ref: 004D990D

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction ID: bf80709a24f295cc4fff76cdf4c79f612c8773d4563c6b2b62db8eae0a0485ee
Opcode Fuzzy Hash: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction Fuzzy Hash: 3CF01C623052046FD344FA6E9C81F6B66DC9B88754F10843FB248C7342D964DC058375

Function 0040C278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040C296

Part of subcall function 0040D4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
Part of subcall function 0040D4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: dd2aa8039920255b97d322d6193c29fca073ce87a4a4145dda77fc50cf625817
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 07E0ED71E003109BCB10DF98C9C5A4737D8AB08754F0446A6AD14DF387D775DD148BD5

Non-executed Functions

Function 004EAA7C Relevance: 48.5, APIs: 32, Instructions: 501windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EAAFC
GetDC.USER32(00000000), ref: 004EAB0D
CreateCompatibleDC.GDI32(00000000), ref: 004EAB1E
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EAB6A
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004EAB8E
SelectObject.GDI32(?,?), ref: 004EADE6
SelectPalette.GDI32(?,00000000,00000000), ref: 004EAE26
RealizePalette.GDI32(?), ref: 004EAE32
SetTextColor.GDI32(?,00000000), ref: 004EAE9B
SetBkColor.GDI32(?,00000000), ref: 004EAEB6
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,004EB046,?,00000000,004EB068,?,00000000,004EB079), ref: 004EAEFF
FillRect.USER32(?,00000000,00000000), ref: 004EAE83

Part of subcall function 004E32AC: GetSysColor.USER32(?), ref: 004E32B6

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 004EAF21
CreateCompatibleDC.GDI32(00000000), ref: 004EAF34
SelectObject.GDI32(004EB33B,00000000), ref: 004EAF57
SelectPalette.GDI32(004EB33B,00000000,00000000), ref: 004EAF73
RealizePalette.GDI32(004EB33B), ref: 004EAF7E
SetTextColor.GDI32(004EB33B,00000000), ref: 004EAF9C
SetBkColor.GDI32(004EB33B,00000000), ref: 004EAFB7
BitBlt.GDI32(?,00000000,00000000,?,?,004EB33B,00000000,00000000,00CC0020), ref: 004EAFDF
SelectPalette.GDI32(004EB33B,00000000,000000FF), ref: 004EAFF1
SelectObject.GDI32(004EB33B,00000000), ref: 004EAFFB
DeleteDC.GDI32(004EB33B), ref: 004EB016

Part of subcall function 004E45BC: EnterCriticalSection.KERNEL32(-00000008), ref: 004E45E4
Part of subcall function 004E45BC: CreateBrushIndirect.GDI32(?), ref: 004E4671
Part of subcall function 004E45BC: LeaveCriticalSection.KERNEL32(?,004E46A5,-00000008), ref: 004E4698

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapCriticalRealizeSectionText$BrushDeleteEnterFillIndirectLeaveRectTable
String ID:
API String ID: 3271313764-0
Opcode ID: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction ID: 35a244f6f23a8f79e02010a3497fee76c02ec5d27261e314751b2550eb949676
Opcode Fuzzy Hash: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction Fuzzy Hash: 47121975A00248AFDB10DFAAC885F9EB7B9EF08315F118456F914EB291C778EE80CB55

Function 0040C520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Strings

GetThreadUILanguage, xrefs: 0040C584
GetThreadPreferredUILanguages, xrefs: 0040C550
SetThreadPreferredUILanguages, xrefs: 0040C56A
kernel32.dll, xrefs: 0040C555, 0040C56F, 0040C589

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction ID: 8edfc10a46b7400df28ad4f2c85025a5e0675a444164cbed82ad90a550fe5e83
Opcode Fuzzy Hash: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction Fuzzy Hash: 15F05EB8951B10BADA023772AD8375F3680DA1070CB20853BB100790D2DEBC19549E9E

Function 004FFD00 Relevance: 20.0, APIs: 10, Strings: 1, Instructions: 742windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004FFE79
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 004FFEC0
DeleteObject.GDI32(00000000), ref: 004FFEDE
DeleteDC.GDI32(00000000), ref: 004FFEE7
SelectObject.GDI32(00000000,00000000), ref: 004FFF18
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FFF47
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 00500607
SelectObject.GDI32(00000000,?), ref: 00500614
DeleteObject.GDI32(00000000), ref: 0050061D
DeleteDC.GDI32(00000000), ref: 00500626

Strings

4iQ, xrefs: 004FFE65

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: DeleteObject$CreateSelect$CompatibleSection
String ID: 4iQ
API String ID: 1283611041-1953506770
Opcode ID: d88ef86889871988d5e71e62d76b397149d8a66913cfffddde6e2f80a1b06be6
Instruction ID: bbd11f52cafe743c80c27e34b82ef85a081ea8be75f910410bf9ba63da6902b7
Opcode Fuzzy Hash: d88ef86889871988d5e71e62d76b397149d8a66913cfffddde6e2f80a1b06be6
Instruction Fuzzy Hash: 27528D71E042598FCB15CFA9C881BEDBBF2FF45300F1481AAE458EB2D2C638A945DB14

Function 0040CBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041A5A8,?,?), ref: 0040CC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040CC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD26
FindClose.KERNEL32(?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD89

Strings

\, xrefs: 0040CD56
kernel32.dll, xrefs: 0040CC10
GetLongPathNameW, xrefs: 0040CC20

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction ID: 182d901b7ba620ca83dfe24b28ff924219823170be1df94bbfac5eeb8ceb1ef4
Opcode Fuzzy Hash: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction Fuzzy Hash: 73417F71A00618DBDB20EBA4CCC5ADEB3B5AF84314F1846BA9504F72C1E77CAE45CB49

Function 0050966C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,005098D1,?,00000000,?,00000000), ref: 005096EE
IsBadReadPtr.KERNEL32(?,00000014), ref: 005098A2

Strings

BuildImportTable: ReallocMemory failed, xrefs: 00509780
Q, xrefs: 00509730, 0050977B, 00509870
BuildImportTable: can't load library: , xrefs: 00509735
BuildImportTable: GetProcAddress failed, xrefs: 00509875

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library: $Q
API String ID: 1452896035-1248965296
Opcode ID: 01559eaaa8801a4c76319fc15976031d7c5f5988f30873b76c2286d17e4ea489
Instruction ID: fb7bc5540705faaedd16c405df7698f4fc3355a4a7c731ca0425fa0b9e15ce9f
Opcode Fuzzy Hash: 01559eaaa8801a4c76319fc15976031d7c5f5988f30873b76c2286d17e4ea489
Instruction Fuzzy Hash: 93715B70A00205AFDB10DB69C885BEEBBF8FF89314F04C4A9A159EB396D774AD458B50

Function 00509C34 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,00509289,?,?,?,?,?,00000000,00000000), ref: 00509CA4
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,00509289,?,?,?,?,?,00000000,00000000), ref: 00509CD3
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,00509289,?,?,?,?,?,00000000,00000000), ref: 00509CDE
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,00509289,?,?,?,?,?,00000000,00000000), ref: 00509CE4
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,00509289,?,?,?,?,?,00000000,00000000), ref: 00509D24

Strings

tQ, xrefs: 00509CE9, 00509D03, 00509D16

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID: tQ
API String ID: 565514093-3345606854
Opcode ID: be0b4dd357747022d74f58292e24bca961313a9b324bc1007752aac4eabd0e43
Instruction ID: 4f77cf3982fad7fe97f8d8cb6ceb5cb3145edca810983f6e52477420b9008134
Opcode Fuzzy Hash: be0b4dd357747022d74f58292e24bca961313a9b324bc1007752aac4eabd0e43
Instruction Fuzzy Hash: 1031BE71644609AFE320EF69CC85F6ABBE8FF88710F108259F454CB2A6C730EC4587A0

Function 004AA910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000), ref: 004AA965

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: cb9b2a388fffd021e353bf4cf2117ea65373932cb549638ab777629fd56d0805
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 96F062B26042047F5744EE5EA841D5B7BECDE5A264310011FF908D7207DA38ED51837D

Function 0040C79C Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C846
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C862
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C873

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction ID: 2a28b5b25d505860436f04a2e6c8396a795a98c7f85c76968f02c108a8d9c51a
Opcode Fuzzy Hash: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction Fuzzy Hash: BB319C71A0061CEBDB20EB55DC81BDE77B9EB44705F6042BAA508B32D0D6395E80DE59

Function 004EA1D8 Relevance: 4.6, APIs: 3, Instructions: 51fileclipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32(0000000E), ref: 004EA1E5
CopyEnhMetaFileW.GDI32(00000000,00000000), ref: 004EA207
GetEnhMetaFileHeader.GDI32(?,0000006C,?,00000000,00000000), ref: 004EA219

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID:
API String ID: 1752724394-0
Opcode ID: e226832609221db96ada4f46c4d3058b6830a4bc16416ec87d94a59a43ebb3d7
Instruction ID: 83af452c7468671752f20afbc5e4981f5782cdc598a28046f7ce867d400c4d25
Opcode Fuzzy Hash: e226832609221db96ada4f46c4d3058b6830a4bc16416ec87d94a59a43ebb3d7
Instruction Fuzzy Hash: BA113C726003449FC710DFAEC885A9AB7F8AF49315F10466EE509DB252DA74EC48CB95

Function 004EFE80 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 783COMMON

Download Yara Rule

Strings

jjj, xrefs: 004F0654

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: jjj
API String ID: 0-2289343631
Opcode ID: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction ID: 0e6e8520d3be3831dee58035f3478674022d586b9291955b557444e96a04ac11
Opcode Fuzzy Hash: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction Fuzzy Hash: CB723970600204CFDB29CF19D9C0B677BA2FB95315F14869AD9464F38BC738E856CB6A

Function 004F1FC4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 699COMMON

Download Yara Rule

Strings

9Q, xrefs: 004F22AF

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: 9Q
API String ID: 0-4141447236
Opcode ID: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction ID: 872c69647381f06e73c0189917d9e5469cc943f97499b4375cee1c22dc96545a
Opcode Fuzzy Hash: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction Fuzzy Hash: 40626D70900209DFDB19CF58C984BBEBBB1BF88304F15819ADD559B386C778D985CB89

Function 004B8000 Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(00000000,004B80BB), ref: 004B8032
RaiseException.KERNEL32(406D1388,00000000,00000004,00001000,00000000,004B808D,?,00000000,004B80BB), ref: 004B807E

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise
String ID:
API String ID: 1899633966-0
Opcode ID: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction ID: aa851b4e1d0f37632037c728c599de388d05abd6bc809da2430ac8adde4c7f7f
Opcode Fuzzy Hash: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction Fuzzy Hash: 7A11D671A14208AFD710EF65DC52ADEBBFCEB48704F61447BE500E3651EB785E04CA68

Function 004E5AA0 Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000,004EB33B,?,00000000,00000054,?,00000000,?), ref: 004E5AC0
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000), ref: 004E5AE6

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction ID: c91c4b4c8320e0c1e530085dddd9d5d25a400c360d6da16a75b1d286b8cd0c3b
Opcode Fuzzy Hash: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction Fuzzy Hash: 7401AC707147455FE721FB628D92F9977A8DB04709F5044BAF704E62C3EAB86D40891D

Function 004219D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 004219F9

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction ID: 0ac6486f21f903cb75f282dfc890b26380fbcd4d5ccfbab9b17402b0b1878633
Opcode Fuzzy Hash: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction Fuzzy Hash: 6011CCB5A00209AFDB04CF99C8819AFB7F9EFC8704B14C56AA509E7354E6319A41CBA4

Function 00425334 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction ID: 4ace5e9765896cc83d0c08b398fcb6cdb51b1f9deae2cd3a8e1490c56280457a
Opcode Fuzzy Hash: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction Fuzzy Hash: DEE0D87171071817D714A9599C86DFBB25CAB88340F4045BFBE05D7383EDB49E4446ED

Function 0042920C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00428FB4,00000002,?,?,0042958D,004257FD,?,00000000,0042583E,?,?,?,00000000,00000000), ref: 00429239

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction ID: 63fa091e9d080db82cecbc2cc5fa61dc70d90b6f989caf0edc4abe69f196ef62
Opcode Fuzzy Hash: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction Fuzzy Hash: A0E02662B415319BC120B7BA1E43B9A7A024F81BA4F08857BF498DF3C3EA6D0C0541FE

Function 00425380 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction ID: 9eed19484239e9ca95c0a1dfbed1db1bf7cda38a4e2fdab08b9ea4c2367ee6e5
Opcode Fuzzy Hash: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction Fuzzy Hash: 0BD05EA631922036E210915B7E45DBB5ADCDBC47B2F14483FBE48CA201D2A4CC059275

Function 00428FD0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,00429086,?,00000000,004291D3), ref: 00428FEB

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction ID: a303c1cb07ff97bfd8ef16a179b2a7490fc3f5062c6a27ca45c0f37d97ec2e54
Opcode Fuzzy Hash: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction Fuzzy Hash: F6D0A7E1B2420023E30426548C42B6722889B84704F10443C7784973C0EE7C591552BF

Function 00423868 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0042386C

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction ID: 8da0d5d7dce6a760fb6fb5968247694cf968f8d8edeffb1c78389c91dfcd4fca
Opcode Fuzzy Hash: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction Fuzzy Hash: 25A0125044582011814037190C0317570405840621FC40789B8F8403D1E91E026040D7

Function 004F6704 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F670A

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction ID: b43b3417401406a326c0658d495f7bfac22fcab4f87dfe3d4983a9788a7a34dd
Opcode Fuzzy Hash: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction Fuzzy Hash: 84814D77D105774BE7628E28C8043A17392AFDC39DF6B42B4ED04ABA42D536BD5386C0

Function 004F6444 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F644A

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction ID: 9cfbf6d39703a2f841c89ad7d8bc5bd644356b16f8883d5035a763e39ed3e34d
Opcode Fuzzy Hash: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction Fuzzy Hash: DB711877D204775BEB609E68C8043617392EF8925CF6B46B4DE04BBA42C636BD539AC0

Function 0043B4C4 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction ID: 0e1373ad738d05412743fbfe0b30fd2dda4791c2bd02ca1af8785a3d2d390580
Opcode Fuzzy Hash: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction Fuzzy Hash: 8702BE32910235DFDB96CF6AC040109B7B6FF8A72472A82D6D854AB229D370BE51DFD1

Function 004F5F80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction ID: 3b8a4b9bdbcbb050131b8f531c600d22b301e14a5b3c7c96b4b24d21a3266e97
Opcode Fuzzy Hash: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction Fuzzy Hash: 2871A53238978207E7288E7D9CE02B7EAD35FC531872EC97D95DAC3F42D979A4164248

Function 004B0F64 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: b7ad73d6065eefe40be1e3c61ddaa82719b5b59149f48ac65b38381fd691009e
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: F8418E31B002558BDB58EE2DC8D16A6B7A2AF94254B18C675DCA88F70BC938DD42C7A0

Function 004B10A8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: 9a75494c871b48b3840d49ff1b59f6b632724ee8b9803b4084a2a4f9b95828cd
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: 40419336A002559BDB48DE5DC8D1696B7A3BFC8314B19C675DCA88F70BC938DE02C7A0

Function 004E6918 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction ID: 2dc40e0aa77415d55bc0616e35fc77692ce9a422371aba29c42deb2143eb0115
Opcode Fuzzy Hash: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction Fuzzy Hash: EEE0016420010A8ED348BF38C1098A2B3E3EFECA1038BC4D0D44A9F23EF622C481C300

Function 004079E8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Function 004FABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 004FABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 004FABE7
SelectObject.GDI32(00000000,00000000), ref: 004FABEE
CreateCompatibleDC.GDI32(?), ref: 004FAC22
CreateCompatibleDC.GDI32(?), ref: 004FAC2E
CreateCompatibleDC.GDI32(?), ref: 004FAC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004FAC6B
SelectObject.GDI32(?,?), ref: 004FAC7B
SelectObject.GDI32(?,?), ref: 004FAC8B
SelectObject.GDI32(?,?), ref: 004FAC9B
SetBkColor.GDI32(00000000,?), ref: 004FACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 004FACCC
SetBkColor.GDI32(00000000,?), ref: 004FACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 004FACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FAD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 004FAD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 004FAD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 004FAD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004FAD90
SelectObject.GDI32(?,?), ref: 004FAD9D
DeleteObject.GDI32(00000000), ref: 004FADA3
SelectObject.GDI32(?,?), ref: 004FADB0
DeleteObject.GDI32(00000000), ref: 004FADB6
SelectObject.GDI32(?,?), ref: 004FADC3
DeleteObject.GDI32(00000000), ref: 004FADC9
SelectObject.GDI32(00000000,?), ref: 004FADD3
DeleteObject.GDI32(00000000), ref: 004FADD9
DeleteDC.GDI32(?), ref: 004FADE2
DeleteDC.GDI32(?), ref: 004FADEB
DeleteDC.GDI32(?), ref: 004FADF4
DeleteDC.GDI32(00000000), ref: 004FADFA

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: 825b2a03bc1370e51723bfade82acbff92c39003225e20d7aaefe19e3380dd92
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 82815BB2E40218BADB10DEE9CD85FDFBBBCAB09715F104459F604FB241D675AE408BA4

Function 0042EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0042EFA5

Part of subcall function 0042EF70: GetProcAddress.KERNEL32(00000000), ref: 0042EF89

Strings

VarIdiv, xrefs: 0042F04D
VarBstrFromCy, xrefs: 0042F155
VarDateFromStr, xrefs: 0042F113
VarI4FromStr, xrefs: 0042F0D1
VarCmp, xrefs: 0042F0BB
VarDiv, xrefs: 0042F037
VarMul, xrefs: 0042F021
VarNot, xrefs: 0042EFDF
VarOr, xrefs: 0042F08F
VariantChangeTypeEx, xrefs: 0042EFB3
VarR8FromStr, xrefs: 0042F0FD
VarMod, xrefs: 0042F063
VarBstrFromDate, xrefs: 0042F16B
VarR4FromStr, xrefs: 0042F0E7
VarAdd, xrefs: 0042EFF5
VarSub, xrefs: 0042F00B
VarBoolFromStr, xrefs: 0042F13F
oleaut32.dll, xrefs: 0042EFA0
VarNeg, xrefs: 0042EFC9
VarCyFromStr, xrefs: 0042F129
VarAnd, xrefs: 0042F079
VarXor, xrefs: 0042F0A5
VarBstrFromBool, xrefs: 0042F181

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction ID: 4d8a8b603ccf47e63391c59ab7cad31be334c78caf3acb6b5dd0fd78b8a56fbb
Opcode Fuzzy Hash: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction Fuzzy Hash: 15412761708239AA53046B6FBE0146677F8EA567103E1C4BBB404CBA69DB3CBC89573D

Function 004E5CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 004E5D2F
SelectObject.GDI32(?,?), ref: 004E5D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,004E5DB4,?,?), ref: 004E5D88
SelectObject.GDI32(?,?), ref: 004E5DA2
DeleteObject.GDI32(?), ref: 004E5DAE
CreateCompatibleDC.GDI32(00000000), ref: 004E5DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004E5DE3
SelectObject.GDI32(?,?), ref: 004E5DF8
SelectPalette.GDI32(?,03080E47,00000000), ref: 004E5E0C
SelectPalette.GDI32(?,?,00000000), ref: 004E5E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 004E5E33
SelectPalette.GDI32(?,03080E47,000000FF), ref: 004E5E49
RealizePalette.GDI32(?), ref: 004E5E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004E5E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 004E5E99
SetTextColor.GDI32(?,00000000), ref: 004E5EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 004E5EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 004E5EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 004E5F00
SetTextColor.GDI32(?,?), ref: 004E5F0A
SetBkColor.GDI32(?,?), ref: 004E5F14
SelectObject.GDI32(?,00000000), ref: 004E5F27
DeleteObject.GDI32(?), ref: 004E5F30
SelectPalette.GDI32(?,00000000,00000000), ref: 004E5F52
DeleteDC.GDI32(?), ref: 004E5F5B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 43d8b39ab4dd5ce79809afa6858bbd5f60031e559fdee60acb28460889f616a0
Instruction ID: 38fa64abe18cb97f8eb184acde96cdf6a208ad42503521d94ff01eaf164f0f81
Opcode Fuzzy Hash: 43d8b39ab4dd5ce79809afa6858bbd5f60031e559fdee60acb28460889f616a0
Instruction Fuzzy Hash: 938193B2A00209AFDB50DEA9CC85EEF7BEDAB0D715F100559F618E7240C238AE408B65

Function 004EB140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EB163
GetDC.USER32(00000000), ref: 004EB191
CreateCompatibleDC.GDI32(?), ref: 004EB1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EB1BD
SelectObject.GDI32(?,00000000), ref: 004EB1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 004EB1F9
CreateCompatibleDC.GDI32(?), ref: 004EB207
SelectObject.GDI32(00000000,00000000), ref: 004EB24F
SelectPalette.GDI32(00000000,?,00000000), ref: 004EB262
RealizePalette.GDI32(00000000), ref: 004EB26B
SelectPalette.GDI32(?,?,00000000), ref: 004EB277
RealizePalette.GDI32(?), ref: 004EB280
SetBkColor.GDI32(00000000,00000000), ref: 004EB28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 004EB2AE
SetBkColor.GDI32(00000000,00000000), ref: 004EB2B8
SelectObject.GDI32(00000000,00000000), ref: 004EB2CB
DeleteObject.GDI32(00000000), ref: 004EB2D7
DeleteDC.GDI32(00000000), ref: 004EB2ED
SelectObject.GDI32(?,00000000), ref: 004EB308
DeleteDC.GDI32(00000000), ref: 004EB324
ReleaseDC.USER32(00000000,00000000), ref: 004EB335

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction ID: a297371bd76699a261ad6334b1a26cfdb4486747052644e0b66a5fa1a439e62f
Opcode Fuzzy Hash: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction Fuzzy Hash: 1E51FF72E00355BBDB10DAEACC56FEFB7BCEF09705F10445AB614E7281D6789A408B94

Function 004EC71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC9A4
CreateCompatibleDC.GDI32(00000001), ref: 004ECA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 004ECA1E
SelectObject.GDI32(?,00000000), ref: 004ECA28
SelectPalette.GDI32(?,?,00000000), ref: 004ECA58
RealizePalette.GDI32(?), ref: 004ECA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 004ECA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,004ECAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 004ECA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 004ECAC8
SelectObject.GDI32(?,?), ref: 004ECAD5
DeleteObject.GDI32(00000000), ref: 004ECADB

Strings

BM, xrefs: 004EC83D
(, xrefs: 004EC8D2

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: fe5c773f6dbb4875201f718b38922d73bdbaab42a48235b57dca7878924f703b
Instruction ID: 9903c2d053803b45233f9d774669a7121d10f4085ead454fb22daa93f9b77526
Opcode Fuzzy Hash: fe5c773f6dbb4875201f718b38922d73bdbaab42a48235b57dca7878924f703b
Instruction Fuzzy Hash: C7E16E70A002589FDF04DFAAC885BAEBBF5FF49305F10856AF904A7391D7389941CB58

Function 004EB698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB6DB
RealizePalette.GDI32(?), ref: 004EB6EA
GetStretchBltMode.GDI32(00000000), ref: 004EB6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB70D
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB74F
SetStretchBltMode.GDI32(?,00000004), ref: 004EB75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB775
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EB792
CreateCompatibleDC.GDI32(00000000), ref: 004EB7F3
SelectObject.GDI32(?,?), ref: 004EB808
SelectObject.GDI32(?,00000000), ref: 004EB867
DeleteDC.GDI32(00000000), ref: 004EB876

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction ID: 489584e9c4cd725b990482e09af51c0bca80148c9d3d35cd6fb0d49a7a8e8351
Opcode Fuzzy Hash: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction Fuzzy Hash: 76A1D8B1600245AFDB40EFAAC985F9AB7E8EF08305F504559F605E7652D738ED40CBA4

Function 00509D34 Relevance: 22.7, APIs: 6, Strings: 9, Instructions: 217COMMON

Download Yara Rule

Strings

BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 00509E18
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 00509DC1
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 00509F4D
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 00509F00
Q, xrefs: 00509D77, 00509DBC, 00509E13, 00509EFB, 00509F0A, 00509F48, 00509F73
BTMemoryLoadLibary: Can't attach library, xrefs: 00509F78
PE, xrefs: 00509DB0
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 00509D7C
MZ, xrefs: 00509D6F

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE$Q
API String ID: 0-1835101375
Opcode ID: 6957516c5df4c619fce75700ef52506794ff2a224b8cd7d06f7dbbd6cd8a7574
Instruction ID: 2e8c3570bd896ee15ab6461b15f5d717bf2d0437d50860efccbcfebe01a04e7b
Opcode Fuzzy Hash: 6957516c5df4c619fce75700ef52506794ff2a224b8cd7d06f7dbbd6cd8a7574
Instruction Fuzzy Hash: BC71BE71B08206AFDB10EF69DC81BAEBBF9FB88300F0484A9F514E7686D674DD448B55

Function 004E5B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E5B6F
CreateCompatibleDC.GDI32(00000000), ref: 004E5B79
GetObjectW.GDI32(?,00000018,?), ref: 004E5B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004E5BB0
GetDC.USER32(00000000), ref: 004E5BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004E5BE9
ReleaseDC.USER32(00000000,00000000), ref: 004E5C0F
SelectObject.GDI32(?,?), ref: 004E5C2A
SelectObject.GDI32(?,00000000), ref: 004E5C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 004E5C65
SelectObject.GDI32(?,00000000), ref: 004E5C73
SelectObject.GDI32(?,00000000), ref: 004E5C81
DeleteDC.GDI32(?), ref: 004E5C97
DeleteDC.GDI32(?), ref: 004E5CA0

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction ID: 17c9c49937640a7ee63a15ab90711d013368aaab887e413720973401a1c3c297
Opcode Fuzzy Hash: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction Fuzzy Hash: 3D410C72E40754BFDB10EAE9C952FAFB7BCAB09705F50045AB600E7281D6789A4087A4

Function 004EB964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB9A7
RealizePalette.GDI32(?), ref: 004EB9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 004EBA0A
SetStretchBltMode.GDI32(?,00000004), ref: 004EBA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 004EBA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EBA4D
CreateCompatibleDC.GDI32(00000000), ref: 004EBAAE
SelectObject.GDI32(?,?), ref: 004EBAC3
SelectObject.GDI32(?,00000000), ref: 004EBB22
DeleteDC.GDI32(00000000), ref: 004EBB31

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction ID: 7ad90294f0dfa4864f0bea30e35c96d4e1fa41525923fe95d334a894f78dac22
Opcode Fuzzy Hash: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction Fuzzy Hash: 54912971604245AFDB50DFAAC981F9FBBE8AB08305F10455AF505E7651D738ED40CBA4

Function 004EE9A8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 004EE9B4
IsEqualGUID.OLE32(?,00512700), ref: 004EE9D5
IsEqualGUID.OLE32(?,00512710), ref: 004EE9EB

Strings

@'Q, xrefs: 004EEA26
0'Q, xrefs: 004EEA10
P'Q, xrefs: 004EEA3C
'Q, xrefs: 004EE9FA

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Equal
String ID: 'Q$0'Q$@'Q$P'Q
API String ID: 4016716531-2080303212
Opcode ID: 91a6e546a8f54ed96ca8def78ac02f2256e74d9d4946828f9873a8cab84fffed
Instruction ID: f395997b495182d7910ce141e5cd1dd74e0ac2f30d9655ca8f6010d2b531dd8d
Opcode Fuzzy Hash: 91a6e546a8f54ed96ca8def78ac02f2256e74d9d4946828f9873a8cab84fffed
Instruction Fuzzy Hash: 601178710085849ADB61DB2BAD80AF72B5D6F56305F04509BFD804F243D39D884A876E

Function 00425DC8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 00408887
Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 0040889F

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425E60
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425E6B
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EA6
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425F42
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425F4D
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F8A
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F95

Strings

[B, xrefs: 00425E21, 00425EDD, 00426014
B.C., xrefs: 00425EF0

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.$[B
API String ID: 1601775584-1960173975
Opcode ID: a50f082faad18564a19bf873938810469e651a565b5808075652403a0bf3687f
Instruction ID: 696a8cbb88cbf135683503293481ae752516e7a6c47e6b4c93b3b9376ce1ac3d
Opcode Fuzzy Hash: a50f082faad18564a19bf873938810469e651a565b5808075652403a0bf3687f
Instruction Fuzzy Hash: 9761F570B006129FE710EF69E885AAA77E5EF44724B51857EF400EB3E1C738AD41DB98

Function 004ED7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004ED0C0: DeleteObject.GDI32(00000000), ref: 004ED206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004ED865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 004ED8E3
GetIconInfo.USER32(00000000,?), ref: 004ED947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 004ED980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,004EDA2B), ref: 004ED9E9
DeleteObject.GDI32(?), ref: 004ED9FF
DeleteObject.GDI32(?), ref: 004EDA08

Strings

, xrefs: 004ED890
,, xrefs: 004ED86A

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction ID: 3b15df45811348dce314f71d9fb3896dfd83895a50164542f8512fd99f32aa23
Opcode Fuzzy Hash: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction Fuzzy Hash: F4913871B00145AFD700EFAAC885A9EBBF9FF48305F6041AAF505EB251DA34ED45CB94

Function 004253AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253D3
GetThreadLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253DC

Part of subcall function 00425380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Strings

mmmm d, yyyy, xrefs: 00425502
AMPM , xrefs: 00425619
m/d/yy, xrefs: 004254DD
2, xrefs: 0042566D
AMPM, xrefs: 0042560A
:mm:ss, xrefs: 00425644
:mm, xrefs: 00425629

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction ID: ae11f37f10c7c7cc2ece4aa2851bd9592c5e3db29736d4fa45ff2483457f4832
Opcode Fuzzy Hash: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction Fuzzy Hash: 597122307005699BDB01EBA5E881ADE72A6DF84344FD0807BF904EB646DB3CDE16879D

Function 004266A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004264A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
Part of subcall function 004264A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,004267C5), ref: 00426701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042674C
GetStdHandle.KERNEL32(000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00426760
WriteFile.KERNEL32(00000000,000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00426766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 0042678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 004267A4

Strings

tfB, xrefs: 00426711, 004267B9

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: tfB
API String ID: 135118572-130872579
Opcode ID: 6834375421c11d9c6b8ff6a51c65370d7f351e438f7ce89f2943f87a8ebf0c9c
Instruction ID: fa5ad383fe9a868bb1de0223e9bb2dd92474bd2812a0f0ae1eae64783a2027d7
Opcode Fuzzy Hash: 6834375421c11d9c6b8ff6a51c65370d7f351e438f7ce89f2943f87a8ebf0c9c
Instruction Fuzzy Hash: F9318775744218BFE710DB55DC83FDA73BCEB04714F9041A6B604E61D1DA78AE84876C

Function 004E4AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

CreateCompatibleDC.GDI32(00000000), ref: 004E4B64
SelectObject.GDI32(?,?), ref: 004E4B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 004E4C70
SetTextColor.GDI32(?,00000000), ref: 004E4C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 004E4C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 004E4CC5
SetTextColor.GDI32(?,?), ref: 004E4CD5
SetBkColor.GDI32(?,?), ref: 004E4CE5
SelectObject.GDI32(?,00000000), ref: 004E4D15
DeleteDC.GDI32(?), ref: 004E4D1E

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction ID: 71bf14b9f78042d93af0d274de238ac5bd12102c0260bb26fb2fcf8b95af7db9
Opcode Fuzzy Hash: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction Fuzzy Hash: EE919375A00248AFCB40DFAAC981E9EBBF9EF4D315B10449AF505EB661C734EE41CB64

Function 004085C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 004085DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004085E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,00408676,?,00000000,?,GetLogicalProcessorInformation), ref: 0040862A

Strings

kernel32.dll, xrefs: 004085D8
@, xrefs: 0040867D
GetLogicalProcessorInformation, xrefs: 004085D3

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction ID: 500c6e41f31b7fdb6d34238680861789b78f08bdeabe16a24c436e355b3d89bb
Opcode Fuzzy Hash: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction Fuzzy Hash: E0116370D00208AADB10EBA5CA05B5EB7A4DF04304F1288BFE854B72C1DA7E8E508E59

Function 00410594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0041064C

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction ID: 0ce41ded5bccfca64fbac36b7d610e41f84856dd8e2a7bbc42b78d3b128abe8f
Opcode Fuzzy Hash: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction Fuzzy Hash: 0CA19075A013099FDB20DFA8D881BEEB7B5FF58310F14812AE915A7390DBB4A9C4CB54

Function 00430A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00430AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00430B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00430B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00430BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00430BD8
VariantCopy.OLEAUT32(?), ref: 00430C0D

Strings

, xrefs: 00430A6E

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: c5ac3e0bb315912875ce6d6a8b12eb4200af54bb65bf5f77a9b42e84e07fd96b
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 2C51227590022D9BCB25DB59CC91BDAB3BCAF4C304F0052DAF548E7252D634AF848F65

Function 004E9A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 004E9B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 004E9B43

Strings

`, xrefs: 004E9A8B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction ID: e4881d64baec76ee9eafe246b21c5bc9d5a9281d976d74d65e8b275913b0d6f5
Opcode Fuzzy Hash: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction Fuzzy Hash: 8A412275D00248AFDB40DFA9C881AAEB7F9FF48711F50816AF904EB241E7389E40CB64

Function 004061E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406206
WriteFile.KERNEL32(00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040620C
GetStdHandle.KERNEL32(000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040622B
WriteFile.KERNEL32(00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?), ref: 00406248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000), ref: 0040624E

Strings

TS@, xrefs: 00406218, 00406223

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: TS@
API String ID: 3320372497-1941835897
Opcode ID: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction ID: 82cfcf8d63e4733cb96d407babe502fa205990dff362196b090b8b3cf9cfd937
Opcode Fuzzy Hash: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction Fuzzy Hash: 9D0162A16486147DE110F2BA9C8AF6F368CDB18724F10077E7618F60D2C5785C449B7A

Function 0040591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 004059D3
Sleep.KERNEL32(0000000A,00000000), ref: 004059E9
Sleep.KERNEL32(00000000), ref: 00405A17
Sleep.KERNEL32(0000000A,00000000), ref: 00405A2D

Strings

@., xrefs: 00405AB4, 00405AD6, 00405BEC, 00405C02

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction ID: a95b6186faaf28ee99436786a323c89c11953a43e3af36f3f78c15d8c677067a
Opcode Fuzzy Hash: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction Fuzzy Hash: 0DC16972601B118FD725CF28D884367BBA1EB95320F1882BFD4059B3D5C778A849DF88

Function 00405CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405912), ref: 00405D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405912), ref: 00405D50

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction ID: 4f935fbc936f4d5eb3d08406d1a455a3bc696dbd4939a17767f2164eefdcc051
Opcode Fuzzy Hash: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction Fuzzy Hash: 1371D231604B008FE725DB28D888B67BBD4EF95314F14C2BFD844AB3D2D67888459F59

Function 004E6084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E60B2
GetDeviceCaps.GDI32(?,00000068), ref: 004E60CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E60ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 004E6111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 004E612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 004E6143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E6163
ReleaseDC.USER32(00000000,?), ref: 004E617B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction ID: 253042d8ae561a030da4b25cfcc59df415f83bc43ecdec077c49d488911ed581
Opcode Fuzzy Hash: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction Fuzzy Hash: 8F2156B1A40218BADB50DFA5DD86F9EB3BCEB08705F510496F704E71C1D679AF408B28

Function 00405E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction ID: 14c4d9104ddc23c6b9370c21b65e9a421d4bec3d23930416dd05d6dcb6f7df23
Opcode Fuzzy Hash: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction Fuzzy Hash: 01C12262710A014BD714AA7D9C8836FB286DBC4325F68823FE645EB3C6DA7CCC458B58

Function 00501CB0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00501CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 00501D28
SelectObject.GDI32(?,?), ref: 00501D38
DeleteObject.GDI32(?), ref: 00501F51
DeleteDC.GDI32(?), ref: 00501F5D

Strings

|O, xrefs: 00501FB6

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID: |O
API String ID: 2986811175-2178481767
Opcode ID: a9bbe83d257c807f7c6cf5841645ed630d934bfa751ed75cbcc86d9f87175290
Instruction ID: 23b0b9da3e35150a70dc60c8eabed989a34c9c4d103326d6d83e4f384e214d9f
Opcode Fuzzy Hash: a9bbe83d257c807f7c6cf5841645ed630d934bfa751ed75cbcc86d9f87175290
Instruction Fuzzy Hash: 60B1C575E0060A9FCB04DF99C985AAEBBF5FF48300F2181A5E914A73A1D734AD41CF55

Function 004FC798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC40B
Part of subcall function 004FC400: DeleteDC.GDI32(?), ref: 004FC418
Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC434

CreateCompatibleDC.GDI32(00000000), ref: 004FC903
CreateHalftonePalette.GDI32(?,00000000), ref: 004FC93E
ResizePalette.GDI32(?,00000001), ref: 004FC973
SelectPalette.GDI32(?,?,00000000), ref: 004FC998
RealizePalette.GDI32(?), ref: 004FC9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 004FC9CE
SelectObject.GDI32(?,00000000), ref: 004FC9E1

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction ID: 4ba82757873bb3c143a4d1742f8b993ef62ffc4f5942cec004fa87537f0c0421
Opcode Fuzzy Hash: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction Fuzzy Hash: E67137756005289FDB04EF19C4D5F6637E5EF0A305F0541E6F2048F3AAC678E84ACB9A

Function 00408850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408CDC: GetCurrentThreadId.KERNEL32 ref: 00408CDF

GetTickCount.KERNEL32 ref: 00408887
GetTickCount.KERNEL32 ref: 0040889F
GetCurrentThreadId.KERNEL32 ref: 004088CE
GetTickCount.KERNEL32 ref: 004088F9
GetTickCount.KERNEL32 ref: 00408930
GetTickCount.KERNEL32 ref: 0040895A
GetCurrentThreadId.KERNEL32 ref: 004089CA

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction ID: 59fdbd664e4c2a787114e1462c869c0698e504600effbf6fb817d1e717bb5ab3
Opcode Fuzzy Hash: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction Fuzzy Hash: BB415E716083419EDB21BE79CA4032BBAD1AB91354F14893FD4D8A73C2EE798881D75B

Function 004EA090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0F9
GetDC.USER32(00000000), ref: 004EA110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,004EA1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 004EA134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,004EA1AB,?,?,00000000,00000000,00000008,?,00000000,004EA1CB), ref: 004EA167

Strings

`, xrefs: 004EA0C8

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction ID: 560aeff5e142fb22fc32d70ae3aa060d7ef4d96bf65ee7c2df06f2301dcbdb9f
Opcode Fuzzy Hash: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction Fuzzy Hash: AD318775A00248ABDB00DFD5C882BEEF7B8EF0D705F514496F904EB281D678AE50D7A9

Function 004EA974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004E62F0: GetObjectW.GDI32(00000000,00000004), ref: 004E6307
Part of subcall function 004E62F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 004E632A

GetDC.USER32(00000000), ref: 004EA9B2
CreateCompatibleDC.GDI32(?), ref: 004EA9BE
SelectObject.GDI32(?), ref: 004EA9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,004EAA23,?,?,?,?,00000000), ref: 004EA9EF
SelectObject.GDI32(?,?), ref: 004EAA09
DeleteDC.GDI32(?), ref: 004EAA12
ReleaseDC.USER32(00000000,?), ref: 004EAA1D

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction ID: a90b19bdd86dec3490e2a43e61abe2758ba6d863edaf7bda9a2135b5bf853f90
Opcode Fuzzy Hash: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction Fuzzy Hash: 54115172E00359BFDB10EFE9C851AEEB7BCEB09705F4044AAF504E7241E6789E5087A4

Function 004098D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?,?), ref: 00409909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?), ref: 0040990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?), ref: 0040992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E), ref: 00409930

Strings

Error, xrefs: 00409942
Runtime error at 00000000, xrefs: 00409902, 00409947

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction ID: 1cafd5f0b55deffaaa1a260c41e3c473f996b032a313f4f96ee96a2a81eb749b
Opcode Fuzzy Hash: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction Fuzzy Hash: FBF04491A4134479FA3077A55C56F6F2B589704B18F18893FB650782D3CAB84C889766

Function 004E65E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 004E662E
GetSystemMetrics.USER32(0000000C), ref: 004E663A
GetDC.USER32(00000000), ref: 004E6656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004E667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004E668A
ReleaseDC.USER32(00000000,00000000), ref: 004E66C3

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction ID: 4016dc568379c8c19e12672c107d27f7e339e6f7b848dc7462e147759cb92e24
Opcode Fuzzy Hash: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction Fuzzy Hash: BA318474E00244EFEB00DFA6C841AAEBBB5FF49751F11856AF414AB384C6749D41CB65

Function 004E6234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E6252
SelectObject.GDI32(00000000,00000000), ref: 004E625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,004EC367), ref: 004E626F
SelectObject.GDI32(00000000,00000000), ref: 004E627B
DeleteDC.GDI32(00000000), ref: 004E6281
CreatePalette.GDI32 ref: 004E62DC

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 9475189358abb1ede253a4bea58285cbdccba1be74ac0865f5f01776e776e117
Instruction ID: 4789e41709c464c38cc190e7d202f6c1cc51657ee1d44f40a86f5a7fef1d04fa
Opcode Fuzzy Hash: 9475189358abb1ede253a4bea58285cbdccba1be74ac0865f5f01776e776e117
Instruction Fuzzy Hash: 3311063120434022E210BB679C43BAB72A8DFD575AF01C52FF649D7382E67D8D89439E

Function 004E6A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E6950: GetObjectW.GDI32(?,00000054), ref: 004E6964

CreateCompatibleDC.GDI32(00000000), ref: 004E6ABE
SelectPalette.GDI32(?,?,00000000), ref: 004E6ADF
RealizePalette.GDI32(?), ref: 004E6AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 004E6B02
SelectPalette.GDI32(?,00000000,00000000), ref: 004E6B2A
DeleteDC.GDI32(?), ref: 004E6B33

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction ID: ce5ef7bc2b447eaaf5ad7ea58a7014afe3a29db5ee430c20c38cefb41b0ea7be
Opcode Fuzzy Hash: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction Fuzzy Hash: EF114275E403047FDB10DFAA8C42F9EBBEDDB49701F51806AB514E7281D678AE408768

Function 004EEBA4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 004EECF4

Strings

,, xrefs: 004EEC6A
pN, xrefs: 004EEC15, 004EED49
p'Q, xrefs: 004EEC33
, xrefs: 004EEC8B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$p'Q$pN
API String ID: 3573556081-239200797
Opcode ID: 36eec72f7cf69da6fd31506253325d15c4f0db435f7c4fdb284083537cfe252a
Instruction ID: e9d08c56acd0b362fb3510c6aa04a5d257184c5f5a7105b1d5cf16c2ef77a781
Opcode Fuzzy Hash: 36eec72f7cf69da6fd31506253325d15c4f0db435f7c4fdb284083537cfe252a
Instruction Fuzzy Hash: F351C074A00208AFDB40DF9AD881E9EB7F9FB48314F5181A6F914EB362D735AE44CB54

Function 004EE3C8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 004EE4B2

Strings

p'Q, xrefs: 004EE3FB
,, xrefs: 004EE468
`'Q, xrefs: 004EE40A
, xrefs: 004EE483

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$`'Q$p'Q
API String ID: 3573556081-2603654308
Opcode ID: 7ac60a7a49f45322ca22797660b5344676ee0932a45c00aed48eb380150a19f4
Instruction ID: 5b01f2d4c3fc12fc153c2c5d6b1d3526b0ec37a74694724511201f37374e4042
Opcode Fuzzy Hash: 7ac60a7a49f45322ca22797660b5344676ee0932a45c00aed48eb380150a19f4
Instruction Fuzzy Hash: 844155B1A00104AFDB40DF6AC885A9A77F9FF09318B2141A6FC04EB356D775ED45CBA4

Function 004264A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

Strings

MZP, xrefs: 00426519

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 2b3f44e4f7a2d6c1b3fee60125f5a3b7ebe0d388335a30d1c0c566c348941ca3
Instruction ID: 3ebe75aaea26270c49df469c1dfa27cf559e126611b230fa96b652b759ddd534
Opcode Fuzzy Hash: 2b3f44e4f7a2d6c1b3fee60125f5a3b7ebe0d388335a30d1c0c566c348941ca3
Instruction Fuzzy Hash: 0F415170A002289FDB20DF65DC81BC9B7F9AB59304F8140EAE508E7241D7799E948F59

Function 004ED0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004ED17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 004ED189
ReleaseDC.USER32(00000000,00000000), ref: 004ED198
DeleteObject.GDI32(00000000), ref: 004ED206

Strings

(, xrefs: 004ED133

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 98f8da26de29ebb582d9f5ef622e35e8f826a0a1f89f088b33e54b1e3e0a9be0
Instruction ID: 61bb5200601fe057a61d32a30b2be6827d93718d7371a4bfa829aa7d385f4c7c
Opcode Fuzzy Hash: 98f8da26de29ebb582d9f5ef622e35e8f826a0a1f89f088b33e54b1e3e0a9be0
Instruction Fuzzy Hash: 4141BE70E04248AFCB10DFA6C885ADEFBB5EF49305F1480AAE404AB351D7789A45DB99

Function 004B7154 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004B722A,?,?,004B5444,00000001), ref: 004B71CC
GetCurrentThread.KERNEL32 ref: 004B7204
GetCurrentThreadId.KERNEL32 ref: 004B720C

Strings

pDA, xrefs: 004B71EB
BnK, xrefs: 004B7221, 004B71D1, 004B71DB

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread$ErrorLast
String ID: BnK$pDA
API String ID: 4172138867-3175749474
Opcode ID: 74a235145783162475347fe5f03ea57b9a11a6ce6388e9cdefc546bf1b9da802
Instruction ID: 8793c087ecae53b8e7c446596dbfc2d7abd4ba4e08a79eb68b1a83a02f08ad02
Opcode Fuzzy Hash: 74a235145783162475347fe5f03ea57b9a11a6ce6388e9cdefc546bf1b9da802
Instruction Fuzzy Hash: B8212B709086456ED701DFB5CC817EABBE4BF89304F4485BBE42497782DB389815C7B9

Function 0043690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction ID: 8d3459a469465bc4371695b4e367a65a38b978d34797e4c4e50731b7cb5a1aca
Opcode Fuzzy Hash: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction Fuzzy Hash: AFD1C235A00209AFCF00EF95C4918EEFBB9EF0D310F5590A6E840A7251D638AE46DB79

Function 004F0894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 004F08C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 004F08F3
memcpy.MSVCRT(00000000,?,?), ref: 004F0989
memcpy.MSVCRT(00000000,?,?), ref: 004F099F
memcpy.MSVCRT(00000000,?,?), ref: 004F09B5
memcpy.MSVCRT(00000000,?,?), ref: 004F09C9

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: bcd7db05d191351e9405a97d2655ef30d3ed96d280d6279a09f2b3dd0a47b8f8
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 965175B1600200AFDB14CF69CCC5E6677A8BF88314F08827AEE098F346E735E944CB94

Function 004EC31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 76c421ad3c698b7ff88da0f61c3aa7df07cb2880bcd4f869b6d47c825d99da29
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: 3D11D3315012D9AEEB20AF27C481BEF3B94AF55357F04505BFC005A281D7BC8DA2C7A9

Function 004E619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E61B4
GetDeviceCaps.GDI32(?,00000068), ref: 004E61D0
GetPaletteEntries.GDI32(03080E47,00000000,00000008,?), ref: 004E61E8
GetPaletteEntries.GDI32(03080E47,00000008,00000008,?), ref: 004E6200
ReleaseDC.USER32(00000000,?), ref: 004E621C

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction ID: fb62e25858754de89261d63ddcf899fc845c4e56b322bcc1c3ebe9d0414cdd2c
Opcode Fuzzy Hash: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction Fuzzy Hash: 191108716483447EEB00DFA6EC42FA97FACE719706F40849BF204DA1C1DABA5544C324

Function 0040904A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 0040911E

Strings

hsB, xrefs: 004090F7
,qB, xrefs: 0040906B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: ,qB$hsB
API String ID: 3192549508-2187915683
Opcode ID: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction ID: 7df4318895a31e83b2a36aa030ba475ccd5b90e95bae95c0b52881597b1f7c6e
Opcode Fuzzy Hash: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction Fuzzy Hash: 834196717042029FE720DF14C888B6BB7E5EB85314F15857AE448AB393C739EC45CB59

Function 00509A14 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 00509A61
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 00509AE6

Strings

FinalizeSections: VirtualProtect failed, xrefs: 00509AF4
Q, xrefs: 00509AEF

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed$Q
API String ID: 2581862158-2157760199
Opcode ID: b598a1189f201a03167d132d2bbbea72632e0df96c8077984b88187cd176324c
Instruction ID: 47b9e1b1dfaa095e21604cbc7bfd7d25654c65e7baeb375db731be04e44617ab
Opcode Fuzzy Hash: b598a1189f201a03167d132d2bbbea72632e0df96c8077984b88187cd176324c
Instruction Fuzzy Hash: E431FE747042059FD710DF58D989F9ABBE8BB487A0F184584FA64DB2A6D734ED40CB90

Function 00423C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CB4

Strings

yyyy, xrefs: 00423C89
, xrefs: 00423C7A

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction ID: 4198a1d351d31b9a86c79895a928489856ad1452b39a35c365c2990c697424f4
Opcode Fuzzy Hash: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction Fuzzy Hash: F4217F35A046289BDB10EF95D842AAEB3F8EF08701F91406BF905F7281D63C9F00C76A

Function 0042D69C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(0041F85C,00000001), ref: 0042D6B8
GetCPInfo.KERNEL32(0042D79C,0042C1C5,0041F85C,00000001), ref: 0042D6D9

Strings

$CA, xrefs: 0042D6E2
\A, xrefs: 0042D6EA

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Info
String ID: $CA$\A
API String ID: 1807457897-218779800
Opcode ID: e004ade26763e9d8a8ab42f6d15ee520ae70fe4195a5a80f6fd8cc3be66cc55a
Instruction ID: 74bc127ab9f55916a256c3b914e092bb6e43920bef8ef7844cb0f093c4ffb1f0
Opcode Fuzzy Hash: e004ade26763e9d8a8ab42f6d15ee520ae70fe4195a5a80f6fd8cc3be66cc55a
Instruction Fuzzy Hash: FC01C471A00A158FC720EF69E981997B7E4AF05364700852FEC99C7351EA3999048BA9

Function 004E3964 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,004E3BCC), ref: 004E39AC
LeaveCriticalSection.KERNEL32(?,004E3BA3,?,00000000,004E3BCC), ref: 004E3B96

Strings

Default, xrefs: 004E3A5A
-Q, xrefs: 004E3A80

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Default$-Q
API String ID: 3168844106-3821686248
Opcode ID: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction ID: 19d7f923896caa44bc4d2895c7d959a39db7ed687c0c5984d3f2fc8e9670fb4e
Opcode Fuzzy Hash: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction Fuzzy Hash: BA519470A083589FDB02DFA9C845AEEBBF5FF48305F51446AE404A7352D778AE44CB14

Function 004E3ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 004E3EF7
GetObjectW.GDI32(?,00000010,?), ref: 004E3F0A
GetObjectW.GDI32(?,00000000,?), ref: 004E3F63

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction ID: b9ca84249461113418995685c1b411e63f59ddf32e5f5f2b3ba05ad8a3118a75
Opcode Fuzzy Hash: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction Fuzzy Hash: 09319471A047849FD711CF5AC885EAABBF9EF49311F14846EF854DB741D234E9008B64

Function 0040C998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040CA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040CA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040CA97

Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040CA15), ref: 0040C96B
Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040CA15), ref: 0040C988

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction ID: 8d1cb3547ee4b9364daa38f1b6dc697d03ddbece5e120c74778344a30482e11a
Opcode Fuzzy Hash: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction Fuzzy Hash: DF313D70A0021E9BDB10DBA9C8C57AFB7B5EF04304F00427AE555E7291DB789A04CB95

Function 004EA788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

CreateCompatibleDC.GDI32(00000000), ref: 004EA7DD
SelectObject.GDI32(00000000,?), ref: 004EA7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 004EA81F
RealizePalette.GDI32(00000000), ref: 004EA82B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction ID: 70351cf6032dbd0939f732d494bf93bb1b6777d92977e90662745986a4f58f41
Opcode Fuzzy Hash: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction Fuzzy Hash: E8310634A00684EFD704EF5AD981D5EB7F5FF48315B6241A6E804AB322C738EE82DB54

Function 004EDF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 004EDFAD
GetObjectW.GDI32(?,00000018,?), ref: 004EDFCE
DeleteObject.GDI32(?), ref: 004EDFFA
DeleteObject.GDI32(?), ref: 004EE003

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction ID: 1a97c13f3edbda2b3c1502a7d4827854aa80e6db8bf7018fb0a338cf34cd0894
Opcode Fuzzy Hash: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction Fuzzy Hash: 32119175A00208AFDB00DFABC982C9EB7F9EB48311B1085AAF904D7351DB75EE00DA94

Function 004EEDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EEDD9
SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction ID: a86a7c8164184303e7b2e3849245c9a5924fc7d8bd12fc902a680fb7c4b12911
Opcode Fuzzy Hash: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction Fuzzy Hash: 94E04F626027B032D551666B5D86BDB2A4C4F026ABF480116FD44997D1DA0DCE5083FA

Function 00427150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00427356), ref: 004271F0
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00427356), ref: 0042721C

Part of subcall function 0040EDD0: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040EE15

Strings

T@A, xrefs: 00427307

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: T@A
API String ID: 902310565-1700159869
Opcode ID: 1934e83e205892d8e93b20eb04534359455845c7401ae6a34e74355a077fd49a
Instruction ID: c1eccce1fff854dcc60035ccc9d3c03645ecc33e51b5142c2093c01634e21a3b
Opcode Fuzzy Hash: 1934e83e205892d8e93b20eb04534359455845c7401ae6a34e74355a077fd49a
Instruction Fuzzy Hash: 69512734A08269DFCB50DF29DC89AD9B7F4EF48304F4045EAA808A7351D778AE84CF59

Function 00428748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,0042BB77,00000000,0042BCB7), ref: 00428707

Strings

A, xrefs: 0042875E
Z, xrefs: 00428763

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: b9253ecd29e492176c38fe4a03f9f14fb6b287faa95297cdab911eb37b575cf8
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 431136127466200BE720643FAC817FF958A87C63A4F99023FF505D73C1DC5C8C0142D9

Function 00408F1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00408F8A
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_00008F20), ref: 00408FC7

Strings

hsB, xrefs: 00408F45

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB
API String ID: 3192549508-625297667
Opcode ID: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction ID: a3b05377a8d17e60e07457b386e13646049d2c6927d33ce14a72d1f6f32e6c37
Opcode Fuzzy Hash: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction Fuzzy Hash: 1A3180B0604301AFD720DB24C984F2BB7EAEB88714F14857EF548972A2CB38EC45D719

Function 004D8F38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FBC
RegCloseKey.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FD4

Strings

0DA, xrefs: 004D8FEB

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: CloseCreate
String ID: 0DA
API String ID: 2932200918-1323616133
Opcode ID: 67f5f4695bea9387195489de9b15d57c7fb85d64dc7cda453563e1676f60fd61
Instruction ID: aa8cda7b400e60673206408045c2687d27914ac2fd395a34ccbd79f4fac5cc60
Opcode Fuzzy Hash: 67f5f4695bea9387195489de9b15d57c7fb85d64dc7cda453563e1676f60fd61
Instruction Fuzzy Hash: 76215171B04208ABDB11EFA5CC52BAE77F9EB48704F10407BF504E7381EA78AE059659

Function 0040945E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 0040947F

Strings

hsB, xrefs: 004094B8
ptB, xrefs: 004094DA

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB$ptB
API String ID: 3192549508-579888589
Opcode ID: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction ID: 1c15842ca407df81533eab869cf356bb1e86fa8830085c109665a44f2841b22d
Opcode Fuzzy Hash: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction Fuzzy Hash: 722187742082059BDB24DF29D884B2B7391AB98710F14C53AA845973D7C73CEC46DB59

Function 004E9928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,004E99F3), ref: 004E99AB

Strings

l, xrefs: 004E9959
EMF, xrefs: 004E994B

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: b17350e6969a2965d523b855784a2a061d3421984c1e8b55934c82cbc41d568e
Instruction ID: d8b59ccd57732e94ff2d5b122cdf495c560b21a665579054683b94a632da62f7
Opcode Fuzzy Hash: b17350e6969a2965d523b855784a2a061d3421984c1e8b55934c82cbc41d568e
Instruction Fuzzy Hash: 84217F71A00244DFCB10EFAAC881A6EB7F5FF49714F55426EE405AB786DB38AD01CB58

Function 00433380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0043338D

Strings

U8C, xrefs: 004333D0
U8C, xrefs: 0043339E

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: U8C$U8C
API String ID: 1927566239-2794899156
Opcode ID: bbc6903c5dc0abfd21a9df4e1f941fb37b9d05c014e77d863f460d82128f39ac
Instruction ID: 101189b5647f5de9443075751191a290935f870a01dfb6d48d6d5855c328d217
Opcode Fuzzy Hash: bbc6903c5dc0abfd21a9df4e1f941fb37b9d05c014e77d863f460d82128f39ac
Instruction Fuzzy Hash: 84F0EC75E0020DEBCB00DF99D881AEEBBF8FB08710F008156EA54E7350E774AA44CB95

Function 004339A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004339AD

Strings

>C, xrefs: 004339BE
>C, xrefs: 004339F0

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: >C$>C
API String ID: 1927566239-3959820462
Opcode ID: a4a01de676e2fa05062c32adf047cee429aff43942e2ede58df66e06337c2fba
Instruction ID: 377e475875467049ae1e6b2267bb170c315a322e8fbbbbdcd1937f2cb043adaa
Opcode Fuzzy Hash: a4a01de676e2fa05062c32adf047cee429aff43942e2ede58df66e06337c2fba
Instruction Fuzzy Hash: 0DF0EC75E0020DABCB00DF99C881ADFB7F8FB08710F008156EA14E7340E774AA44CB95

Function 004289EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0050E4DB,00000000,0050E512), ref: 004289F2

Part of subcall function 004139B0: GetProcAddress.KERNEL32(0043C998,?), ref: 004139DA

Strings

kernel32.dll, xrefs: 004289ED
GetDiskFreeSpaceExW, xrefs: 004289FD

Memory Dump Source

Source File: 00000005.00000002.1687415032.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1687390772.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687511560.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687532681.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687558082.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687579298.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687600957.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687624741.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687664750.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687690023.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1687708416.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction ID: 8ccd786351900723a36e45e0a3bb3a683afe0fdfe4abf5b7f5dbba0d790a7421
Opcode Fuzzy Hash: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction Fuzzy Hash: 24D05EB07123624AD760ABA1B882B1E2288A320F06F80013FB20145B26CFFD8848534C

Analysis Process: rundll32.exePID: 6496, Parent PID: 7588COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	331
Total number of Limit Nodes:	23

Executed Functions

Function 041AD2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,041AD3BC,?,?), ref: 041AD32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,041AD3BC,?,?), ref: 041AD337

Part of subcall function 041AD1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,041AD222,?,00000001), ref: 041AD1F7
Part of subcall function 041AD1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,041AD222,?,00000001), ref: 041AD207

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 94b62cca3353e15eb9d552f50a15df27be68a62be0a13d459eabdca2bef8158c
Instruction ID: 332072f6a58553833f9e78b3b44523b0b29f565816114d4241d6346b0f0de9d5
Opcode Fuzzy Hash: 94b62cca3353e15eb9d552f50a15df27be68a62be0a13d459eabdca2bef8158c
Instruction Fuzzy Hash: C5114FB8A046099BEF00EFA4D9D1ABEB3B9EF44308F504475A904E7640DB747F15CA65

Function 041AD1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,041AD222,?,00000001), ref: 041AD1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,041AD222,?,00000001), ref: 041AD207

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f93071d7272d9076eb80ef8fe5de17e5567a3fd9a941cb9201dab4eeafb3b768
Instruction ID: a54801ae623779783e356b8f02d18fa3794953c01890773752d1b72531fd656b
Opcode Fuzzy Hash: f93071d7272d9076eb80ef8fe5de17e5567a3fd9a941cb9201dab4eeafb3b768
Instruction Fuzzy Hash: 1CF0E2B9544A08AFEB10FBB4EDC189EB3FCEB48214BA005A1A404D3580EB30BF609950

Function 041ACDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041AD00D,?,?), ref: 041ACE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041AD00D,?,?), ref: 041ACE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041AD00D,?,?), ref: 041ACE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 041ACEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 041ACEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 041ACEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 041ACF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,041ACFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,041AD00D), ref: 041ACF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,041ACFF0,?,80000001), ref: 041ACF6F
RegCloseKey.ADVAPI32(?,041ACFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,041ACFF0,?,80000001,Software\Embarcadero\Locales), ref: 041ACFEA

Strings

Software\CodeGear\Locales, xrefs: 041ACEA0, 041ACEBE
Software\Borland\Delphi\Locales, xrefs: 041ACEFA
Software\Embarcadero\Locales, xrefs: 041ACE60, 041ACE82
Software\Borland\Locales, xrefs: 041ACEDC

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 283a0860faa9b678800cd26ffdca31a28005c6de456c498e953b0ca72afbfde7
Instruction ID: 944ec57b3dadd4d9a881de34cb36775712db6ce0aaf4ee5fa7bdb11d16c738ff
Opcode Fuzzy Hash: 283a0860faa9b678800cd26ffdca31a28005c6de456c498e953b0ca72afbfde7
Instruction Fuzzy Hash: AF513779B44708BEEB10DBA4DCC5FFEB7BDEB08708F504065B604E6581E771B9608A94

Function 041ACAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(042BAC10,00000000,041ACBB8,?,?,?,00000000,?,041AD480,00000000,041AD4DF,?,?,00000000,00000000,00000000), ref: 041ACAD2
LeaveCriticalSection.KERNEL32(042BAC10,042BAC10,00000000,041ACBB8,?,?,?,00000000,?,041AD480,00000000,041AD4DF,?,?,00000000,00000000), ref: 041ACAF6
LeaveCriticalSection.KERNEL32(042BAC10,042BAC10,00000000,041ACBB8,?,?,?,00000000,?,041AD480,00000000,041AD4DF,?,?,00000000,00000000), ref: 041ACB05
IsValidLocale.KERNEL32(00000000,00000002,042BAC10,042BAC10,00000000,041ACBB8,?,?,?,00000000,?,041AD480,00000000,041AD4DF), ref: 041ACB17
EnterCriticalSection.KERNEL32(042BAC10,00000000,00000002,042BAC10,042BAC10,00000000,041ACBB8,?,?,?,00000000,?,041AD480,00000000,041AD4DF), ref: 041ACB74
LeaveCriticalSection.KERNEL32(042BAC10,042BAC10,00000000,00000002,042BAC10,042BAC10,00000000,041ACBB8,?,?,?,00000000,?,041AD480,00000000,041AD4DF), ref: 041ACB9D

Strings

en-GB,en,en-US,, xrefs: 041ACAE2, 041ACB89

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: a13ee6718a8dd4b121f30b247e7ed09435e465a39dfd5a71ed5f02f194544e5d
Instruction ID: 6db06e18c7165da7e309cbd010242bf02fae61dd81c0963571eb74382c2eac38
Opcode Fuzzy Hash: a13ee6718a8dd4b121f30b247e7ed09435e465a39dfd5a71ed5f02f194544e5d
Instruction Fuzzy Hash: 9621D52C35430077FB12BBA898D276D32859F85B88F514861E18097241EF76BDA586EA

Function 0428EE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0428EE3A

Part of subcall function 0428EDD0: GetDC.USER32(00000000), ref: 0428EDD9
Part of subcall function 0428EDD0: SelectObject.GDI32(00000000,058A00B4), ref: 0428EDEB
Part of subcall function 0428EDD0: GetTextMetricsW.GDI32(00000000), ref: 0428EDF6
Part of subcall function 0428EDD0: ReleaseDC.USER32(00000000,00000000), ref: 0428EE07

Strings

Tahoma, xrefs: 0428EE5C
MS Shell Dlg 2, xrefs: 0428EEA4
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 0428EE90

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 89117fbd92efd6ea90ee36e147b619c3935cc854ae1d43e43b20e5c8bd9f79f4
Instruction ID: 53825530af69fa70e467b4a7e761fda910c644f08ad676b39f75677f088e1dff
Opcode Fuzzy Hash: 89117fbd92efd6ea90ee36e147b619c3935cc854ae1d43e43b20e5c8bd9f79f4
Instruction Fuzzy Hash: E8119170720209AFFB11FF68DC5199D7BE5EB46718F9244A8E400E7691D775BE01CB50

Function 041A961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 041A9653

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 3e80c9bb616b5094358be40cca8f4bcb4a2ac774195cff2743e74454f5aa29b4
Instruction ID: b08bf388766aef62a9e0d7194ebe04bd32671ddb8e6c4430a52014c2e5b7c2bf
Opcode Fuzzy Hash: 3e80c9bb616b5094358be40cca8f4bcb4a2ac774195cff2743e74454f5aa29b4
Instruction Fuzzy Hash: 85519FB86207049FEB24EF68D4C475A7BE5EF49314F148C9AE8498B241D778F8E4CB91

Function 042AE000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,042AE0D7), ref: 042AE02D

Part of subcall function 041AC520: InitializeCriticalSection.KERNEL32(042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC525
Part of subcall function 041AC520: GetVersion.KERNEL32(042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC533
Part of subcall function 041AC520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC55A
Part of subcall function 041AC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041AC560
Part of subcall function 041AC520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC574
Part of subcall function 041AC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041AC57A
Part of subcall function 041AC520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC58E
Part of subcall function 041AC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041AC594

Part of subcall function 041AEE84: GetSystemInfo.KERNEL32 ref: 041AEE88

GetCommandLineW.KERNEL32(00000400,00000000,042AE0D7), ref: 042AE092

Part of subcall function 041A5244: GetStartupInfoW.KERNEL32 ref: 041A5255

GetACP.KERNEL32(00000400,00000000,042AE0D7), ref: 042AE0A6
GetCurrentThreadId.KERNEL32 ref: 042AE0BA

Part of subcall function 041AEE98: GetVersion.KERNEL32(042AE0C9,00000400,00000000,042AE0D7), ref: 041AEE98

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: 5342fe4e874f8fd6efc4d1fffd6cb469539a5fe7d104fc9c533a69555a7fe193
Instruction ID: 8ccdb76bdd832d5ef9015a40d827bd0ee324dd1ed91b08d9b2bcd0b1e3e91548
Opcode Fuzzy Hash: 5342fe4e874f8fd6efc4d1fffd6cb469539a5fe7d104fc9c533a69555a7fe193
Instruction Fuzzy Hash: E6117C78748B80AAF701FF78B48C1193BA8FB0534CB054C18C5084A641E77D6824CBFB

Function 0427915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,0427931F), ref: 042791D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,0427931F), ref: 0427924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 042792BC

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: bca1081572c613b1a1a45034aa34c5d83d4efc2a9f20e8035786b460a4e03e36
Instruction ID: f89f15e3b43f39a65e737ac0e47d89d58519f596f367adda2bf9053ff45b04c6
Opcode Fuzzy Hash: bca1081572c613b1a1a45034aa34c5d83d4efc2a9f20e8035786b460a4e03e36
Instruction Fuzzy Hash: 6951D074F10208AFFB12EBA4C880B9EB7FAAF44308F104468A444E3250DB75BF55D751

Function 041C7884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,041C7984), ref: 041C78C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,041C7967,?,00000000,?,00000000,041C7984), ref: 041C7902
VerQueryValueW.VERSION(?,041C7998,?,?,00000000,?,00000000,?,00000000,041C7967,?,00000000,?,00000000,041C7984), ref: 041C791C

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: d66795361b8bf32c2c08d533584c6cff0592d337239b3621f705ee9e8000f0f3
Instruction ID: b1d54127f77302e0fd4972cb31795894e3265297b52a23cf2a1cdb851185ae68
Opcode Fuzzy Hash: d66795361b8bf32c2c08d533584c6cff0592d337239b3621f705ee9e8000f0f3
Instruction Fuzzy Hash: D8314C75A0024AAFEB01DFA9CDC1DAEB7F8EB59614B5144B9E854E3240DB74EE10CB60

Function 041AD3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,041AD4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,041AD566,00000000,?,00000105), ref: 041AD473
GetSystemDefaultUILanguage.KERNEL32(00000000,041AD4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,041AD566,00000000,?,00000105), ref: 041AD49B

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 96dde4a7b7731b3cba9ccff1978f499bd0ce3c6f8df8440f3573efad043a0640
Instruction ID: f45a3a786f0270b024086f12adb57f9f482f235bc55bc7e85537d975fd8e8076
Opcode Fuzzy Hash: 96dde4a7b7731b3cba9ccff1978f499bd0ce3c6f8df8440f3573efad043a0640
Instruction Fuzzy Hash: E7311078A146099FEB10EFA8D8C0AAEB7F6EF44308F5044A6D40497E50DB74BDA5CB51

Function 041AD4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041AD5A6,?,041A0000,042AFC1C), ref: 041AD528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,041AD5A6,?,041A0000,042AFC1C), ref: 041AD579

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 3b8bc341d1793afc7d8aec10c30774934ba9a9223774f05d40015487a470e032
Instruction ID: db3d6f5dc74f5308e0cc6984dbe4d98e801dd1aadab2019f4c33551a7be0d1c7
Opcode Fuzzy Hash: 3b8bc341d1793afc7d8aec10c30774934ba9a9223774f05d40015487a470e032
Instruction Fuzzy Hash: 51119478A4461C9BEB10EB50DCC5BDE73B9DF04708F4144E5E50893290DB706F95CE95

Function 041A5600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,041A5C17), ref: 041A5617

Strings

@., xrefs: 041A5652, 041A5670

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: 8adb21b7b04eff7d65b95a962a0ab65b52f380b03ebd1eeaf303fe62cb26508a
Instruction ID: 80dcafbe3b765b9de67fb32a65f70c3858231f67e0141344c5e16d86cb24d2b9
Opcode Fuzzy Hash: 8adb21b7b04eff7d65b95a962a0ab65b52f380b03ebd1eeaf303fe62cb26508a
Instruction Fuzzy Hash: 1DF03CB2B042119FE714AF7CA944752AAE9EB49354F15427EE94DEB784EB749C008BC0

Function 04278EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,04278F0C,?,?,00000000,04279123,00000000,00000000,00000000,?,?,00000000,04279139), ref: 04278EB1
RegCloseKey.ADVAPI32(00000000,?,04278F0C,?,?,00000000,04279123,00000000,00000000,00000000,?,?,00000000,04279139), ref: 04278EBA

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 630c61536920fe8dd834fd473f594445e4b5b5353358806fb33b29cb7ec992aa
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 23D017E4B102098BEF50EE79C9C8A43BBDC6F08214B08C4A2AC48CF14AD734E4508B60

Function 04279EDC Relevance: 1.6, APIs: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,04279BB9), ref: 04279F07

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d5ed261c72e754326974b4e87a9d801805847b2378e5a9f0ad687b6cdecd169b
Instruction ID: abac6d1b08ee3d00208ecf981d0a8ff53efc7c756016704c0d473bc1c6e7855d
Opcode Fuzzy Hash: d5ed261c72e754326974b4e87a9d801805847b2378e5a9f0ad687b6cdecd169b
Instruction Fuzzy Hash: 49012175B00208AFEB00EEADDCC4ADAB7ACDF59214F108166F918DB341D675AE0587A1

Function 042798DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,04279AE0,00000000,04279C1C), ref: 0427990D

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction ID: a578de14b6535d563009d215f658aa40891a282fa8e5cdad01eb933e63dc4613
Opcode Fuzzy Hash: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction Fuzzy Hash: 1AF039663052046FE344FAADACC4FABA6DCDB88614F10843EB28CC7241DA60EC0983B1

Function 041AC278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(041A0000,?,0000020A), ref: 041AC296

Part of subcall function 041AD4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,041AD5A6,?,041A0000,042AFC1C), ref: 041AD528
Part of subcall function 041AD4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,041AD5A6,?,041A0000,042AFC1C), ref: 041AD579

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: dc882434042e2eb9dae20445cffafaaddd359b036b01f1e5967b619b84e7e640
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 22E0EDB5A043109BDB20DE9CD9C5A5637D8AB08658F044596AD14CF346E771E92087D1

Function 041AEE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 041AEE88

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 5fa63a28ff319f619f36c96103a69e2538cac799d0575451e3d2bd3859186665
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 84A0121440C4001EC408B7184C8240F3180194101CFC40610685C95282E705957A02DB

Non-executed Functions

Function 041ACBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,041BA5A8,?,?), ref: 041ACC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 041ACC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,041BA5A8,?,?), ref: 041ACD26
FindClose.KERNEL32(?,?,?,kernel32.dll,041BA5A8,?,?), ref: 041ACD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,041BA5A8,?,?), ref: 041ACD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,041BA5A8,?,?), ref: 041ACD89

Strings

\, xrefs: 041ACD56
GetLongPathNameW, xrefs: 041ACC20
kernel32.dll, xrefs: 041ACC10

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: a3e410b855b36e0fce9003d94585b0d432f212735f59c25440d0596a72604aa4
Instruction ID: 32282ba627e054e08ab54dc106f15642addbb5756485ebf8fcb01843d4194125
Opcode Fuzzy Hash: a3e410b855b36e0fce9003d94585b0d432f212735f59c25440d0596a72604aa4
Instruction Fuzzy Hash: 9B419079E006189BDB20EFA8CCC4ADDB7B6AF84314F1885A58504E7244FB74BE64DBC5

Function 0429ABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 0429ABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0429ABE7
SelectObject.GDI32(00000000,00000000), ref: 0429ABEE
CreateCompatibleDC.GDI32(?), ref: 0429AC22
CreateCompatibleDC.GDI32(?), ref: 0429AC2E
CreateCompatibleDC.GDI32(?), ref: 0429AC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0429AC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0429AC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0429AC6B
SelectObject.GDI32(?,?), ref: 0429AC7B
SelectObject.GDI32(?,?), ref: 0429AC8B
SelectObject.GDI32(?,?), ref: 0429AC9B
SetBkColor.GDI32(00000000,?), ref: 0429ACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0429ACCC
SetBkColor.GDI32(00000000,?), ref: 0429ACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 0429ACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0429AD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 0429AD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 0429AD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 0429AD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0429AD90
SelectObject.GDI32(?,?), ref: 0429AD9D
DeleteObject.GDI32(00000000), ref: 0429ADA3
SelectObject.GDI32(?,?), ref: 0429ADB0
DeleteObject.GDI32(00000000), ref: 0429ADB6
SelectObject.GDI32(?,?), ref: 0429ADC3
DeleteObject.GDI32(00000000), ref: 0429ADC9
SelectObject.GDI32(00000000,?), ref: 0429ADD3
DeleteObject.GDI32(00000000), ref: 0429ADD9
DeleteDC.GDI32(?), ref: 0429ADE2
DeleteDC.GDI32(?), ref: 0429ADEB
DeleteDC.GDI32(?), ref: 0429ADF4
DeleteDC.GDI32(00000000), ref: 0429ADFA

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: a8984099b11549394ba171a7441854336114b984ef697cfb5d111f9784fc9a7d
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 6E816AB1E40218BBEB51EAE9CD85FEFB7BCAB09614F104415F654FB280C675BD108BA4

Function 041CEF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 041CEFA5

Part of subcall function 041CEF70: GetProcAddress.KERNEL32(00000000), ref: 041CEF89

Strings

VarR4FromStr, xrefs: 041CF0E7
VarBoolFromStr, xrefs: 041CF13F
VarXor, xrefs: 041CF0A5
VarDateFromStr, xrefs: 041CF113
VarCyFromStr, xrefs: 041CF129
VarBstrFromDate, xrefs: 041CF16B
VarCmp, xrefs: 041CF0BB
VarMul, xrefs: 041CF021
VarI4FromStr, xrefs: 041CF0D1
VarNeg, xrefs: 041CEFC9
VarIdiv, xrefs: 041CF04D
VarR8FromStr, xrefs: 041CF0FD
VarNot, xrefs: 041CEFDF
VarAnd, xrefs: 041CF079
VarBstrFromCy, xrefs: 041CF155
VarOr, xrefs: 041CF08F
VarMod, xrefs: 041CF063
VarBstrFromBool, xrefs: 041CF181
VarSub, xrefs: 041CF00B
VariantChangeTypeEx, xrefs: 041CEFB3
oleaut32.dll, xrefs: 041CEFA0
VarAdd, xrefs: 041CEFF5
VarDiv, xrefs: 041CF037

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 63bb9d54c202ab2e3338c6d5c6ea2628c0b6c620e9a5a14102f296b0f205edca
Instruction ID: 712951ec0b99bdf8352cf656b942eebc4b834a41cfaa56708f87702dde84df5b
Opcode Fuzzy Hash: 63bb9d54c202ab2e3338c6d5c6ea2628c0b6c620e9a5a14102f296b0f205edca
Instruction Fuzzy Hash: 6B4148617583095F72086B6D7EC446A77DAEA75718360442EB408FB388DF34FD824B6E

Function 04285CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 04285D2F
SelectObject.GDI32(?,?), ref: 04285D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,04285DB4,?,?), ref: 04285D88
SelectObject.GDI32(?,?), ref: 04285DA2
DeleteObject.GDI32(?), ref: 04285DAE
CreateCompatibleDC.GDI32(00000000), ref: 04285DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 04285DE3
SelectObject.GDI32(?,?), ref: 04285DF8
SelectPalette.GDI32(?,02080EE8,00000000), ref: 04285E0C
SelectPalette.GDI32(?,?,00000000), ref: 04285E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 04285E33
SelectPalette.GDI32(?,02080EE8,000000FF), ref: 04285E49
RealizePalette.GDI32(?), ref: 04285E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 04285E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 04285E99
SetTextColor.GDI32(?,00000000), ref: 04285EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 04285EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 04285EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 04285F00
SetTextColor.GDI32(?,?), ref: 04285F0A
SetBkColor.GDI32(?,?), ref: 04285F14
SelectObject.GDI32(?,00000000), ref: 04285F27
DeleteObject.GDI32(?), ref: 04285F30
SelectPalette.GDI32(?,00000000,00000000), ref: 04285F52
DeleteDC.GDI32(?), ref: 04285F5B

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 2eab675262a39a4f618ed4de2d8298acfb442aee742a1f281a4f8715cf1cdf69
Instruction ID: 44189609763d63db897aa253165e44124a89802f2ef80e74074285bd8fef13a8
Opcode Fuzzy Hash: 2eab675262a39a4f618ed4de2d8298acfb442aee742a1f281a4f8715cf1cdf69
Instruction Fuzzy Hash: D281A6B1A01209BFEB51EE98CC85EEF77ECAB0D614F100515FA58E7280C274BD508BA1

Function 0428B140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 0428B163
GetDC.USER32(00000000), ref: 0428B191
CreateCompatibleDC.GDI32(?), ref: 0428B1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 0428B1BD
SelectObject.GDI32(?,00000000), ref: 0428B1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 0428B1F9
CreateCompatibleDC.GDI32(?), ref: 0428B207
SelectObject.GDI32(00000000,00000000), ref: 0428B24F
SelectPalette.GDI32(00000000,?,00000000), ref: 0428B262
RealizePalette.GDI32(00000000), ref: 0428B26B
SelectPalette.GDI32(?,?,00000000), ref: 0428B277
RealizePalette.GDI32(?), ref: 0428B280
SetBkColor.GDI32(00000000,00000000), ref: 0428B28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 0428B2AE
SetBkColor.GDI32(00000000,00000000), ref: 0428B2B8
SelectObject.GDI32(00000000,00000000), ref: 0428B2CB
DeleteObject.GDI32(00000000), ref: 0428B2D7
DeleteDC.GDI32(00000000), ref: 0428B2ED
SelectObject.GDI32(?,00000000), ref: 0428B308
DeleteDC.GDI32(00000000), ref: 0428B324
ReleaseDC.USER32(00000000,00000000), ref: 0428B335

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: eb4ccb0bc52ab339c11839c219c306afc9d913f27417c284fb941ab511bd7a12
Instruction ID: d4ecdcad5a004622a88acb1d53dbd636bf5c773d8f6eba314be564b5d2122f87
Opcode Fuzzy Hash: eb4ccb0bc52ab339c11839c219c306afc9d913f27417c284fb941ab511bd7a12
Instruction Fuzzy Hash: F851EC71F11209BBEB11EAE8CC95BEEB7B8AB08704F544459F614E7280D774B950CB90

Function 0428C71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0428C9A4
CreateCompatibleDC.GDI32(00000001), ref: 0428CA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 0428CA1E
SelectObject.GDI32(?,00000000), ref: 0428CA28
SelectPalette.GDI32(?,?,00000000), ref: 0428CA58
RealizePalette.GDI32(?), ref: 0428CA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 0428CA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,0428CAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 0428CA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 0428CAC8
SelectObject.GDI32(?,?), ref: 0428CAD5
DeleteObject.GDI32(00000000), ref: 0428CADB

Strings

BM, xrefs: 0428C83D
(, xrefs: 0428C8D2

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 0e6baa7dc035aac558151803a3a1d30e228793a71872271c1c0f4b23b525528c
Instruction ID: 82a936e52db10d63b76cf24569dd87942955a1c02eca01cc3e0ac2182029711d
Opcode Fuzzy Hash: 0e6baa7dc035aac558151803a3a1d30e228793a71872271c1c0f4b23b525528c
Instruction Fuzzy Hash: C3E16F74B112199FEF14EFA9C884BAEBBF5FF49304F008569E954EB294D734A850CB60

Function 0428B698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0428C31C: GetDC.USER32(00000000), ref: 0428C372
Part of subcall function 0428C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0428C387
Part of subcall function 0428C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0428C391
Part of subcall function 0428C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0428A7DB,00000000,0428A867), ref: 0428C3B5
Part of subcall function 0428C31C: ReleaseDC.USER32(00000000,00000000), ref: 0428C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 0428B6DB
RealizePalette.GDI32(?), ref: 0428B6EA
GetStretchBltMode.GDI32(00000000), ref: 0428B6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 0428B70D
GetDeviceCaps.GDI32(?,0000000E), ref: 0428B71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 0428B74F
SetStretchBltMode.GDI32(?,00000004), ref: 0428B75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 0428B775
SetStretchBltMode.GDI32(00000000,00000003), ref: 0428B792
CreateCompatibleDC.GDI32(00000000), ref: 0428B7F3
SelectObject.GDI32(?,?), ref: 0428B808
SelectObject.GDI32(?,00000000), ref: 0428B867
DeleteDC.GDI32(00000000), ref: 0428B876

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: 2d48edd46c6545c62071a83a94ebe8f63fd4ae7a51f8b1808939b87b71ad5cbb
Instruction ID: f5d4869ec4823fe39792d117d5be01c2ea3a6cbf077965a2f85554b768357b1f
Opcode Fuzzy Hash: 2d48edd46c6545c62071a83a94ebe8f63fd4ae7a51f8b1808939b87b71ad5cbb
Instruction Fuzzy Hash: FAA114B1B10209AFDB40EBADC984F9EBBE8AF09204F504599F555EB691C734FD50CBA0

Function 042A9D34 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

MZ, xrefs: 042A9D6F
BTMemoryLoadLibary: Can't attach library, xrefs: 042A9F78
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 042A9F00
PE, xrefs: 042A9DB0
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 042A9D7C
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 042A9F4D
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 042A9E18
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 042A9DC1

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: 0c74a8e7ce79d9a632ea34d3be93a2b85fbab0c690619389a9b397e7954cfe28
Instruction ID: dd0b8787b142aa53a36f6fc4a05d9ea96d9e24a35813a5555d5da7a97d8ce038
Opcode Fuzzy Hash: 0c74a8e7ce79d9a632ea34d3be93a2b85fbab0c690619389a9b397e7954cfe28
Instruction Fuzzy Hash: 1C71AFB1B14205AFEB14DB6DDC80BAEB3E9EF88304F0488A5E914E7640D674FD54CB50

Function 04285B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 04285B6F
CreateCompatibleDC.GDI32(00000000), ref: 04285B79
GetObjectW.GDI32(?,00000018,?), ref: 04285B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 04285BB0
GetDC.USER32(00000000), ref: 04285BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 04285BE9
ReleaseDC.USER32(00000000,00000000), ref: 04285C0F
SelectObject.GDI32(?,?), ref: 04285C2A
SelectObject.GDI32(?,00000000), ref: 04285C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 04285C65
SelectObject.GDI32(?,00000000), ref: 04285C73
SelectObject.GDI32(?,00000000), ref: 04285C81
DeleteDC.GDI32(?), ref: 04285C97
DeleteDC.GDI32(?), ref: 04285CA0

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: be02152e8359e9bb8401e1407742dfd85de6de28542e9444773384592e301b0f
Instruction ID: 376ec48ba3978c56745fb8742161b2f26e85af4dd694decfd112779c829d8d9f
Opcode Fuzzy Hash: be02152e8359e9bb8401e1407742dfd85de6de28542e9444773384592e301b0f
Instruction Fuzzy Hash: 8A41C972F51209BFEB51EAE8CD85FAEB7B8AB19704F400455FA14E7280D674B9508BA0

Function 041AC520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC525
GetVersion.KERNEL32(042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041AC560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041AC57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,042BAC10,042AE037,00000400,00000000,042AE0D7), ref: 041AC58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041AC594

Strings

GetThreadPreferredUILanguages, xrefs: 041AC550
kernel32.dll, xrefs: 041AC555, 041AC56F, 041AC589
GetThreadUILanguage, xrefs: 041AC584
SetThreadPreferredUILanguages, xrefs: 041AC56A

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 6a6012e9377e534e13bfd61ad4cda5ec3a00b5789e5e9bb9d6b4421462154be0
Instruction ID: 11666f5ad8c311a4dda510e19271e974f79b4a57167359505146f7eb387e2dcb
Opcode Fuzzy Hash: 6a6012e9377e534e13bfd61ad4cda5ec3a00b5789e5e9bb9d6b4421462154be0
Instruction Fuzzy Hash: F3F0F8E97883407BE6227778A8CE93D3686DE8174CB104421B10095002EFBC75608AD5

Function 0428B964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0428C31C: GetDC.USER32(00000000), ref: 0428C372
Part of subcall function 0428C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0428C387
Part of subcall function 0428C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0428C391
Part of subcall function 0428C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0428A7DB,00000000,0428A867), ref: 0428C3B5
Part of subcall function 0428C31C: ReleaseDC.USER32(00000000,00000000), ref: 0428C3C0

SelectPalette.GDI32(?,?,000000FF), ref: 0428B9A7
RealizePalette.GDI32(?), ref: 0428B9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 0428B9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 0428B9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 0428BA0A
SetStretchBltMode.GDI32(?,00000004), ref: 0428BA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 0428BA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 0428BA4D
CreateCompatibleDC.GDI32(00000000), ref: 0428BAAE
SelectObject.GDI32(?,?), ref: 0428BAC3
SelectObject.GDI32(?,00000000), ref: 0428BB22
DeleteDC.GDI32(00000000), ref: 0428BB31

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 3cd624542e4306bfd44bb9f5a37cb86b1f87167382f7fe437ac157dbce65e2ce
Instruction ID: eb42b2d9fdc87be7703d94e698eaa4f61a5e17a1781e5a12c7ed96ed6e4f9734
Opcode Fuzzy Hash: 3cd624542e4306bfd44bb9f5a37cb86b1f87167382f7fe437ac157dbce65e2ce
Instruction Fuzzy Hash: 4C9137B1B10249AFDB50EBA9C880F9EBBF8AF09204F104559F955E7691D734FA50CBA0

Function 0428D7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0428D0C0: DeleteObject.GDI32(00000000), ref: 0428D206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0428D865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 0428D8E3
GetIconInfo.USER32(00000000,?), ref: 0428D947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 0428D980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,0428DA2B), ref: 0428D9E9
DeleteObject.GDI32(?), ref: 0428D9FF
DeleteObject.GDI32(?), ref: 0428DA08

Strings

,, xrefs: 0428D86A
, xrefs: 0428D890

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: 494cb8a247895f4ecfbb6063a5c087afd62825ee71d26bfcad142a496e8a9676
Instruction ID: 09f1bb1e3e680995ab8c4b650b1420c7964f6cfcb5378027149bec3ffbec5a96
Opcode Fuzzy Hash: 494cb8a247895f4ecfbb6063a5c087afd62825ee71d26bfcad142a496e8a9676
Instruction Fuzzy Hash: EE910A71B11109AFD710EFA9C884A9EBBF9FF49314F5141A8E514DB290DB30ED59CB90

Function 041C53AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,041C5691,?,?,?,?,00000000,00000000), ref: 041C53D3
GetThreadLocale.KERNEL32(?,00000001,00000000,041C5691,?,?,?,?,00000000,00000000), ref: 041C53DC

Part of subcall function 041C5380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,041C5482,?,00000001,00000000,041C5691), ref: 041C5393

Part of subcall function 041C5334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 041C5352

Strings

AMPM, xrefs: 041C560A
m/d/yy, xrefs: 041C54DD
2, xrefs: 041C566D
mmmm d, yyyy, xrefs: 041C5502
:mm:ss, xrefs: 041C5644
:mm, xrefs: 041C5629
AMPM , xrefs: 041C5619

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 60a8b1ab70b995da2f3f938fd6de726814d6561dba40c79e9b394cefdea508dd
Instruction ID: 118160b3d7ad008019b2e069e2352c9c92db7b7e9bffd6560bf4d823e41e25a7
Opcode Fuzzy Hash: 60a8b1ab70b995da2f3f938fd6de726814d6561dba40c79e9b394cefdea508dd
Instruction Fuzzy Hash: E1717334700168ABFB01EBA4CDC0ADF72A7DFA4748F909069E504AF745DB34FA068795

Function 041C5DC8 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 041A8850: GetTickCount.KERNEL32 ref: 041A8887
Part of subcall function 041A8850: GetTickCount.KERNEL32 ref: 041A889F

Part of subcall function 041C5334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 041C5352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 041C5E60
EnumCalendarInfoW.KERNEL32(041C5C8C,00000000,00000000,00000004), ref: 041C5E6B
GetThreadLocale.KERNEL32(00000000,00000003,041C5C8C,00000000,00000000,00000004), ref: 041C5EA6
EnumCalendarInfoW.KERNEL32(041C5D30,00000000,00000000,00000003,041C5C8C,00000000,00000000,00000004), ref: 041C5EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 041C5F42
EnumCalendarInfoW.KERNEL32(041C5C8C,00000000,00000000,00000004), ref: 041C5F4D
GetThreadLocale.KERNEL32(00000000,00000003,041C5C8C,00000000,00000000,00000004), ref: 041C5F8A
EnumCalendarInfoW.KERNEL32(041C5D30,00000000,00000000,00000003,041C5C8C,00000000,00000000,00000004), ref: 041C5F95

Strings

B.C., xrefs: 041C5EF0

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: a66511657c7712ee35729ce8426a089a8be796d5a077d9518782bdc9a6701966
Instruction ID: 36d55c89e99e327e1a5c35b5cc23c1d412a246466a65fc7d27fd1271e36a80d1
Opcode Fuzzy Hash: a66511657c7712ee35729ce8426a089a8be796d5a077d9518782bdc9a6701966
Instruction Fuzzy Hash: 3F619F75B00215AFF710EF6CE8C4AAA7BA6EF18714B1042A8E914EB791C734FD51DB90

Function 04284AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04284778: EnterCriticalSection.KERNEL32(042BDE34,?,04284858,?,?,?,?,?,?,?,?,00000000,04284870,?,042BDE34), ref: 04284780
Part of subcall function 04284778: LeaveCriticalSection.KERNEL32(042BDE34,042BDE34,?,04284858,?,?,?,?,?,?,?,?,00000000,04284870,?,042BDE34), ref: 0428478D
Part of subcall function 04284778: EnterCriticalSection.KERNEL32(?,042BDE34,042BDE34,?,04284858,?,?,?,?,?,?,?,?,00000000,04284870), ref: 04284796

CreateCompatibleDC.GDI32(00000000), ref: 04284B64
SelectObject.GDI32(?,?), ref: 04284B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 04284C70
SetTextColor.GDI32(?,00000000), ref: 04284C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 04284C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 04284CC5
SetTextColor.GDI32(?,?), ref: 04284CD5
SetBkColor.GDI32(?,?), ref: 04284CE5
SelectObject.GDI32(?,00000000), ref: 04284D15
DeleteDC.GDI32(?), ref: 04284D1E

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 950c0ef5ed783631cebba293563f4dce4ebb3964d4dd5d1a63f53b5984b4c923
Instruction ID: 3d9cbf21f525adc88a231d64ece32a7749074a0860b2aac1b08f00d061bf7160
Opcode Fuzzy Hash: 950c0ef5ed783631cebba293563f4dce4ebb3964d4dd5d1a63f53b5984b4c923
Instruction Fuzzy Hash: E191B275A11219AFDB40EFA8C980E9EBBF9EF4D204B104499F954EB260D734FD50CB60

Function 041A85C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 041A85DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 041A85E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 041A85F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 041A85FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,041A8676,?,00000000,?,GetLogicalProcessorInformation), ref: 041A862A

Strings

GetLogicalProcessorInformation, xrefs: 041A85D3
@, xrefs: 041A867D
kernel32.dll, xrefs: 041A85D8

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: a64d3d8a5da635328273f6d83f4a4d80122c86c6425ef30c9480cb541a75ae1c
Instruction ID: d920f0b782e61bdda44c6b80b8c8f6b0db276e3601ed1e708929585901d4f3c9
Opcode Fuzzy Hash: a64d3d8a5da635328273f6d83f4a4d80122c86c6425ef30c9480cb541a75ae1c
Instruction Fuzzy Hash: F8117279D04208AEFB10FFB4C984AADBBF5EF40218F1888A5D41897141E775AA608A51

Function 041B0594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 041B064C

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 53bee3d0f560033fde656a8cb9731df190c4ce427a8026fd6a5e3defdbec8e0a
Instruction ID: cffc43154fb3fbe26e89ff9048af164497214055569d5fe497f817d085c80558
Opcode Fuzzy Hash: 53bee3d0f560033fde656a8cb9731df190c4ce427a8026fd6a5e3defdbec8e0a
Instruction Fuzzy Hash: 2FA19975E012089FDB24DFA8D8C4BEEBBF5EF48310F118169E995A7280DB74B940CB90

Function 042A966C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,042A98D1,?,00000000,?,00000000), ref: 042A96EE
IsBadReadPtr.KERNEL32(?,00000014), ref: 042A98A2

Strings

BuildImportTable: GetProcAddress failed, xrefs: 042A9875
BuildImportTable: can't load library: , xrefs: 042A9735
BuildImportTable: ReallocMemory failed, xrefs: 042A9780

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: 01b872cccff0ad5a312731777253a1d2a4f3b71fc9a9ce81f46d5c064323d5e5
Instruction ID: 26abe74c7d0dc291157cb98db21063b203c6c0dd41bebf0463fe2d8130d84f3a
Opcode Fuzzy Hash: 01b872cccff0ad5a312731777253a1d2a4f3b71fc9a9ce81f46d5c064323d5e5
Instruction Fuzzy Hash: 6F716CB4B10205AFEB10EB69CC80BAAB7F8EF88314F4488A4E955DB250D774BD95CF51

Function 041D0A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 041D0AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 041D0B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 041D0B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 041D0BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 041D0BD8
VariantCopy.OLEAUT32(?), ref: 041D0C0D

Strings

, xrefs: 041D0A6E

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: 2181d2a7ab8d2d404c8fd8469b930a33941118c69d6549a58ce243c340ade0c8
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 355109B5A0062D9FDB22DB58CCC0BD9B7BCAF4C208F0042D9E549A7255D730AF848F65

Function 04289A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 04289AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 04289AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 04289AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 04289B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 04289B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 04289B43

Strings

`, xrefs: 04289A8B

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 4b5c4fadfb11bbeac66a9e8ee9f84c1508ece52594c13beba27e57f757eea11f
Instruction ID: 08c8653c70e3c166b458271995d24886c8023be944cfd05defd6470db2326064
Opcode Fuzzy Hash: 4b5c4fadfb11bbeac66a9e8ee9f84c1508ece52594c13beba27e57f757eea11f
Instruction Fuzzy Hash: 95411FB5E11209AFDB40EFA8C884AEEB7F9FF48710F508559E954EB240D734AD40CB64

Function 041A591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 041A59D3
Sleep.KERNEL32(0000000A,00000000), ref: 041A59E9
Sleep.KERNEL32(00000000), ref: 041A5A17
Sleep.KERNEL32(0000000A,00000000), ref: 041A5A2D

Strings

@., xrefs: 041A5AB4, 041A5AD6, 041A5BEC, 041A5C02

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: 8d9ddbc491c7171e2e0983d4b8e4747a96593749524b2b66b14e4354473aa496
Instruction ID: 66bf4f9f0710268eb19bfa5184cb9c3f7236e8b5e5907d673eb7dd865c765632
Opcode Fuzzy Hash: 8d9ddbc491c7171e2e0983d4b8e4747a96593749524b2b66b14e4354473aa496
Instruction Fuzzy Hash: EBC1447A709201AFD715CF2CE8C8356BBE6EB84321F1881AED4498F386C374A865C7D0

Function 041A5CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,041A5912), ref: 041A5D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,041A5912), ref: 041A5D50

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 09313020e5932081b3700b7e2bf9280be4c722591c3c9a5f208ba7e35b137ce1
Instruction ID: a4d78268a6e1cca3a40dab6fdccbaef1d05ad1d1b14e9edf131344de42a61265
Opcode Fuzzy Hash: 09313020e5932081b3700b7e2bf9280be4c722591c3c9a5f208ba7e35b137ce1
Instruction Fuzzy Hash: 83713539708300AFE715DF68D8C8B16BBD6EF85318F1882AED4888B396D770E851C791

Function 041C66A0 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 041C64A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,041C6654), ref: 041C64DB
Part of subcall function 041C64A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 041C64FF
Part of subcall function 041C64A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 041C651A
Part of subcall function 041C64A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 041C65B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,041C67C5), ref: 041C6701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041C6734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041C6746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 041C674C
GetStdHandle.KERNEL32(000000F4,041C67E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 041C6760
WriteFile.KERNEL32(00000000,000000F4,041C67E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 041C6766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 041C678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 041C67A4

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: 40037d14512373ec4716c2531c0a542a3bc6d18bf0dcd2c6497d46bb8b5cba4c
Instruction ID: 6a283e038107ecadfe6167b2cf451ce2811ecb8aca70e726dd36af8d4133020a
Opcode Fuzzy Hash: 40037d14512373ec4716c2531c0a542a3bc6d18bf0dcd2c6497d46bb8b5cba4c
Instruction Fuzzy Hash: BC318475644208BFFB14E7A4DCC2FDA73ACEB44704F504065BA54E61C0DB74BE548BA4

Function 04286084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 042860B2
GetDeviceCaps.GDI32(?,00000068), ref: 042860CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 042860ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 04286111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 0428612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 04286143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 04286163
ReleaseDC.USER32(00000000,?), ref: 0428617B

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 89a61c66d6103ff571c2999a060a05cf15fe09332aa30de964ec1f17566a508c
Instruction ID: d3ead185b9fad3cad382c54f5db97b113d04e8bad3bc09ae986adde566655560
Opcode Fuzzy Hash: 89a61c66d6103ff571c2999a060a05cf15fe09332aa30de964ec1f17566a508c
Instruction Fuzzy Hash: 032141B5A50208BBEB50EBA4CD85FAE73ACEB08704F900495FB48E71C1D675BE508B64

Function 041A5E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e761eb783a681b89862f9f0882c2ec7475ad6c5ce1ad774399e92d01092d6da
Instruction ID: be20979d3e9c9406c2f7e062729305fd3fa755caf6ab99019b948c721323a985
Opcode Fuzzy Hash: 4e761eb783a681b89862f9f0882c2ec7475ad6c5ce1ad774399e92d01092d6da
Instruction Fuzzy Hash: 57C1376A7182006BE714AA7CDCC836EB787DBC4325F6C867EE254CB385DB74E8658350

Function 0429C798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0429C400: DeleteObject.GDI32(?), ref: 0429C40B
Part of subcall function 0429C400: DeleteDC.GDI32(?), ref: 0429C418
Part of subcall function 0429C400: DeleteObject.GDI32(?), ref: 0429C434

CreateCompatibleDC.GDI32(00000000), ref: 0429C903
CreateHalftonePalette.GDI32(?,00000000), ref: 0429C93E
ResizePalette.GDI32(?,00000001), ref: 0429C973
SelectPalette.GDI32(?,?,00000000), ref: 0429C998
RealizePalette.GDI32(?), ref: 0429C9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 0429C9CE
SelectObject.GDI32(?,00000000), ref: 0429C9E1

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: 62694a3ea9b130214b9131284b9b512e777235fb754c4951880a12379a31d5ff
Instruction ID: b4b0020d5c03689479bca7dddccb9e03fe83f2a7286246f2e90257ee1abf4e4e
Opcode Fuzzy Hash: 62694a3ea9b130214b9131284b9b512e777235fb754c4951880a12379a31d5ff
Instruction Fuzzy Hash: EC7111757105609FEB44DB29C8D4BA633E5EB4A304F0541E6E6088F3AAD670FC4ACB96

Function 041A8850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 041A8CDC: GetCurrentThreadId.KERNEL32 ref: 041A8CDF

GetTickCount.KERNEL32 ref: 041A8887
GetTickCount.KERNEL32 ref: 041A889F
GetCurrentThreadId.KERNEL32 ref: 041A88CE
GetTickCount.KERNEL32 ref: 041A88F9
GetTickCount.KERNEL32 ref: 041A8930
GetTickCount.KERNEL32 ref: 041A895A
GetCurrentThreadId.KERNEL32 ref: 041A89CA

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: b37379a46fb9f2216abbdd8349879555c5857fac30bfaf51441cbd8bdcaf403a
Instruction ID: 63f0eccfaeadea76b39ee2a093d2d3a873105379151d6ae66734f944b542b1fd
Opcode Fuzzy Hash: b37379a46fb9f2216abbdd8349879555c5857fac30bfaf51441cbd8bdcaf403a
Instruction Fuzzy Hash: 71417B782083419EE721FE3CC8C432EBAD1AFC5358F05896DD4D88B281EBB5A4A4D753

Function 0428A090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 0428A0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 0428A0F9
GetDC.USER32(00000000), ref: 0428A110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,0428A1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 0428A134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,0428A1AB,?,?,00000000,00000000,00000008,?,00000000,0428A1CB), ref: 0428A167

Strings

`, xrefs: 0428A0C8

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: 2ff4b193fd7c6cc2ab71d4d7734d054476a4b3defab13673c9fb42f3f00b6bcb
Instruction ID: 26ab02f73d98f54c506be497b1cb5f14dab7288868b468dec3fc7bf380475b56
Opcode Fuzzy Hash: 2ff4b193fd7c6cc2ab71d4d7734d054476a4b3defab13673c9fb42f3f00b6bcb
Instruction Fuzzy Hash: 03315075B10208ABEB00EFE4D881AAEB7B8EF08704F504455F954EB280D775BE10DBA5

Function 0428E9A8 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 0428E9B4
IsEqualGUID.OLE32(?,042B2700), ref: 0428E9D5
IsEqualGUID.OLE32(?,042B2710), ref: 0428E9EB

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Equal
String ID:
API String ID: 4016716531-0
Opcode ID: e63da030ef8c06ad14f5a73eae3ddee65221173da9cb2f93eec1a62672c87021
Instruction ID: 17a7a485097ab959fb2c643ea38e4ab58a3f48c991112303371a3a4b0b938466
Opcode Fuzzy Hash: e63da030ef8c06ad14f5a73eae3ddee65221173da9cb2f93eec1a62672c87021
Instruction Fuzzy Hash: 9411E7713225409EEB51EB68DDC4BBA275CAF86304F45108AED61CF2C2E3D5A845CBB6

Function 0428A974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 042862F0: GetObjectW.GDI32(00000000,00000004), ref: 04286307
Part of subcall function 042862F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 0428632A

GetDC.USER32(00000000), ref: 0428A9B2
CreateCompatibleDC.GDI32(?), ref: 0428A9BE
SelectObject.GDI32(?), ref: 0428A9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,0428AA23,?,?,?,?,00000000), ref: 0428A9EF
SelectObject.GDI32(?,?), ref: 0428AA09
DeleteDC.GDI32(?), ref: 0428AA12
ReleaseDC.USER32(00000000,?), ref: 0428AA1D

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: f481ef0fbbe1f985dec2e769ed736646c75444142fe50cf721347157ee490675
Instruction ID: 1a4b352ab77bb9ceca31e2ee122ce0b59c183d550dc8c96e2a3da8e940e0f661
Opcode Fuzzy Hash: f481ef0fbbe1f985dec2e769ed736646c75444142fe50cf721347157ee490675
Instruction Fuzzy Hash: 31112772E112197FEB10EBD4CC91AEEB3BCEB09714F5044A6E914D7640DB74BD608790

Function 041A98D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041A998E,?,?,?,?,041A9AA2,041A6F13,041A6F5A,?,?), ref: 041A9909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041A998E,?,?,?,?,041A9AA2,041A6F13,041A6F5A,?), ref: 041A990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041A998E,?,?,?), ref: 041A992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,041A998E), ref: 041A9930

Strings

Runtime error at 00000000, xrefs: 041A9902, 041A9947
Error, xrefs: 041A9942

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: f092a7c5a8bd5a2ce8c1d3fdadc9836c5ecc6ab4943d0824ed9395cf35f2929f
Instruction ID: ac6d8777eb32b21b40f3cde33c142b4f311d3b9d77ae220551061f1b786b7afa
Opcode Fuzzy Hash: f092a7c5a8bd5a2ce8c1d3fdadc9836c5ecc6ab4943d0824ed9395cf35f2929f
Instruction Fuzzy Hash: 76F09C98758340BEF720B7786EC9F5A275C9704B1CF1C5945B714680C1C7A874E587A2

Function 042865E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0428662E
GetSystemMetrics.USER32(0000000C), ref: 0428663A
GetDC.USER32(00000000), ref: 04286656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0428667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0428668A
ReleaseDC.USER32(00000000,00000000), ref: 042866C3

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: e5a1cb617a060cb889d45753c96a7e1c3688e39657a78b7e6e7fc5ecd4239618
Instruction ID: 2d2023c2b0a09d13250b3a39e3edcb38769a0610da392d82070881ba6f134238
Opcode Fuzzy Hash: e5a1cb617a060cb889d45753c96a7e1c3688e39657a78b7e6e7fc5ecd4239618
Instruction Fuzzy Hash: A2318474B00249EFEB00EF94C881AAEBBB5FF49710F008569E914AB384C774B940CFA1

Function 04286234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 04286252
SelectObject.GDI32(00000000,00000000), ref: 0428625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,0428C367), ref: 0428626F
SelectObject.GDI32(00000000,00000000), ref: 0428627B
DeleteDC.GDI32(00000000), ref: 04286281
CreatePalette.GDI32 ref: 042862DC

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 896f4745d74bc88d2cfa87e7e403eaae377fe1fbe97d90ffedfc2e006db8c7f3
Instruction ID: 60ec3af8d3ccc6e1187a81cd1b62dda05824fa6a95c24e23b19b12d3c4782e15
Opcode Fuzzy Hash: 896f4745d74bc88d2cfa87e7e403eaae377fe1fbe97d90ffedfc2e006db8c7f3
Instruction Fuzzy Hash: CC11E32131530832F314B7A58C81BAF72A8DFC1318F00882EF985D72C1EA78B85983D2

Function 04286A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04286950: GetObjectW.GDI32(?,00000054), ref: 04286964

CreateCompatibleDC.GDI32(00000000), ref: 04286ABE
SelectPalette.GDI32(?,?,00000000), ref: 04286ADF
RealizePalette.GDI32(?), ref: 04286AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 04286B02
SelectPalette.GDI32(?,00000000,00000000), ref: 04286B2A
DeleteDC.GDI32(?), ref: 04286B33

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 8e8012d4b9e55395a5450586399a9ec9b0aa5b7538f5b43daf13904a38c96b1e
Instruction ID: 6918cf868e8b725852970840978cad519d63597df7fc92809751795582e7ccbf
Opcode Fuzzy Hash: 8e8012d4b9e55395a5450586399a9ec9b0aa5b7538f5b43daf13904a38c96b1e
Instruction Fuzzy Hash: 51114F75B102087FEB11EBA8CC81F9EB7ECEB49714F508465F924E7280D674B9108BA4

Function 041A61E4 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,041A5358,00000000,?,00000000,?,?,00000000,041A6B8F), ref: 041A6206
WriteFile.KERNEL32(00000000,000000F4,041A5358,00000000,?,00000000,?,?,00000000,041A6B8F), ref: 041A620C
GetStdHandle.KERNEL32(000000F4,041A5354,00000000,?,00000000,00000000,000000F4,041A5358,00000000,?,00000000,?,?,00000000,041A6B8F), ref: 041A622B
WriteFile.KERNEL32(00000000,000000F4,041A5354,00000000,?,00000000,00000000,000000F4,041A5358,00000000,?,00000000,?,?,00000000,041A6B8F), ref: 041A6231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,041A5354,00000000,?,00000000,00000000,000000F4,041A5358,00000000,?), ref: 041A6248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,041A5354,00000000,?,00000000,00000000,000000F4,041A5358,00000000), ref: 041A624E

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: db43c274eb695dba488458f4da369eaf7710f5aabf23f82ec6021532b3d70c3f
Instruction ID: 18fca459e405812019139dca677a9e095808d72ade4019cc6b08a10073005c5b
Opcode Fuzzy Hash: db43c274eb695dba488458f4da369eaf7710f5aabf23f82ec6021532b3d70c3f
Instruction Fuzzy Hash: A501319974C610BEF250F6B8ADC8F6B378DDF48669F110B117618D20C1C764BC608371

Function 041C64A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,041C6654), ref: 041C64DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 041C64FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 041C651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 041C65B5

Strings

MZP, xrefs: 041C6519

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: dc9e8f57fe94e9ac4c7456bdc2cd78d89202b52c0d3e600d02032372319b73ca
Instruction ID: d33f189839ca27c9f7ed81c8a25b792c07f6c5e3de70e41880f8a7d0f3b6fd23
Opcode Fuzzy Hash: dc9e8f57fe94e9ac4c7456bdc2cd78d89202b52c0d3e600d02032372319b73ca
Instruction Fuzzy Hash: 7E414C70A002589FEB20EF68CDC4BD9B7B9AB69304F4044E9E508E7244D775BEA4CF50

Function 0428D0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0428D17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 0428D189
ReleaseDC.USER32(00000000,00000000), ref: 0428D198
DeleteObject.GDI32(00000000), ref: 0428D206

Strings

(, xrefs: 0428D133

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: f1e5ee8075f513ab21e3c45c9ac972d46e993cad013546342ee583ceeadff4fa
Instruction ID: 0e6ec0c91afa2da048a62b4c913964b2c31c18d6ca8c32b29eb412a8c5d30b06
Opcode Fuzzy Hash: f1e5ee8075f513ab21e3c45c9ac972d46e993cad013546342ee583ceeadff4fa
Instruction Fuzzy Hash: 18418070B25208AFEB10EBA8C884ADDBBF5EF49304F5040A9E405A73D5D774BA49DB90

Function 041D690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b87468e3847b883c77fee901e2fb37df406cb36c9271365919e7c21faaf2066
Instruction ID: 63da9c409ad2e2ff272fa3a10fbe5b09d73e679ceaf1d079a41a83c3c5329e58
Opcode Fuzzy Hash: 0b87468e3847b883c77fee901e2fb37df406cb36c9271365919e7c21faaf2066
Instruction Fuzzy Hash: F2D19DB5A00248AFDB00EFA4C4D09FDFBB9EF49314F8440A5E840A7215E734BE95DB61

Function 042A1CB0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 042A1CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 042A1D28
SelectObject.GDI32(?,?), ref: 042A1D38
DeleteObject.GDI32(?), ref: 042A1F51
DeleteDC.GDI32(?), ref: 042A1F5D

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID:
API String ID: 2986811175-0
Opcode ID: c068262352e687c8233119745f4ee42baa496bd91ca2b26397f1e72ed32b028d
Instruction ID: ef47716867d26b93214158e8d9af3442e2b5f636d7d9a9f35f9ee8ebcf96cc4b
Opcode Fuzzy Hash: c068262352e687c8233119745f4ee42baa496bd91ca2b26397f1e72ed32b028d
Instruction Fuzzy Hash: 82B1B2B4E102099FDB40DFA8C984AAEBBF5FF48314F2485A5E814AB365D730AE51CF50

Function 04290894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 042908C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 042908F3
memcpy.MSVCRT(00000000,?,?), ref: 04290989
memcpy.MSVCRT(00000000,?,?), ref: 0429099F
memcpy.MSVCRT(00000000,?,?), ref: 042909B5
memcpy.MSVCRT(00000000,?,?), ref: 042909C9

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: c8846fd7540f1fe14b28bc92c146c638bc5917efea0df63089ec4684867dd551
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 295172B1611600AFDB14DF68D8C4AA677E8BF88314F18866DED098F286E731E950CB94

Function 042A9C34 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,042A9289,?,?,?,?,?,00000000,00000000), ref: 042A9CA4
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,042A9289,?,?,?,?,?,00000000,00000000), ref: 042A9CD3
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,042A9289,?,?,?,?,?,00000000,00000000), ref: 042A9CDE
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,042A9289,?,?,?,?,?,00000000,00000000), ref: 042A9CE4
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,042A9289,?,?,?,?,?,00000000,00000000), ref: 042A9D24

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: 6c87c55ef74451c151aa42b0c33d672fe581d1cef8e4092844a668772ecbbf3c
Instruction ID: 589804106b08145ed6ca1af40b1a4e3a149a54d382c9aa945721837d5e716a09
Opcode Fuzzy Hash: 6c87c55ef74451c151aa42b0c33d672fe581d1cef8e4092844a668772ecbbf3c
Instruction Fuzzy Hash: CC318EB4700A06AFE310EE6ACC84F66B3E9FF88714F144A59E954CB250C730F8A587E0

Function 0428C31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0428C372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0428C387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0428C391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0428A7DB,00000000,0428A867), ref: 0428C3B5
ReleaseDC.USER32(00000000,00000000), ref: 0428C3C0

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 300ff3b2699b6e7631452a4ffaee99bda4606e1ffd29bc650c5319b07b44bd4a
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: DA11D33171229AAEFB30BF66C8807EE7690AF45315F041029FC509A1C0C7B4B9E2C7B1

Function 0428619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 042861B4
GetDeviceCaps.GDI32(?,00000068), ref: 042861D0
GetPaletteEntries.GDI32(02080EE8,00000000,00000008,?), ref: 042861E8
GetPaletteEntries.GDI32(02080EE8,00000008,00000008,?), ref: 04286200
ReleaseDC.USER32(00000000,?), ref: 0428621C

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: 7e2d20e004124a2f5d52c0d2159036f3379a4130c7f6e839a5a1428da745b40e
Instruction ID: f6562216a0fbf8f65d8a727795c15acdea4893ce3c79e0f0b4908f9b65b9ae6c
Opcode Fuzzy Hash: 7e2d20e004124a2f5d52c0d2159036f3379a4130c7f6e839a5a1428da745b40e
Instruction Fuzzy Hash: E311CC317483087EF710DA98EC86FAD7BA8E749714F408499F954D61C0DA767414C7A1

Function 041C3C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,041C3D0B), ref: 041C3CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,041C3D0B), ref: 041C3CB4

Strings

yyyy, xrefs: 041C3C89
, xrefs: 041C3C7A

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: b2e4937b44827b1fa0fd494f707d858bd8213221fd8e927cabedd096613af3e2
Instruction ID: 6aefe4c1347d2ea8b442b518d0ee2bd63eea2bbea74bba75eab26a02b07dc737
Opcode Fuzzy Hash: b2e4937b44827b1fa0fd494f707d858bd8213221fd8e927cabedd096613af3e2
Instruction Fuzzy Hash: 6A21837560061C9BEB10DF94C9C16AEB3F9EF18750F5180AAEC15E7240D730BE50C765

Function 04283ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 04283EF7
GetObjectW.GDI32(?,00000010,?), ref: 04283F0A
GetObjectW.GDI32(?,00000000,?), ref: 04283F63

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: 1c54391c7ebd9ee3a70764e74ef8e5d833e02361cf78e9c14b378286e8fed240
Instruction ID: ec1db03335a562f1e29ac5527773a08e34981b706d7bc0758b9d3c08f83a574e
Opcode Fuzzy Hash: 1c54391c7ebd9ee3a70764e74ef8e5d833e02361cf78e9c14b378286e8fed240
Instruction Fuzzy Hash: A131BE71715344AFE720EF69C884DAEBBF9EF59610B14846DEC94DB692D271F8008BA0

Function 041AC998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 041AC9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 041ACA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 041ACA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 041ACA97

Part of subcall function 041AC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,041ACA15), ref: 041AC96B
Part of subcall function 041AC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,041ACA15), ref: 041AC988

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 3ecf6e8377b3506c6f08e01cce10ecf9638f05a258b66c4febc1275c84bf21fb
Instruction ID: a174aa62adabb8b79c3a445b839121a35a724420cb900c4fdd64f936d07a9f9c
Opcode Fuzzy Hash: 3ecf6e8377b3506c6f08e01cce10ecf9638f05a258b66c4febc1275c84bf21fb
Instruction Fuzzy Hash: 7F313C74E0021E9BDB10DFA8D8C4ABEB7B5EF44304F0041A5D569E7291FB74AA15CBD0

Function 0428A788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 04284778: EnterCriticalSection.KERNEL32(042BDE34,?,04284858,?,?,?,?,?,?,?,?,00000000,04284870,?,042BDE34), ref: 04284780
Part of subcall function 04284778: LeaveCriticalSection.KERNEL32(042BDE34,042BDE34,?,04284858,?,?,?,?,?,?,?,?,00000000,04284870,?,042BDE34), ref: 0428478D
Part of subcall function 04284778: EnterCriticalSection.KERNEL32(?,042BDE34,042BDE34,?,04284858,?,?,?,?,?,?,?,?,00000000,04284870), ref: 04284796

Part of subcall function 0428C31C: GetDC.USER32(00000000), ref: 0428C372
Part of subcall function 0428C31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0428C387
Part of subcall function 0428C31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 0428C391
Part of subcall function 0428C31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,0428A7DB,00000000,0428A867), ref: 0428C3B5
Part of subcall function 0428C31C: ReleaseDC.USER32(00000000,00000000), ref: 0428C3C0

CreateCompatibleDC.GDI32(00000000), ref: 0428A7DD
SelectObject.GDI32(00000000,?), ref: 0428A7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 0428A81F
RealizePalette.GDI32(00000000), ref: 0428A82B

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 327e841a01aa338a1f20c33ea747b8facea76fb9a0afc81295ebffaa62ce26f8
Instruction ID: 440bbd0df59fd424b27f9866714c20aba9f7a1a094f01a3a5af293211aeaee8c
Opcode Fuzzy Hash: 327e841a01aa338a1f20c33ea747b8facea76fb9a0afc81295ebffaa62ce26f8
Instruction Fuzzy Hash: 1531F834B11648EFE704EB59D980D5DB3F5EF48714B6241A9E804AB361D730FE41DB90

Function 0428DF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 0428DFAD
GetObjectW.GDI32(?,00000018,?), ref: 0428DFCE
DeleteObject.GDI32(?), ref: 0428DFFA
DeleteObject.GDI32(?), ref: 0428E003

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 6a59c8ea6b5af4afaefc9abe2b8a55c85add178322b21e3b7496fec8a05f665b
Instruction ID: 2a42838b27f380ad1ca12cdd17e5ea36edecbb8801f896f90b473ecfa0a59676
Opcode Fuzzy Hash: 6a59c8ea6b5af4afaefc9abe2b8a55c85add178322b21e3b7496fec8a05f665b
Instruction Fuzzy Hash: 61114F75B10208AFDB04EFE9C981D9EB7F9FB48310B5188A9E904E7690DB30ED10DA90

Function 0424A910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,0424A7FE,00000000,?), ref: 0424A927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,0424A7FE,00000000,?), ref: 0424A941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,0424A7FE,00000000,?), ref: 0424A95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,0424A7FE,00000000), ref: 0424A965

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: 3b79ecb9add41238a0f754a0051cf54e1db40d12fdccc583b99afc1a02426c7a
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 3BF031736456087F6748EE9CAC80D5B77ECEE892643100169FD58D7205DA30FD1147B8

Function 0428EDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0428EDD9
SelectObject.GDI32(00000000,058A00B4), ref: 0428EDEB
GetTextMetricsW.GDI32(00000000), ref: 0428EDF6
ReleaseDC.USER32(00000000,00000000), ref: 0428EE07

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 6ccbac124ffcdb227fa9650dda41257d31d88110fead965b61086238d93b3a23
Instruction ID: af58a188ef62b4d137ee9876f8c831a64abbae073e52417491382cae7d486ce9
Opcode Fuzzy Hash: 6ccbac124ffcdb227fa9650dda41257d31d88110fead965b61086238d93b3a23
Instruction Fuzzy Hash: 83E04F6271356632E55171691DC5BDF26488F026B9F490125FDA4D92C0DB05FD20C3F3

Function 0428EBA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 0428ECF4

Strings

, xrefs: 0428EC8B
,, xrefs: 0428EC6A

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: a42d7e03d78ce83a7e6c0e8ad20d87bc85daef44678e22dc2272276be1c590dc
Instruction ID: 426bc0eb929bf09afaa25ee48d8780c52c264ff626e39cd07a0a01c1e7397b84
Opcode Fuzzy Hash: a42d7e03d78ce83a7e6c0e8ad20d87bc85daef44678e22dc2272276be1c590dc
Instruction Fuzzy Hash: F051D274A10208AFEB40DF99D884E9EB7F9FB48314F5180A5E914EB3A1D730EE04CB50

Function 0428E3C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 0428E4B2

Strings

, xrefs: 0428E483
,, xrefs: 0428E468

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: 5428ab28e61efaf4bc8f4ab6e2d13dc9badcc63b58b8a0344397470200a7bf0e
Instruction ID: f7ec396be51cd55cef2f786b241d655214bfaafb4489ef28b125eca7b5e6b7c9
Opcode Fuzzy Hash: 5428ab28e61efaf4bc8f4ab6e2d13dc9badcc63b58b8a0344397470200a7bf0e
Instruction Fuzzy Hash: A64143B1A10104AFEB40EF68D884A9A77F9EF49314B6201A5EC08EB256D770FD44CBA0

Function 042A9A14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 042A9A61
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 042A9AE6

Strings

FinalizeSections: VirtualProtect failed, xrefs: 042A9AF4

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: dd10d5a18478b088ea4cc44379de7c44a42d6f37d84b14e7dd105582614a063c
Instruction ID: f7911c913aab24bb00f785aaf3db4e60c089c237997f74d67222ad2e456e5c97
Opcode Fuzzy Hash: dd10d5a18478b088ea4cc44379de7c44a42d6f37d84b14e7dd105582614a063c
Instruction Fuzzy Hash: 6231F2B47102069FE710DE5AC985F9AB7E8BF08384F144881FE54DB2A2D330F9A4CB90

Function 041C8748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,041CBB77,00000000,041CBCB7), ref: 041C8707

Strings

Z, xrefs: 041C8763
A, xrefs: 041C875E

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: 6a22bed413e86a1fba38ba05e8bca451dfb3ff59c540920c6a1a9bd24875fb4d
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 141156227857101BF724747F5CC47FF958ACB962A6F49023EE545C72C0FA14AC015291

Function 04289928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,042899F3), ref: 042899AB

Strings

EMF, xrefs: 0428994B
l, xrefs: 04289959

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: 6f59ef58d9bde9d91479a935b31c60c625d74c9213eebedd552cab32e32052f1
Instruction ID: ecd4488a8a3899354affa27e7ae8a9b75b966d12d3d61df281eae78145d74afb
Opcode Fuzzy Hash: 6f59ef58d9bde9d91479a935b31c60c625d74c9213eebedd552cab32e32052f1
Instruction Fuzzy Hash: 6F213A75A21208DFEB10EFA8C8D0A6EB7F5FF88714B544568D4049B688DB34BD418B55

Function 041C89EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,042AE4DB,00000000,042AE512), ref: 041C89F2

Part of subcall function 041B39B0: GetProcAddress.KERNEL32(041DC998,?), ref: 041B39DA

Strings

GetDiskFreeSpaceExW, xrefs: 041C89FD
kernel32.dll, xrefs: 041C89ED

Memory Dump Source

Source File: 00000020.00000002.1735896782.00000000041A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 041A0000, based on PE: true

Associated: 00000020.00000002.1735877666.00000000041A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735974116.00000000042AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1735994917.00000000042B0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736014243.00000000042B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736034713.00000000042B5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736053344.00000000042B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736072248.00000000042BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736107889.00000000042C0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736126046.00000000042C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.1736143419.00000000042C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_41a0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: afce1cb4e323ff33b8b24fedbcbeb4c091022aba92c97ab3aa345adbb1942fee
Instruction ID: f97d9d2e6d8b0373da1b56fb014036a9cb1f823b4de4f0928780250b2b89df74
Opcode Fuzzy Hash: afce1cb4e323ff33b8b24fedbcbeb4c091022aba92c97ab3aa345adbb1942fee
Instruction Fuzzy Hash: CCD0A7B0B003465FF710BFA97EC47122284EB60607B40112DFA4955702D7FDF8208B80

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report y2WSfG9g8W.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2129def29827316c53fa9262167235f70c4ed97_7522e4b5_8e2d9f83-882f-46d0-afb1-35170efa58d3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e0abdff3bd5dbbcc6e35e11a1c7aa362b1b4caa9_7522e4b5_791ed9c4-594e-4462-b830-7a8b482104f0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e0abdff3bd5dbbcc6e35e11a1c7aa362b1b4caa9_7522e4b5_9c1f6d5c-8190-42b3-9ff4-ecf9ba67352f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A59.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EA0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EC0.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC513.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC551.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5FE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC64C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC65D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6BA.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
y2WSfG9g8W.dll