Edit tour

Windows Analysis Report
dRs2BksGEy.dll

Overview

General Information

Sample name:	dRs2BksGEy.dll renamed because original name is a hash value
Original sample name:	5314ad14c81fa4099d8608c95c82d31f07d32a5c4c407c5ec3c3508a28e72b41.dll
Analysis ID:	1544794
MD5:	5408904cb76332f662c09afa85c2e530
SHA1:	d0dc9556efac593d89f07c308a0edd6b58fe6f0e
SHA256:	5314ad14c81fa4099d8608c95c82d31f07d32a5c4c407c5ec3c3508a28e72b41
Tags:	2024bankerdllgolangloadermekotiouser-johnk3r
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 2768 cmdline: loaddll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1608 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 5940 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6740 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 828 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 5424 cmdline: rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6880 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 836 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 5700 cmdline: rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 792 cmdline: rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5552 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 5480 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 824 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 2036 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6840 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1872 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",_cgo_dummy_export MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5548 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellSpell MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3404 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellInit MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4004 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellFree MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5908 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SignalInitializeCrashReporting MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6544 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",GetInstallDetailsPayload MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5196 cmdline: rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarRecognize MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Bitcoin Miner

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D211830	3_2_6D211830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFD1830	13_2_6CFD1830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFD1830	17_2_6CFD1830

Source: dRs2BksGEy.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: dRs2BksGEy.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	3_2_6D1E2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	3_2_6D1E2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp], edx	3_2_6D1FCEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ebp, 0Dh	3_2_6D209030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ecx, 0Dh	3_2_6D20A360
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	13_2_6CFA2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	13_2_6CFA2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp], edx	13_2_6CFBCEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ebp, 0Dh	13_2_6CFC9030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ecx, 0Dh	13_2_6CFCA360
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	17_2_6CFA2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	17_2_6CFA2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov dword ptr [esp], edx	17_2_6CFBCEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ebp, 0Dh	17_2_6CFC9030
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then shr ecx, 0Dh	17_2_6CFCA360

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D211A70 NtCreateWaitCompletionPacket,	3_2_6D211A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D212A90 NtCreateWaitCompletionPacket,	3_2_6D212A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D211570 NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,	3_2_6D211570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D2111F0 NtCancelWaitCompletionPacket,NtAssociateWaitCompletionPacket,	3_2_6D2111F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFD2A90 NtCreateWaitCompletionPacket,	13_2_6CFD2A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFD1A70 NtCreateWaitCompletionPacket,	13_2_6CFD1A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFD1570 NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,	13_2_6CFD1570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFD11F0 NtCancelWaitCompletionPacket,NtAssociateWaitCompletionPacket,	13_2_6CFD11F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFD2A90 NtCreateWaitCompletionPacket,	17_2_6CFD2A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFD1A70 NtCreateWaitCompletionPacket,	17_2_6CFD1A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFD1570 NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,	17_2_6CFD1570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFD11F0 NtCancelWaitCompletionPacket,NtAssociateWaitCompletionPacket,	17_2_6CFD11F0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D264D20	3_2_6D264D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20AD50	3_2_6D20AD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D23BC20	3_2_6D23BC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D266C20	3_2_6D266C20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1E2CA6	3_2_6D1E2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1E2CA0	3_2_6D1E2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D274F30	3_2_6D274F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D21CF90	3_2_6D21CF90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D272E70	3_2_6D272E70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1EBE90	3_2_6D1EBE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D25CEF0	3_2_6D25CEF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D235ED0	3_2_6D235ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20D9C5	3_2_6D20D9C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1F59F0	3_2_6D1F59F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D2659D0	3_2_6D2659D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D24A872	3_2_6D24A872
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20BB10	3_2_6D20BB10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1EFBC0	3_2_6D1EFBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20CA30	3_2_6D20CA30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1F0AF0	3_2_6D1F0AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D262560	3_2_6D262560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D238570	3_2_6D238570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D2695A0	3_2_6D2695A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D203400	3_2_6D203400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D226470	3_2_6D226470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D201440	3_2_6D201440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D25E740	3_2_6D25E740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D266740	3_2_6D266740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D206630	3_2_6D206630
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D23D6E0	3_2_6D23D6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20C6D0	3_2_6D20C6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D216010	3_2_6D216010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20D040	3_2_6D20D040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20C080	3_2_6D20C080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1F80A0	3_2_6D1F80A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1E90F0	3_2_6D1E90F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D21A320	3_2_6D21A320
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D24332F	3_2_6D24332F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D2093F0	3_2_6D2093F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D273230	3_2_6D273230
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D21E240	3_2_6D21E240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D247280	3_2_6D247280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1E32A0	3_2_6D1E32A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D20B2D0	3_2_6D20B2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D024D20	13_2_6D024D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFA2CA0	13_2_6CFA2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFA2CA6	13_2_6CFA2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFFBC20	13_2_6CFFBC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D026C20	13_2_6D026C20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCAD50	13_2_6CFCAD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFF5ED0	13_2_6CFF5ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D034F30	13_2_6D034F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFABE90	13_2_6CFABE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFDCF90	13_2_6CFDCF90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D032E70	13_2_6D032E70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D01CEF0	13_2_6D01CEF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D0259D0	13_2_6D0259D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFB59F0	13_2_6CFB59F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCD9C5	13_2_6CFCD9C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D00A872	13_2_6D00A872
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFB0AF0	13_2_6CFB0AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCCA30	13_2_6CFCCA30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFAFBC0	13_2_6CFAFBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCBB10	13_2_6CFCBB10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D022560	13_2_6D022560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFE6470	13_2_6CFE6470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D0295A0	13_2_6D0295A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFC1440	13_2_6CFC1440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFC3400	13_2_6CFC3400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFF8570	13_2_6CFF8570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFFD6E0	13_2_6CFFD6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCC6D0	13_2_6CFCC6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D01E740	13_2_6D01E740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D026740	13_2_6D026740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFC6630	13_2_6CFC6630
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFA90F0	13_2_6CFA90F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFB80A0	13_2_6CFB80A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCC080	13_2_6CFCC080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCD040	13_2_6CFCD040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFD6010	13_2_6CFD6010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFCB2D0	13_2_6CFCB2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D00332F	13_2_6D00332F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFA32A0	13_2_6CFA32A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFDE240	13_2_6CFDE240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFC93F0	13_2_6CFC93F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D033230	13_2_6D033230
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D007280	13_2_6D007280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6CFDA320	13_2_6CFDA320
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D024D20	17_2_6D024D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFA2CA0	17_2_6CFA2CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFA2CA6	17_2_6CFA2CA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFFBC20	17_2_6CFFBC20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D026C20	17_2_6D026C20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCAD50	17_2_6CFCAD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFF5ED0	17_2_6CFF5ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D034F30	17_2_6D034F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFABE90	17_2_6CFABE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFDCF90	17_2_6CFDCF90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D032E70	17_2_6D032E70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D01CEF0	17_2_6D01CEF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D0259D0	17_2_6D0259D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFB59F0	17_2_6CFB59F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCD9C5	17_2_6CFCD9C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D00A872	17_2_6D00A872
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFB0AF0	17_2_6CFB0AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCCA30	17_2_6CFCCA30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFAFBC0	17_2_6CFAFBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCBB10	17_2_6CFCBB10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D022560	17_2_6D022560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFE6470	17_2_6CFE6470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D0295A0	17_2_6D0295A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFC1440	17_2_6CFC1440
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFC3400	17_2_6CFC3400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFF8570	17_2_6CFF8570
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFFD6E0	17_2_6CFFD6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCC6D0	17_2_6CFCC6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D01E740	17_2_6D01E740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D026740	17_2_6D026740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFC6630	17_2_6CFC6630
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFA90F0	17_2_6CFA90F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFB80A0	17_2_6CFB80A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCC080	17_2_6CFCC080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCD040	17_2_6CFCD040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFD6010	17_2_6CFD6010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFCB2D0	17_2_6CFCB2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D00332F	17_2_6D00332F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFA32A0	17_2_6CFA32A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFDE240	17_2_6CFDE240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFC93F0	17_2_6CFC93F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D033230	17_2_6D033230
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D007280	17_2_6D007280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6CFDA320	17_2_6CFDA320

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D217410 appears 693 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D006A90 appears 962 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D246A90 appears 481 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CFA2C30 appears 34 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CFD7410 appears 1386 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CFD5080 appears 46 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D005740 appears 40 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CFD3B30 appears 32 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 836

Source: dRs2BksGEy.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: classification engine

Classification label: mal48.mine.winDLL@35/0@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D275B30 GetLastError,FormatMessageA,fprintf,LocalFree,

3_2_6D275B30

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d9df36c7-8e70-4530-a918-8d962597685f

Jump to behavior

Source: dRs2BksGEy.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarCreate

Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: brarylfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrun
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: hed/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spa
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: rundll32.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarCreate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 836
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 828
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarCreate
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",_cgo_dummy_export
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellSpell
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 824
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellInit
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellFree
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SignalInitializeCrashReporting
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",GetInstallDetailsPayload
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarRecognize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",_cgo_dummy_export	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellSpell	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellInit	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellFree	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SignalInitializeCrashReporting	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",GetInstallDetailsPayload	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarRecognize	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: dRs2BksGEy.dll

Static PE information: Image base 0x6d8c0000 > 0x60000000

Source: dRs2BksGEy.dll

Static file information: File size 1368576 > 1048576

Source: dRs2BksGEy.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D1E13E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6D1E13E0

Source: dRs2BksGEy.dll

Static PE information: real checksum: 0x158f05 should be: 0x1505df

Source: dRs2BksGEy.dll

Static PE information: section name: .eh_fram

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0143D74E push cs; ret	0_2_0143D74F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0143CD7A push ebp; retf	0_2_0143CD7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D255094 pushad ; ret	3_2_6D255095
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D25509D pushad ; ret	3_2_6D25509E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0543C8DE push esp; ret	11_2_0543C8F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_0543D7F9 pushfd ; iretd	11_2_0543D80C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_0503AF34 push eax; retf	12_2_0503AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D015094 pushad ; ret	13_2_6D015095
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D01509D pushad ; ret	13_2_6D01509E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04C3CD8B push esp; iretd	14_2_04C3CDAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04C3CD28 push eax; ret	14_2_04C3CD29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 14_2_04C3AF34 push eax; retf	14_2_04C3AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0503D2D3 push esp; ret	15_2_0503D2ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0503AF34 push eax; retf	15_2_0503AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D015094 pushad ; ret	17_2_6D015095
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D01509D pushad ; ret	17_2_6D01509E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 18_2_0503C34B pushfd ; retf	18_2_0503C369
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 18_2_0503AF34 push eax; retf	18_2_0503AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_0443C90D push ds; ret	20_2_0443C90E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 21_2_0483AF58 push eax; retf	21_2_0483AF61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 22_2_0543C39F pushad ; iretd	22_2_0543C3A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 22_2_0543AF34 push eax; retf	22_2_0543AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_0543AF34 push eax; retf	23_2_0543AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 24_2_0503C8B7 push ebp; retf	24_2_0503C8F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 24_2_0503AF34 push eax; retf	24_2_0503AF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 24_2_0503C39B push ebp; retf	24_2_0503C8F8

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D24C0C0 rdtscp

3_2_6D24C0C0

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.8 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 1.3 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D24C0C0 rdtscp

3_2_6D24C0C0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D1E13E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_6D1E13E0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D274F30 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,memcpy,memset,IsBadReadPtr,realloc,SetLastError,SetLastError,SetLastError,SetLastError,SetLastError,memcpy,SetLastError,SetLastError,SetLastError,SetLastError,

3_2_6D274F30

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D276300 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	3_2_6D276300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D2762FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	3_2_6D2762FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D036300 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	13_2_6D036300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 13_2_6D0362FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	13_2_6D0362FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D036300 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	17_2_6D036300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_6D0362FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	17_2_6D0362FC

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D276250 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_6D276250

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D211C90 RtlGetVersion,RtlGetCurrentPeb,

3_2_6D211C90

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dRs2BksGEy.dll	5%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544794
Start date and time:	2024-10-29 18:51:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dRs2BksGEy.dll renamed because original name is a hash value
Original Sample Name:	5314ad14c81fa4099d8608c95c82d31f07d32a5c4c407c5ec3c3508a28e72b41.dll
Detection:	MAL
Classification:	mal48.mine.winDLL@35/0@0/0
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 70% Number of executed functions: 7 Number of non-executed functions: 116
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll32.exe, PID 2768 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 2036 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 3404 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 4004 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5196 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5548 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5700 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5908 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5940 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 6544 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 6840 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 792 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: dRs2BksGEy.dll

Simulations

Behavior and APIs

Time	Type	Description
13:52:29	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.270971784420794
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dRs2BksGEy.dll
File size:	1'368'576 bytes
MD5:	5408904cb76332f662c09afa85c2e530
SHA1:	d0dc9556efac593d89f07c308a0edd6b58fe6f0e
SHA256:	5314ad14c81fa4099d8608c95c82d31f07d32a5c4c407c5ec3c3508a28e72b41
SHA512:	15bf68dc8a0256cd1548783274018382546d4c4deb75d53ed82c49c9de9350f7383dc87609bc09e3b5927df73f65721e6950c95d30217bbe5a92b791a421e8c6
SSDEEP:	24576:MmuEK/vLJrWnfL8lcmfYm9FBmiu/+znlMqHNMsfNjF02nMWU:MRJrhHRdY0ld
TLSH:	A8550800FDC784F1E403263285AB62AB6325AD195F31CBC7FB44BB79FA776954832285
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....d.......H.................m......................................@... .........................-..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x6d8c1380
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x6d8c0000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x6d9563e0, 0x6d956390
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	47d9e8363ec498a9360ee0a7da269805

Entrypoint Preview

Instruction
sub esp, 1Ch
mov dword ptr [6DA2C730h], 00000000h
mov edx, dword ptr [esp+24h]
cmp edx, 01h
je 00007F5AB5298E9Ch
mov ecx, dword ptr [esp+28h]
mov eax, dword ptr [esp+20h]
call 00007F5AB5298D02h
add esp, 1Ch
retn 000Ch
lea esi, dword ptr [esi+00000000h]
mov dword ptr [esp+0Ch], edx
call 00007F5AB532DD1Ch
mov edx, dword ptr [esp+0Ch]
jmp 00007F5AB5298E59h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], 6DA08000h
mov dword ptr [esp+04h], eax
call 00007F5AB532EB6Eh
add esp, 1Ch
ret
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 6D95F000h
call dword ptr [6DA2E21Ch]
sub esp, 04h
test eax, eax
je 00007F5AB5298EF5h
mov ebx, eax
mov dword ptr [esp], 6D95F000h
call dword ptr [6DA2E264h]
mov edi, dword ptr [6DA2E224h]
sub esp, 04h
mov dword ptr [6DA2C764h], eax
mov dword ptr [esp+04h], 6D95F013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 6D95F029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [6D958000h], eax
sub esp, 08h
test esi, esi
je 00007F5AB5298E93h
mov dword ptr [esp+00h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x16d000	0x12d	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16e000	0xb78	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x171000	0x868c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x144fd0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16e1cc	0x190	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x962a8	0x96400	9ea4a82fd4e60f8c004a91e6611ae41c	False	0.4697915583402662	data	6.282346381872946	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x98000	0x67c8	0x6800	385a798458db0898433d7cab18d59df8	False	0.42044771634615385	data	4.442318225516769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x9f000	0xa63a0	0xa6400	b2382868fbb9751c79ae434240bbff93	False	0.43169789708646616	data	5.58957621003733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x146000	0x1274	0x1400	85e22b3e84813337ea1a67b904c6bbcd	False	0.3369140625	data	4.565839626312234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x148000	0x2477c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x16d000	0x12d	0x200	67859e1c9d81f1d2bdf6b531a2016f52	False	0.44921875	data	3.400613123216997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x16e000	0xb78	0xc00	cb8eb4a241279d6fed66c3ea8ecac795	False	0.3961588541666667	data	5.12056831676781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x16f000	0x2c	0x200	db151290603a2662b590a75b7e0b0988	False	0.0546875	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x170000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x171000	0x868c	0x8800	fbb66618699b0a6c6649977b4061f913	False	0.6663602941176471	data	6.630453637493472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateIoCompletionPort, CreateThread, CreateWaitableTimerExW, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FormatMessageA, FreeEnvironmentStringsW, FreeLibrary, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetLastError, GetModuleHandleA, GetNativeSystemInfo, GetProcAddress, GetProcessAffinityMask, GetProcessHeap, GetQueuedCompletionStatusEx, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadLocale, GetTickCount, HeapAlloc, HeapFree, InitializeCriticalSection, IsBadReadPtr, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadLibraryW, LocalFree, PostQueuedCompletionStatus, QueryPerformanceCounter, RaiseFailFastException, ResumeThread, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessPriorityBoost, SetThreadContext, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TerminateProcess, TlsAlloc, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WriteConsoleW, WriteFile, lstrlenA

msvcrt.dll

_amsg_exit, _beginthread, _errno, _initterm, _iob, _lock, _unlock, _wcsnicmp, abort, bsearch, calloc, fprintf, free, fwrite, malloc, mbstowcs, memcpy, memset, qsort, realloc, strcmp, strlen, strncmp, strtol, vfprintf, wcstombs

Exports

Name	Ordinal	Address
BarCreate	1	0x6d9545d0
BarDestroy	2	0x6d954850
BarFreeRec	3	0x6d954800
BarRecognize	4	0x6d9547b0
GetInstallDetailsPayload	5	0x6d954710
SignalInitializeCrashReporting	6	0x6d954760
SpellFree	7	0x6d954620
SpellInit	8	0x6d954670
SpellSpell	9	0x6d9546c0
_cgo_dummy_export	10	0x6da2c768

Target ID:	0
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll"
Imagebase:	0x570000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarCreate
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",#1
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 836
Imagebase:	0x770000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:52:20
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 828
Imagebase:	0x770000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:52:23
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarDestroy
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:52:26
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\dRs2BksGEy.dll,BarFreeRec
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarCreate
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarDestroy
Imagebase:	0x7ff6ee680000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarFreeRec
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",_cgo_dummy_export
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellSpell
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 824
Imagebase:	0x770000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellInit
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SpellFree
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",SignalInitializeCrashReporting
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",GetInstallDetailsPayload
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:52:29
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dRs2BksGEy.dll",BarRecognize
Imagebase:	0x2a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	2

Executed Functions

Function 6D275FB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_beginthread.MSVCRT ref: 6D275FD6
_errno.MSVCRT ref: 6D275FE1
_errno.MSVCRT ref: 6D275FE8
fprintf.MSVCRT ref: 6D276008
abort.MSVCRT ref: 6D27600D
Sleep.KERNEL32 ref: 6D276026

Strings

runtime: failed to create new OS thread (%d), xrefs: 6D275FF9

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: _errno$Sleep_beginthreadabortfprintf
String ID: runtime: failed to create new OS thread (%d)
API String ID: 1261927973-3231778263
Opcode ID: dd830b884022d6e9ec078468f853597bbac3e71574443d12ad84c80868fddb2e
Instruction ID: b09b814be7dbbbdfc75d1af032c8ae66684c6af45d493d684dfec37f5adec00c
Opcode Fuzzy Hash: dd830b884022d6e9ec078468f853597bbac3e71574443d12ad84c80868fddb2e
Instruction Fuzzy Hash: 4901627544931ADFC720BF64C88862EBBB4FF86355F01451DE58583250C7349480DAA3

Function 6D276060 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 6D27606F
fwrite.MSVCRT ref: 6D2760BD
abort.MSVCRT ref: 6D2760C2
free.MSVCRT ref: 6D2760E5

Part of subcall function 6D275FB0: _beginthread.MSVCRT ref: 6D275FD6
Part of subcall function 6D275FB0: _errno.MSVCRT ref: 6D275FE1
Part of subcall function 6D275FB0: _errno.MSVCRT ref: 6D275FE8
Part of subcall function 6D275FB0: fprintf.MSVCRT ref: 6D276008
Part of subcall function 6D275FB0: abort.MSVCRT ref: 6D27600D

Strings

+, xrefs: 6D2760A2
runtime/cgo: out of memory in thread_start, xrefs: 6D2760B6

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: _errnoabort$_beginthreadfprintffreefwritemalloc
String ID: +$runtime/cgo: out of memory in thread_start
API String ID: 2633710936-1802439445
Opcode ID: 1b66dbcc014eeb8c8a80661ee2ffb0ca078e7650b16de52b20da6b98e2fb8de4
Instruction ID: caa5ca8f3483cfeda8fa03317612def186aa1123dd6e5d634265b07a1a1dc188
Opcode Fuzzy Hash: 1b66dbcc014eeb8c8a80661ee2ffb0ca078e7650b16de52b20da6b98e2fb8de4
Instruction Fuzzy Hash: F621ED75948704DFC720EF29D59891AFBF4FF8A304F4589ADE9888B325D7399840CB92

Function 6D24CEA0 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 6D24CEC8

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction ID: 9415c1c9b5faffa2539e13697fb71bf7aaa2d75ce03b3c65366bd91c8d520bd7
Opcode Fuzzy Hash: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction Fuzzy Hash: 8EE0E571505600CFDB19DF18C2C1316BBE1EB48A00F0485A8DE098F74AD734ED10DB92

Non-executed Functions

Function 6D274F30 Relevance: 33.8, APIs: 17, Strings: 2, Instructions: 564
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 6D274FEC
GetProcessHeap.KERNEL32 ref: 6D27504D
HeapAlloc.KERNEL32 ref: 6D275066
memcpy.MSVCRT ref: 6D275132
memset.MSVCRT ref: 6D2751C9
IsBadReadPtr.KERNEL32 ref: 6D27522F
realloc.MSVCRT ref: 6D27527E
SetLastError.KERNEL32 ref: 6D275339
SetLastError.KERNEL32 ref: 6D275359

Strings

@, xrefs: 6D275053
?, xrefs: 6D274F3A

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ErrorHeapLast$AllocInfoNativeProcessReadSystemmemcpymemsetrealloc
String ID: ?$@
API String ID: 2257136212-1463999369
Opcode ID: 20be2b3c4edbb52e9c19b89d75cad1ce52adfddb5fee4a4babe4ee582a140c8d
Instruction ID: 2566a96df205a2f9ec65a632a1e03511020fd2bb4b429f9286a7228ac5d13662
Opcode Fuzzy Hash: 20be2b3c4edbb52e9c19b89d75cad1ce52adfddb5fee4a4babe4ee582a140c8d
Instruction Fuzzy Hash: 414205B464970A9FD720DF29C584A2AFBF1BF88345F44892DE89987350E774E845CF82

Function 6D1F59F0 Relevance: 18.5, Strings: 14, Instructions: 1019
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 6D1F606A
+:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08, xrefs: 6D1F64A4, 6D1F678B
5, xrefs: 6D1F6C27
non-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class bo, xrefs: 6D1F6C1E
ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = , tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=[ gp.goid, xrefs: 6D1F68DC
gcing MB, got= ... max=scav ptr ] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= , xrefs: 6D1F5ABA
MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc=, xrefs: 6D1F699C
@s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12, xrefs: 6D1F62C7
gc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltadxaesshaavxfmaintma, xrefs: 6D1F629A
ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACE, xrefs: 6D1F64EC
MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, xrefs: 6D1F6A06
failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre, xrefs: 6D1F6C34
gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket, xrefs: 6D1F6C4A
., xrefs: 6D1F61FE

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: $ @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12$ MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:$ MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc=$ ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACE$ ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = , tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=[ gp.goid$+:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08$.$5$failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre$gc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltadxaesshaavxfmaintma$gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket$gcing MB, got= ... max=scav ptr ] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= $non-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class bo
API String ID: 0-2575422049
Opcode ID: 342dd9400cde94f92d12bfed6c9bd387fb91e64bcc7688d68823794cebb0edb9
Instruction ID: 584f9581c347cb91cabc99be3055a11421313008ce773e66435f35d3c7f9396a
Opcode Fuzzy Hash: 342dd9400cde94f92d12bfed6c9bd387fb91e64bcc7688d68823794cebb0edb9
Instruction Fuzzy Hash: 72B20674A0D345DFC764EF28C590B9ABBF5FB8A304F01892ED98987350DB74A845CB92

Function 6D2093F0 Relevance: 16.9, Strings: 13, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard , xrefs: 6D209C5B
, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by short writeProcessPrngMoveFileExWNetShar, xrefs: 6D209BD7
][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13C, xrefs: 6D2096A4, 6D209AED
, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base stringGetACPSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13rdtscppopcntuint16uint32uint64structcmd/gonetdnsCommonCopySidWSARecvWSASendconnectconsoleforcegcallocmWc, xrefs: 6D209C88
] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc, xrefs: 6D2096CD
runtime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupQuerySer, xrefs: 6D20976B
bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 6D2097A2, 6D209F68
runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket, xrefs: 6D209CE8
, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime:, xrefs: 6D209D15
, [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST, xrefs: 6D2096F7, 6D209721, 6D209B44, 6D209B6E
] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheapt, xrefs: 6D209B1A
runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 6D20967A, 6D209AB3
, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type float32float64\\.\UNCTuesdayJanuaryOctoberMUI_StdMUI_Dltavx512finvaliduintptros/execruntimetls3desno anodeCancelIoReadFileAcceptExWSAIoctlshu, xrefs: 6D209C04

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST$, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base stringGetACPSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13rdtscppopcntuint16uint32uint64structcmd/gonetdnsCommonCopySidWSARecvWSASendconnectconsoleforcegcallocmWc$, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type float32float64\\.\UNCTuesdayJanuaryOctoberMUI_StdMUI_Dltavx512finvaliduintptros/execruntimetls3desno anodeCancelIoReadFileAcceptExWSAIoctlshu$, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime:$, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by short writeProcessPrngMoveFileExWNetShar$] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheapt$] = (usagefalseinit ms, fault and tab= top=[...], fp:MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localsse41sse42ssse3int16int32int64uint8arraysliceGreeklistensocketsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc$][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13C$bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket$runtime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupQuerySer$runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard $runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-566501290
Opcode ID: d0ed0918d51e71e91c495d5688aa394179066e8bc07df5053558d80891056060
Instruction ID: 698e315284140d937ae08c29a583985ced66dcf7f21f30680b6400af9d3c1565
Opcode Fuzzy Hash: d0ed0918d51e71e91c495d5688aa394179066e8bc07df5053558d80891056060
Instruction Fuzzy Hash: AA523475A5C3198FD320DF68C480B5EBBF5BF89308F05892DEA9997340DB74A844CB92

Function 6D211570 Relevance: 16.4, Strings: 13, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 6D2116A2
NtCancelWaitCompletionPacket, xrefs: 6D2116E2
, xrefs: 6D21169A
ProcessPrng, xrefs: 6D2115BF
NtCreateWaitCompletionPacket exists but NtCancelWaitCompletionPacket does notcannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcgocheck > 1 mode is no , xrefs: 6D2117C5
ntdll.dll, xrefs: 6D211608
RtlGetVersion, xrefs: 6D21177E
bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue is not fullruntime: bad pointer in frame invalid pointer found on stack locals stack map entries for abi mismatch detected between runtime: impossible , xrefs: 6D211807
bcryptprimitives.dll, xrefs: 6D21158D
NtAssociateWaitCompletionPacket, xrefs: 6D211690
P, xrefs: 6D2117E4
RtlGetCurrentPeb, xrefs: 6D211734
NtCreateWaitCompletionPacket, xrefs: 6D21163E

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: $ $NtAssociateWaitCompletionPacket$NtCancelWaitCompletionPacket$NtCreateWaitCompletionPacket$NtCreateWaitCompletionPacket exists but NtCancelWaitCompletionPacket does notcannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcgocheck > 1 mode is no $P$ProcessPrng$RtlGetCurrentPeb$RtlGetVersion$bcryptprimitives.dll$bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue is not fullruntime: bad pointer in frame invalid pointer found on stack locals stack map entries for abi mismatch detected between runtime: impossible $ntdll.dll
API String ID: 0-2332038095
Opcode ID: 52c791dc50504ddc00ea0e9383277f9110fff9dac1314fd28f871b45f9750186
Instruction ID: 4fa4634d4858f4eabbd989a537ea97cd1ec9e1877a1631be8977c15a3729cccd
Opcode Fuzzy Hash: 52c791dc50504ddc00ea0e9383277f9110fff9dac1314fd28f871b45f9750186
Instruction Fuzzy Hash: 8C71F3B4549706AFDB04DF68C594B5ABBF0BF9A748F01C82DE99887340D7749888CF52

Function 6D203400 Relevance: 14.6, Strings: 11, Instructions: 876COMMON

Download Yara Rule

Strings

mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1, xrefs: 6D2041A9
sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executiontraceSto, xrefs: 6D203C4F
nalloc= nfreed=runtime.[signal reflect. newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes wsaioctlThursdaySaturdayFebruaryNovemberDecember%!Month(avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberx509sha1SafetyDogFindCloseLo, xrefs: 6D203D81
previous allocCount=, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:, xrefs: 6D203DAB
mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification, xrefs: 6D203D16
sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine LockFileExWSASocketWunixpacket, xrefs: 6D203CB8, 6D20412C
mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdea, xrefs: 6D20418A
, xrefs: 6D203E12
swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 6D203C65
sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket, xrefs: 6D203E09
mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 6D203CE2, 6D204156

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: $ mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$ nalloc= nfreed=runtime.[signal reflect. newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes wsaioctlThursdaySaturdayFebruaryNovemberDecember%!Month(avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberx509sha1SafetyDogFindCloseLo$ previous allocCount=, levelBits[level] = runtime: searchIdx = panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:$ sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine LockFileExWSASocketWunixpacket$mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification$mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdea$mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1$sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket$sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executiontraceSto$swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-450365003
Opcode ID: ef3cb454f0a54f08adac40d2c6fc5842a86a8cb198d88e36b6f85f641c7ee84f
Instruction ID: 1d42946919edcb80f3f88ca2e99d43310cdff109a945a3487afb41c5b5c5276a
Opcode Fuzzy Hash: ef3cb454f0a54f08adac40d2c6fc5842a86a8cb198d88e36b6f85f641c7ee84f
Instruction Fuzzy Hash: 158246B464C3598FC355DF28C080B6ABBF1BF89708F41896DE9C88B391E7749945CB92

Function 6D212A90 Relevance: 14.0, Strings: 11, Instructions: 253COMMON

Download Yara Rule

Strings

runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] with length %ypanicwrap: unexpected string afte, xrefs: 6D212E47, 6D212EA2
runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!internal error: unknown network type godebug: unexpected IncNonDefault of b, xrefs: 6D212F31
runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:, xrefs: 6D212D95
VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notunexpected runtime.netpoll error: network dropped connec, xrefs: 6D212DC9
%, xrefs: 6D212F3A
runtime: NtCreateWaitCompletionPacket failed; errno=casfrom_Gscanstatus: gp->status is not in scan statenon-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS thr, xrefs: 6D212DEC
bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFi, xrefs: 6D212D6E
NtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a cor, xrefs: 6D212E20
,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12, xrefs: 6D212D29
CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplet, xrefs: 6D212E7B, 6D212ED6
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] wi, xrefs: 6D212EFD

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: %$,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12$CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplet$NtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a cor$VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notunexpected runtime.netpoll error: network dropped connec$bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFi$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] wi$runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!internal error: unknown network type godebug: unexpected IncNonDefault of b$runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerociphertext is not a multiple of the block sizeslice bounds out of range [:%x] with length %ypanicwrap: unexpected string afte$runtime: NtCreateWaitCompletionPacket failed; errno=casfrom_Gscanstatus: gp->status is not in scan statenon-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS thr$runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:
API String ID: 0-2809656213
Opcode ID: 6079a601660f8ab4a630850196ef7f0edead6c25df00bf253219e4caf09d40f7
Instruction ID: 1cc40ba33aaf19ddff7ff4eb857366c12221bb880340fd390fd494564f6c6478
Opcode Fuzzy Hash: 6079a601660f8ab4a630850196ef7f0edead6c25df00bf253219e4caf09d40f7
Instruction Fuzzy Hash: 1AC1E3B464D30A8FD700EF68C59875ABBF4BF89709F01C96CE6988B340D7759948CB52

Function 6D1E13E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6D1E13F0
LoadLibraryA.KERNEL32 ref: 6D1E1406
GetProcAddress.KERNEL32 ref: 6D1E1425
GetProcAddress.KERNEL32 ref: 6D1E1437

Strings

__register_frame_info, xrefs: 6D1E141A
libgcc_s_dw2-1.dll, xrefs: 6D1E13E9, 6D1E13FF
__deregister_frame_info, xrefs: 6D1E142C

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 9da484a11bfad4e0c326527615c7dda81aca00b8ee410099c1789cfd7c7968cf
Instruction ID: 89a178da9a6302013e25ebcae1861eb00f6a4a38965070ccec38dffa1bb9d967
Opcode Fuzzy Hash: 9da484a11bfad4e0c326527615c7dda81aca00b8ee410099c1789cfd7c7968cf
Instruction Fuzzy Hash: FD011EB58497149BC720BF79960A31EBEF8BF42795F01452DD88897309D7705484CBA3

Function 6D24332F Relevance: 12.0, Strings: 9, Instructions: 757COMMON

Download Yara Rule

Strings

malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo, xrefs: 6D243D31
mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largelimiterEvent.stop: invalid limiter event type foundpotential, xrefs: 6D243D47
2, xrefs: 6D243D50
4, xrefs: 6D243D0E
p, xrefs: 6D243D5E
mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= , xrefs: 6D243D05
!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 6D2436FF
malloc during signalclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not empty, xrefs: 6D243D1B
3-, xrefs: 6D243D58

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC$2$4$malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo$malloc during signalclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not empty$mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largelimiterEvent.stop: invalid limiter event type foundpotential$mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= $3-$p
API String ID: 0-234616912
Opcode ID: d21636e442b75dc62c68c6592568ef972a9394594b6260c32ccf82aef6bfca9c
Instruction ID: 4b1a3e7bdbd3de2619e1879ef725685a703993c35d1c7e95b646f93088ba1c38
Opcode Fuzzy Hash: d21636e442b75dc62c68c6592568ef972a9394594b6260c32ccf82aef6bfca9c
Instruction Fuzzy Hash: 4962AD7068835A8FC308DF29C090A6ABBF1BF89714F15C96DE9948B391D775D885CF82

Function 6D25CEF0 Relevance: 10.8, Strings: 8, Instructions: 756COMMON

Download Yara Rule

Strings

$, xrefs: 6D25D66D
y: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KS, xrefs: 6D25D1C5
pattern bits too long: runtime: C malloc failedconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32Snaps, xrefs: 6D25D785
n, xrefs: 6D25D1B1
invalid pattern syntax (+ after -): cannot exec a shared library directlyvalue too large for defined data typeruntime: allocation size out of range) is smaller than minimum page size (/cpu/classes/gc/mark/idle:cpu-secondssetprofilebucket: profile already setfa, xrefs: 6D25D663
invalid pattern syntax: resource deadlock avoidedoperation now in progressno buffer space availableno such device or addresssocket type not supportedinvalid cross-device linkGetFinalPathNameByHandleWGetQueuedCompletionStatusUpdateProcThreadAttributegoroutine p, xrefs: 6D25CF75, 6D25D068, 6D25D138, 6D25D6F4, 6D25D816, 6D25D8A7, 6D25D938, 6D25D9CD
!, xrefs: 6D25D0EC
v, xrefs: 6D25D025

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: !$$$invalid pattern syntax (+ after -): cannot exec a shared library directlyvalue too large for defined data typeruntime: allocation size out of range) is smaller than minimum page size (/cpu/classes/gc/mark/idle:cpu-secondssetprofilebucket: profile already setfa$invalid pattern syntax: resource deadlock avoidedoperation now in progressno buffer space availableno such device or addresssocket type not supportedinvalid cross-device linkGetFinalPathNameByHandleWGetQueuedCompletionStatusUpdateProcThreadAttributegoroutine p$n$pattern bits too long: runtime: C malloc failedconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32Snaps$v$y: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KS
API String ID: 0-3686076665
Opcode ID: 75f0395e53c2b68537376044aebfb608b33cce135941cdc5503c2c02a536b040
Instruction ID: 23aab0c6f68f21abb6a98d54fedc97e05ed14164ba375d8ba27a2a5a0f6ed4d1
Opcode Fuzzy Hash: 75f0395e53c2b68537376044aebfb608b33cce135941cdc5503c2c02a536b040
Instruction Fuzzy Hash: BB7214B494834A8FC714DF68C180B5AFBF1BBC9704F54892DE9A887350DB74A948CF92

Function 6D262560 Relevance: 10.5, Strings: 7, Instructions: 1779COMMON

Download Yara Rule

Strings

%!Month(avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberx509sha1SafetyDogFindCloseLocalFreeMoveFileWWriteFileWSASendTod.nx != 0timerSendpollCacheprofBlockstackpoolhchanLeafwbufSpansGC (idle)mSpanDeadinittracescavtracepanicwaitchan sendpreemptedcoroutin, xrefs: 6D263FD9, 6D2642BB
0, xrefs: 6D263150
)]+:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+, xrefs: 6D263BE4, 6D263EAF, 6D263FF3, 6D2642D5
%!Weekday(complex128execerrdothttp2debugcrypto/tlsMessageBoxWbroken pipebad messagefile existsbad addressRegCloseKeyCloseHandleCreateFileWDeleteFileWExitProcessFreeLibraryGetFileTypeOpenProcessSetFileTimeVirtualLockWSARecvFromclosesocketgetpeernamegetsocknamec, xrefs: 6D263BCA, 6D263E95
0, xrefs: 6D263344
0, xrefs: 6D263267
0, xrefs: 6D2630B1

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: %!Month(avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0tlskyberx509sha1SafetyDogFindCloseLocalFreeMoveFileWWriteFileWSASendTod.nx != 0timerSendpollCacheprofBlockstackpoolhchanLeafwbufSpansGC (idle)mSpanDeadinittracescavtracepanicwaitchan sendpreemptedcoroutin$%!Weekday(complex128execerrdothttp2debugcrypto/tlsMessageBoxWbroken pipebad messagefile existsbad addressRegCloseKeyCloseHandleCreateFileWDeleteFileWExitProcessFreeLibraryGetFileTypeOpenProcessSetFileTimeVirtualLockWSARecvFromclosesocketgetpeernamegetsocknamec$)]+:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+$0$0$0$0
API String ID: 0-1887530876
Opcode ID: 5f0865cbfe63a073fd93a9789988e6dba21af2f035d53e853aa03ef85a01ba1e
Instruction ID: a8467a872a5235bb151e1e4b9c768b866fbac844ec6186471c0ab28112b26136
Opcode Fuzzy Hash: 5f0865cbfe63a073fd93a9789988e6dba21af2f035d53e853aa03ef85a01ba1e
Instruction Fuzzy Hash: 5A03E5B4A4D3868FC329CF18C09069EF7E1BFC9304F15892EE99997351D770A985CB92

Function 6D235ED0 Relevance: 10.5, Strings: 8, Instructions: 512COMMON

Download Yara Rule

Strings

, xrefs: 6D236031
pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptrace, xrefs: 6D236593
(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08ID, xrefs: 6D236320
non-Go function at pc=RtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultSao Tome Standard TimeAleutian Standard TimeParaguay Standard TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard , xrefs: 6D2366C5
sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (us, xrefs: 6D236566
, xrefs: 6D236039
fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (usagefalseinit, xrefs: 6D236539
:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08I, xrefs: 6D2363FD

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: $ $ fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (usagefalseinit$ pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptrace$ sp= sp: lr: fp= gp= mp=) m=JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTermssse3avx2bmi1bmi2boolint8uintchanfunctimentohswriteclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepgcing MB, got= ... max=scav ptr ] = (us$(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08ID$:(1/=,-[<{}_My: ??M , [("")) ) @s -> Pn=][}]i)> +"osLlLtLuMnfinptrnilobjgc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF\\.\\?\??MayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08I$non-Go function at pc=RtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultSao Tome Standard TimeAleutian Standard TimeParaguay Standard TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard
API String ID: 0-3830612415
Opcode ID: 2635e36f98637983cd00f9e72c533f6a67f2e9aa98d07233461da9d645d61677
Instruction ID: 18bf94c7992df9ef60b4e2409a169a8988d1249d73b1cb8c44467063ab8c542d
Opcode Fuzzy Hash: 2635e36f98637983cd00f9e72c533f6a67f2e9aa98d07233461da9d645d61677
Instruction Fuzzy Hash: 2232C1B464C3958FC365DF25C580B9FBBE5ABC9305F02882EEAC897351D734A845CB92

Function 6D211A70 Relevance: 8.9, Strings: 7, Instructions: 116COMMON

Download Yara Rule

Strings

timeBeginPeriod, xrefs: 6D211B29
runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already connectedmismatched count during itab ta, xrefs: 6D211BD9
timeEndPeriod, xrefs: 6D211B73
timeBegin/EndPeriod not foundruntime: sudog with non-nil centersyscall inconsistent bp entersyscall inconsistent sp gfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon, xrefs: 6D211C0D
runtime: LoadLibraryExW failed; errno=runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already co, xrefs: 6D211C34
winmm.dll, xrefs: 6D211AF3
&, xrefs: 6D211C3D

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: &$runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already connectedmismatched count during itab ta$runtime: LoadLibraryExW failed; errno=runtime: GetProcAddress failed; errno=runtime: sudog with non-false isSelectarg size to reflect.call more than 1GBv could not fit in traceBytesPerNumbertime: missing Location in call to Datetransport endpoint is already co$timeBegin/EndPeriod not foundruntime: sudog with non-nil centersyscall inconsistent bp entersyscall inconsistent sp gfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon$timeBeginPeriod$timeEndPeriod$winmm.dll
API String ID: 0-424793872
Opcode ID: 683cb8ab8e4f1b61ce40e7103c172a66b1b3b1af8e1880fa8b3cd33a23cec6fe
Instruction ID: fe8b2399bd27e01ee394bb065ae2ec5b4556fb375767af93ae7f86390f8a1c20
Opcode Fuzzy Hash: 683cb8ab8e4f1b61ce40e7103c172a66b1b3b1af8e1880fa8b3cd33a23cec6fe
Instruction Fuzzy Hash: 7751C4B064D30A9FD704EF68C59475ABBF4BF99709F01C82DE69887340DB749588CB92

Function 6D275B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6D275B34
FormatMessageA.KERNEL32 ref: 6D275B79
fprintf.MSVCRT ref: 6D275BA2
LocalFree.KERNEL32 ref: 6D275BAE

Strings

Erro: %s, xrefs: 6D275B93

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessagefprintf
String ID: Erro: %s
API String ID: 659079672-2412703935
Opcode ID: 25fee8ff75e86694acfb33ac2de16f146b621d4aaf8d82f6bcc6bdeb4ca0c295
Instruction ID: cc32b6f296940d2640b5a1335144eb8552e40d9da9714e9e76697c42e79eefe0
Opcode Fuzzy Hash: 25fee8ff75e86694acfb33ac2de16f146b621d4aaf8d82f6bcc6bdeb4ca0c295
Instruction Fuzzy Hash: 71014DB48083019FE700EF68C59971AFBF4AB88749F01891DE99896254D7798289CF93

Function 6D21CF90 Relevance: 8.6, Strings: 6, Instructions: 1093COMMON

Download Yara Rule

Strings

findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a corrupted shared librarylfstack node a, xrefs: 6D21E0A9
findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for [origina, xrefs: 6D21E0BF
!, xrefs: 6D21E0DE
global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/metadata/mspan/free:bytesruntime.SetFinaliz, xrefs: 6D21E093
findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfi, xrefs: 6D21E0EB
findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r, xrefs: 6D21E0D5

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: !$findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r$findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for [origina$findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadline2006-01-02T15:04:05.999999999Z07:00accessing a corrupted shared librarylfstack node a$findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfi$global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/metadata/mspan/free:bytesruntime.SetFinaliz
API String ID: 0-3518981815
Opcode ID: fe82a800749aa8e39f03e957152adbb0dcd1a2d04bf0b5574ba1f4474a5229a8
Instruction ID: e3bb46217b5b5964d5a8726c01d5334f10b10b9087ac2dfdbbd345d5886b4572
Opcode Fuzzy Hash: fe82a800749aa8e39f03e957152adbb0dcd1a2d04bf0b5574ba1f4474a5229a8
Instruction Fuzzy Hash: F1A2D17468D3469FD724DF68C490B6ABBF1BF89744F01882DEA9887380EB75D844CB52

Function 6D2111F0 Relevance: 7.6, Strings: 6, Instructions: 133COMMON

Download Yara Rule

Strings

runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallDestroy, xrefs: 6D21139D, 6D2113F8, 6D21144B
runtime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not , xrefs: 6D211417
5, xrefs: 6D211420
runtime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit ar, xrefs: 6D211369
d, xrefs: 6D211276
runtime: SetWaitableTimer failed; errno= stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classe, xrefs: 6D2113C4

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: 5$d$runtime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit ar$runtime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not $runtime: SetWaitableTimer failed; errno= stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classe$runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallDestroy
API String ID: 0-2414937731
Opcode ID: 67e885504d59872c12b3dcb89cc01e98d3ba1a2e81c96f058f823e0a55aa287c
Instruction ID: cd95aac08b541ea60ca3d794bcbbad604ec9aecefd313aee1621946a32957c3b
Opcode Fuzzy Hash: 67e885504d59872c12b3dcb89cc01e98d3ba1a2e81c96f058f823e0a55aa287c
Instruction Fuzzy Hash: A451BBB464D7099FD740EF28C49475EBBF4AF89709F01C82DEA9887350D7749988CBA2

Function 6D276300 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D27634F
UnhandledExceptionFilter.KERNEL32 ref: 6D27635F
GetCurrentProcess.KERNEL32 ref: 6D276368
TerminateProcess.KERNEL32 ref: 6D276379
abort.MSVCRT ref: 6D276382

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 52aa3a10f5e335fb6b337cbe4ad963f49e4b0664e650a6ac7233bb066f46fd3a
Instruction ID: d9fb9a1c0b86e76e26a391615bcb126500f49f3c2a5750c4ba49102661ccccfd
Opcode Fuzzy Hash: 52aa3a10f5e335fb6b337cbe4ad963f49e4b0664e650a6ac7233bb066f46fd3a
Instruction Fuzzy Hash: F311D7B5904306AFDB00FF69C14975A7BF4FB4A345F008569E948D7350EB389988CF92

Function 6D276250 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6D276289
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D1E13B9), ref: 6D27629A
GetCurrentThreadId.KERNEL32 ref: 6D2762A2
GetTickCount.KERNEL32 ref: 6D2762AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D1E13B9), ref: 6D2762B9

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 8302bfbc64c6ac8cd3f7fa9ca051df3e4b9810fae56f17e968c2aef27b255015
Instruction ID: 3fa816299ec6d278619394ca9f9229d9065516973bb4629fa89c14ba3acf704a
Opcode Fuzzy Hash: 8302bfbc64c6ac8cd3f7fa9ca051df3e4b9810fae56f17e968c2aef27b255015
Instruction Fuzzy Hash: CF1151B55053018FDB10EF79D48864BBBF9FB89256F054D39E444C6210EB35D488C792

Function 6D2762FC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D27634F
UnhandledExceptionFilter.KERNEL32 ref: 6D27635F
GetCurrentProcess.KERNEL32 ref: 6D276368
TerminateProcess.KERNEL32 ref: 6D276379
abort.MSVCRT ref: 6D276382

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 6d54203270e80b0cb41704076adff198107b1b22304f454e00e49df60e2e7300
Instruction ID: 00546e70c03dbc9b1499c1595c26e29a6ff8dfd468f5533982abbd4b71ac3c8a
Opcode Fuzzy Hash: 6d54203270e80b0cb41704076adff198107b1b22304f454e00e49df60e2e7300
Instruction Fuzzy Hash: 3011F3B5804206AFDB00FF69C2497697BF8FB06305F008568E948D7340EB389988CF92

Function 6D201440 Relevance: 5.5, Strings: 4, Instructions: 494COMMON

Download Yara Rule

Strings

min must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exce, xrefs: 6D201A0F
!, xrefs: 6D201A18
runtime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckrunti, xrefs: 6D20198C, 6D2019DB
min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextW, xrefs: 6D2019C0

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: !$min must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exce$min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextW$runtime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckrunti
API String ID: 0-967014423
Opcode ID: a0e5725d6dd3a44c916ad8967d6224493dcd3b8e1a5217dd3dfbe9c46765d1ba
Instruction ID: 3dcfe5c1d9058636b6d764d8a9175d25f03e959cca4ed60e3a7368d43d62d65f
Opcode Fuzzy Hash: a0e5725d6dd3a44c916ad8967d6224493dcd3b8e1a5217dd3dfbe9c46765d1ba
Instruction Fuzzy Hash: FDF1E33668D32A8FD306DE98C4C061EB7E2BBC8348F15893CD994DB385EB719845C6C2

Function 6D21A320 Relevance: 5.4, Strings: 4, Instructions: 352COMMON

Download Yara Rule

Strings

stopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a , xrefs: 6D21A843
stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executionruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base pointer out of rangeattempting to link in too many, xrefs: 6D21A7B0
stopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/met, xrefs: 6D21A7EB
stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classes/gc/mark/dedicated:cpu-seconds/memory/cl, xrefs: 6D21A690

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: stopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2runtime: typeBitsBulkBarrier without type/memory/classes/met$stopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a $stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executionruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base pointer out of rangeattempting to link in too many$stopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basehash mismatch: data integrity check failedpersistentalloc: align is not a power of 2out of memory allocating checkmarks bitmap/cpu/classes/gc/mark/dedicated:cpu-seconds/memory/cl
API String ID: 0-2039697367
Opcode ID: 8b717361952d3c4db79029ace6a210f1e121c012679a8992c3584690ec64f2da
Instruction ID: 65f0557e753feea568851636b750d041fd57672d2bb668c4193b43f3ab68615b
Opcode Fuzzy Hash: 8b717361952d3c4db79029ace6a210f1e121c012679a8992c3584690ec64f2da
Instruction Fuzzy Hash: AFF1F274A4D3459FC308CF69C190A6ABBF1BF89704F51892EEA9887351D770D949CF42

Function 6D211830 Relevance: 5.1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

Strings

', xrefs: 6D211889
powrprof.dll, xrefs: 6D21184D
PowerRegisterSuspendResumeNotification, xrefs: 6D21187F
', xrefs: 6D211891

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: '$'$PowerRegisterSuspendResumeNotification$powrprof.dll
API String ID: 0-4026319467
Opcode ID: 13e09fe2f0310754414b28eb81df6623723b3fa836ef882ecc76b5d0ba7c0872
Instruction ID: 711e8cff16f44d528be5426652181f51dd842e1ef3aa357aed77f58f842fc7d4
Opcode Fuzzy Hash: 13e09fe2f0310754414b28eb81df6623723b3fa836ef882ecc76b5d0ba7c0872
Instruction Fuzzy Hash: 3321BAB460C3069FD704DF25C094B5ABBE0BB89758F40C82DE99887240E7799A88CF92

Function 6D226470 Relevance: 4.2, Strings: 3, Instructions: 451COMMON

Download Yara Rule

Strings

runtime: malformed profBuf buffer - tag and data out of syncabiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotruntime: intern, xrefs: 6D226A04
runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplete multibyte or wide characterslice bounds out of range [::%x] with capacity %yinvalid memory add, xrefs: 6D2269D7
<, xrefs: 6D226A0D

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: <$runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=invalid or incomplete multibyte or wide characterslice bounds out of range [::%x] with capacity %yinvalid memory add$runtime: malformed profBuf buffer - tag and data out of syncabiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotruntime: intern
API String ID: 0-450027851
Opcode ID: 833e7e1bf34f265b0efc21403a78ecb3cd5c44e933d28d8f7da00a05e881f67e
Instruction ID: 4c81ffea3b45bfba3a4f13ba163fcdda19b8b0d087da73285e8cdf46dee31a4b
Opcode Fuzzy Hash: 833e7e1bf34f265b0efc21403a78ecb3cd5c44e933d28d8f7da00a05e881f67e
Instruction Fuzzy Hash: 89025971A4C70A8FC714CF69C19061ABBE2BFC8705F15892DE9998B350EB71E845CB82

Function 6D216010 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

', xrefs: 6D2164AC
suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function traceRegion: alloc with concurrent drop2006-01-02 15:04:05.999999999 -0700 MSTaddress family not support, xrefs: 6D2164A3
invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:DuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "[bisect-match 0xpermission deniedwro, xrefs: 6D21648D

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: '$invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:DuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "[bisect-match 0xpermission deniedwro$suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function traceRegion: alloc with concurrent drop2006-01-02 15:04:05.999999999 -0700 MSTaddress family not support
API String ID: 0-3278438963
Opcode ID: a299ebee35e5009002d27b0418fde19ae7e45041e87885aad7eac5b191cca29c
Instruction ID: ed19adc8054c074be68260960c7f97fd5400b7521eb8647ff84036c129de347c
Opcode Fuzzy Hash: a299ebee35e5009002d27b0418fde19ae7e45041e87885aad7eac5b191cca29c
Instruction Fuzzy Hash: 33D1317428D3568FC705CF29C490A2EBBF2AF8A709F45886DEAC587351D735E944CB82

Function 6D206630 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me, xrefs: 6D206D4E
+, xrefs: 6D206D57

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: +$grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me
API String ID: 0-3347251187
Opcode ID: 0297b7eadeb26d8366d47a64570ff88d53ab0dec1829c0e37c69295b828bb780
Instruction ID: d34eaa65352b9e482f8056461473911863427e4ec29b0e91621ebbe6caabace1
Opcode Fuzzy Hash: 0297b7eadeb26d8366d47a64570ff88d53ab0dec1829c0e37c69295b828bb780
Instruction Fuzzy Hash: 5322DF7464C34A9FC354DF29C190A6ABBF1BF89745F05892DE9D887350DB35E888CB82

Function 6D20B2D0 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 6D20B60F
@, xrefs: 6D20B4FB

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: @$bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod
API String ID: 0-1191861649
Opcode ID: 48e601ef5c43faa4d99fd50721b1b2e893dd89de88ae4e607299971eb784fd00
Instruction ID: c6623edc9fd5b79352b0e5a0f28299419a12119ce57aff85809669705e9f964a
Opcode Fuzzy Hash: 48e601ef5c43faa4d99fd50721b1b2e893dd89de88ae4e607299971eb784fd00
Instruction Fuzzy Hash: 4EA1D17564871A8FC308CF18C88065AB7E1FFC8314F45CA2DE9999B341DB34E94ACB82

Function 6D24A872 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

, xrefs: 6D24A898
@, xrefs: 6D24A89D

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: e52145faca93d1eca5eb624aafff8dc4f848bd4652eb2773a9ccb583bdbccb69
Instruction ID: 67fff7ad9ce7f46296a3958719e01773b61d5070dca5935ba7376ff036b61efd
Opcode Fuzzy Hash: e52145faca93d1eca5eb624aafff8dc4f848bd4652eb2773a9ccb583bdbccb69
Instruction Fuzzy Hash: 0451A320C1CF5B65E7331ABDC4026667B20AEB3144B01D76FFDD6B54B2EB176940BA22

Function 6D1FCEC0 Relevance: 2.6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

,, xrefs: 6D1FCFAA
gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackcannot send after transport endpoint shu, xrefs: 6D1FCFA1

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: ,$gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackcannot send after transport endpoint shu
API String ID: 0-27675022
Opcode ID: 85b680ce7c24dd924acef28a214520ab90f34995db9bdfe7b87b856de8cb0396
Instruction ID: 6b6fe618e20bc7bca030ea3774a0f73a7c5a73d8c0db8c15535fc19a06bdc60d
Opcode Fuzzy Hash: 85b680ce7c24dd924acef28a214520ab90f34995db9bdfe7b87b856de8cb0396
Instruction Fuzzy Hash: D8318175A493568FD305DF14C490A69B7F1BB86608F0985BDDD484F387DB31A84ACBC1

Function 6D2659D0 Relevance: 1.9, Strings: 1, Instructions: 607COMMON

Download Yara Rule

Strings

,M3.2.0,M11.1.0jstmpllitinterptarinsecurepathx509keypairleafx509usepolicieszipinsecurepathRegCreateKeyExWRegDeleteValueWstring too large0123456789abcdefinvalid exchangeno route to hostinvalid argumentmessage too longobject is remoteremote I/O errorSetFilePoint, xrefs: 6D265B6E

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: ,M3.2.0,M11.1.0jstmpllitinterptarinsecurepathx509keypairleafx509usepolicieszipinsecurepathRegCreateKeyExWRegDeleteValueWstring too large0123456789abcdefinvalid exchangeno route to hostinvalid argumentmessage too longobject is remoteremote I/O errorSetFilePoint
API String ID: 0-1364986362
Opcode ID: e0cca7863d32f4e164725f172789904d837a7b504f9cd8c1b8e26fc4ea65a2fe
Instruction ID: 611d52e88630ba3416734154564720493aa213afa2cddc1f74bd06c72e0d8900
Opcode Fuzzy Hash: e0cca7863d32f4e164725f172789904d837a7b504f9cd8c1b8e26fc4ea65a2fe
Instruction Fuzzy Hash: 745217B5A083898FD338CF19C59039FFBE1ABC5304F45892DDAD897381E7B599448B92

Function 6D238570 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

4, xrefs: 6D2388DB

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 6c6f006c3165d007fd5038c63f92e79ae67e72a5be304f7cb18e5b58c60ef9c2
Instruction ID: 0fa921c0215a3e500cdf837b584346d4579814e145bc560d02943e956c23abcc
Opcode Fuzzy Hash: 6c6f006c3165d007fd5038c63f92e79ae67e72a5be304f7cb18e5b58c60ef9c2
Instruction Fuzzy Hash: 9F22D0B564D35A8BC724DF28C4C4A6EF7E1AFC5304F168A2DD9998B351DB31A805CB82

Function 6D1F0AF0 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor, xrefs: 6D1F0D52

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor
API String ID: 0-1712010102
Opcode ID: da28b67df934a6a383908f577c1d4b9da2960342f8255cfc894a782ed1a98ee9
Instruction ID: 369c09c0c5825c9675511c9fcedff48e85f2f0d9fea2ea2750922e07dbfde9b2
Opcode Fuzzy Hash: da28b67df934a6a383908f577c1d4b9da2960342f8255cfc894a782ed1a98ee9
Instruction Fuzzy Hash: 40D152B464C3499FC704DF29C090A2ABBE0BF89748F01896EF9D98B345E775D946CB42

Function 6D20D040 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin, xrefs: 6D20D3CB

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin
API String ID: 0-429552053
Opcode ID: 39945c3849948616bd2c963749ac198cda07fae7c7be1fdf0fa45646615ed274
Instruction ID: 65b01b1666bacc77aa74bea283a6058757776d982e851c3526a2a52048f09c2a
Opcode Fuzzy Hash: 39945c3849948616bd2c963749ac198cda07fae7c7be1fdf0fa45646615ed274
Instruction Fuzzy Hash: ECB1D378A4930A9FC704DF68C58092ABBF1BFC9744F42892DE99487751EB34E945CF82

Function 6D2695A0 Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

;, xrefs: 6D26988A

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: cf05eb2f4b3406c8e1d238a0aa465d700732d17d8ea8256966041028e5098247
Instruction ID: 3a66b7f58a3cd016cc5396bb325a704fd0128eb0cf15f9fb2d0dbace84735cd9
Opcode Fuzzy Hash: cf05eb2f4b3406c8e1d238a0aa465d700732d17d8ea8256966041028e5098247
Instruction Fuzzy Hash: 5DA17171B083054FC70CDF6DD99531ABAE6ABC8304F05CA3DE589CB7A4E634D9098B86

Function 6D20A360 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

@, xrefs: 6D20A588

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4dda17549d82e19f9628bc28af1166d663fddd9cd64618b461112aae67892d7d
Instruction ID: a1206ebd21c55a38ef3b6a44d1a775cc92a336983aa37906598630c4599e2b5b
Opcode Fuzzy Hash: 4dda17549d82e19f9628bc28af1166d663fddd9cd64618b461112aae67892d7d
Instruction Fuzzy Hash: A19122B5A593099FC344CF28C080A5ABBE1FF89744F81992DE99897341E735D985CF82

Function 6D25E740 Relevance: .9, Instructions: 941COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587a21fe7aa5cec56273c2d94f9b58847a029360e533ca6345368a997134a6b5
Instruction ID: 143f47a8e7ba7e2b00119803cf7a5573bb3821e6f87a2c5879dc7ea86ac8aa3e
Opcode Fuzzy Hash: 587a21fe7aa5cec56273c2d94f9b58847a029360e533ca6345368a997134a6b5
Instruction Fuzzy Hash: A2824D75A583598BC728CF09C490B9AF3F2BBCD301F55892ED69AD3350E770A915CB82

Function 6D266C20 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4318e73299a7402a8aceff829af987767735d66ea1321447e90865e6f91a6a5e
Instruction ID: a26c61578d10b541aeb8056bc5a33b9dba07ac04930dea781594dad1d7a2f80a
Opcode Fuzzy Hash: 4318e73299a7402a8aceff829af987767735d66ea1321447e90865e6f91a6a5e
Instruction Fuzzy Hash: 8F22B071A9C78A8FC324CF69C4D076BB7E2BBC5305F41C87DD98587240EB7198898B92

Function 6D264D20 Relevance: .5, Instructions: 530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c58166ba2d6da66eabff61d4af7c7851a78b06a00cbef5b7c6cfa35dbfd611d
Instruction ID: 94d7f26ee43016bedcc0a7719336e874ba8c28025f5bc73e8f2396c3395295a5
Opcode Fuzzy Hash: 0c58166ba2d6da66eabff61d4af7c7851a78b06a00cbef5b7c6cfa35dbfd611d
Instruction Fuzzy Hash: F712BB72A487498FC314DE6DC98024AF7E6BBC4304F55CA3DD9988B355EB70E949CB82

Function 6D20C080 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e031f9238d2ca08fd5d4dd70784d31e77362256f3d4efb819ffbf093314448fa
Instruction ID: 5d488df342339484495181adfda86c42b5ecad491d92503e6a20df1fcd72832f
Opcode Fuzzy Hash: e031f9238d2ca08fd5d4dd70784d31e77362256f3d4efb819ffbf093314448fa
Instruction Fuzzy Hash: B1E13673B9971A4FD319DDAC88C025EB2D2ABC8744F09863CDD649B380FA75DC0A96D1

Function 6D23BC20 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e055a93e420d843bc45e6a50cc863996d7843084bf2e076d672b8d3ceed75d2
Instruction ID: 49c512b9db9a1592374461f385a08bddc7251f9f5b9684d8de2b96c796a745ac
Opcode Fuzzy Hash: 7e055a93e420d843bc45e6a50cc863996d7843084bf2e076d672b8d3ceed75d2
Instruction Fuzzy Hash: 5C028F7564C36A8FC324CF68C480A1EB7E1BF89704F56893DE9998B351D730E905DB92

Function 6D20BB10 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e06c000bcd368673f113269873a3565fa1271e66c0e680d0a48fe04f881968
Instruction ID: 4c07525345e42507a56d24d5099b67b5ee4495c4d0cda47144e4be70c76e4d7e
Opcode Fuzzy Hash: d0e06c000bcd368673f113269873a3565fa1271e66c0e680d0a48fe04f881968
Instruction Fuzzy Hash: BEE1B533E2472907D3149E58CC80249B6D3ABC8670F4EC73DDD959B781EAB4ED5986C2

Function 6D266740 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d14b58390c1ffd39adb7d2285d1e76ee0fd56b5ff117753c73def7d7f63c66
Instruction ID: 6b6e16c8c494b7aeeba4c3cd94865c433e58203fc2e8e9d68fe175ced556438f
Opcode Fuzzy Hash: d6d14b58390c1ffd39adb7d2285d1e76ee0fd56b5ff117753c73def7d7f63c66
Instruction Fuzzy Hash: C8E1C472A9C39A8BC305CF25849021FBBE2BBC5706F45C9ADE9918B341D771D849CBD2

Function 6D1F80A0 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ea397c511ae41c79707be9a427c7c6ed81f709138a99c504d1ab6d86dd7616
Instruction ID: 7d6870d6de9fd4b6cf5ca991133e20fcd3368a094cc2f06a962078b43b811052
Opcode Fuzzy Hash: 01ea397c511ae41c79707be9a427c7c6ed81f709138a99c504d1ab6d86dd7616
Instruction Fuzzy Hash: 11C1D472B083164FC709DE6DC89061EB7E2ABC8304F49863CE955DB3A5E7B4EC068781

Function 6D23D6E0 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33825de9f9770dc4e0941f342db924a3cd60e305e9716be00f3d8640fcb908b3
Instruction ID: 363f603d1672e9a0e3bae24f5c772379edad43b14e21ab5c2fdbbad97f3c3817
Opcode Fuzzy Hash: 33825de9f9770dc4e0941f342db924a3cd60e305e9716be00f3d8640fcb908b3
Instruction Fuzzy Hash: 18E1907564C36A8FC315CF29C4D092AFBE1AFCA204F05897DE9958B392D730E945CB92

Function 6D21E240 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c83024be99eec062a92ba333e770a2d543e381f07dca6a79e1ef896d7334fa
Instruction ID: 067ad9d6466d55d74bdffd13f182e8ddb9e528315032fee1d88d33113a555ff3
Opcode Fuzzy Hash: 30c83024be99eec062a92ba333e770a2d543e381f07dca6a79e1ef896d7334fa
Instruction Fuzzy Hash: 6CF1EF74A4C3958FC364CF29C490B5BBBE2BBC9304F54892EEAD887351DB31A845CB52

Function 6D272E70 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b18c97eb22bce79512eed41578c450884768773413f839417edb465bfa8d4a
Instruction ID: 088a1fb7915f70fa465f998a18e0b3d98815f454571c1503fe8fe8bbc6de2819
Opcode Fuzzy Hash: d7b18c97eb22bce79512eed41578c450884768773413f839417edb465bfa8d4a
Instruction Fuzzy Hash: 4FC1617060432A4FC351CE5EDCC0A6A73D1AB4821DF91867D9A448F7C3DA3AF46B97A4

Function 6D273230 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920f9fa82136215bc644f029787155ba88f6482863f4b2493e389c6061e8ab55
Instruction ID: 84c98c5813fe43892ce45cd4a99d7ccf999bac4306b33fbd052f131a9637ea2e
Opcode Fuzzy Hash: 920f9fa82136215bc644f029787155ba88f6482863f4b2493e389c6061e8ab55
Instruction Fuzzy Hash: 90C1617060432A4FC251CE5EDCC0A6A73D1AB4821DF91867D9A448F7C3DA3AF46B96A4

Function 6D20C6D0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55159abaa99c1a65475548d44116c0a82cdd53cf855358a189c2fe8f763807e9
Instruction ID: 654447c8cde46c00379a842e620d8bff6c0044196b7e459002eeb5e562aa4790
Opcode Fuzzy Hash: 55159abaa99c1a65475548d44116c0a82cdd53cf855358a189c2fe8f763807e9
Instruction Fuzzy Hash: 7291667268971A4FC31ADE9CC4D052EB3E2FBC8744F55873CD9690B380EB719909C691

Function 6D20CA30 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0a2832901c1d52ee2022006b52a3099f408240e947db540ca62398b30413ea
Instruction ID: 6b7edc2927f2731b3baba1ad9b39d239610dffe211f348396b28e4e7e932771f
Opcode Fuzzy Hash: 0f0a2832901c1d52ee2022006b52a3099f408240e947db540ca62398b30413ea
Instruction Fuzzy Hash: 1F81477768873E4FD316CEA888D065E3292ABC8718F09863CDD708B3C1FBB1980592D1

Function 6D20AD50 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124c9cf62abbcbdbefc7c73b17428f57d836f0bf3449cb4da93bc4fb72eb4cb6
Instruction ID: 33cf490359d671af178a1ab11403e97f1556d2439dd12f37712ee99f05a96441
Opcode Fuzzy Hash: 124c9cf62abbcbdbefc7c73b17428f57d836f0bf3449cb4da93bc4fb72eb4cb6
Instruction Fuzzy Hash: 9091D776A187194BD304DE59CCC0659B3E2BBC8324F49C63CEDA89B345E674EE49CB81

Function 6D1E32A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb35e4d5c0583117b41203e6ea7d4611ac0cc9814d0ec54de9f2d9aa79797e6
Instruction ID: 1fb35dd3331ea0330c35ba2823073778ec437a1e68a9e086ada881257e561edf
Opcode Fuzzy Hash: aeb35e4d5c0583117b41203e6ea7d4611ac0cc9814d0ec54de9f2d9aa79797e6
Instruction Fuzzy Hash: 5D81F8B2A187108FC314DF29D88095AF7E2BFC9748F46892DF988D7315E771E9158B82

Function 6D209030 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc7bef500a5900f3716418d760276e4172c363e5d79d241b648007617bf3cad
Instruction ID: 61b6c65f7783518eb98f39059d9da9c01fc578f0072a6a5234de6af12f579a5b
Opcode Fuzzy Hash: 2bc7bef500a5900f3716418d760276e4172c363e5d79d241b648007617bf3cad
Instruction Fuzzy Hash: EA91BBB4A493459FC308DF28C090A1ABBF1FF89748F418A6EE99997351D730E945CF46

Function 6D1E2CA6 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaac1fa95927537056fa748d1ed80cb4c36531cfe69fe86e380ee050db7f54d2
Instruction ID: 0da7200be79d29892b3f755e310d070732b9031f74d250ea9b25f49b312cf532
Opcode Fuzzy Hash: aaac1fa95927537056fa748d1ed80cb4c36531cfe69fe86e380ee050db7f54d2
Instruction Fuzzy Hash: 9751667090C3A44AE3158F6F48D402AFFE16FC6341F884A6EF5E443392D5B89515DB6A

Function 6D1E2CA0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5965cf9d052c85f5287a0fc848d5858a8dbdf7b94c64c27d01392e9efdd4e0f1
Instruction ID: 6f4325e31a11edaa5ae2fc81c7052e8726f1518d295d600c2c83d2019bd48596
Opcode Fuzzy Hash: 5965cf9d052c85f5287a0fc848d5858a8dbdf7b94c64c27d01392e9efdd4e0f1
Instruction Fuzzy Hash: 1E51763090C3A44AE3158F6F48D402AFFF16FCA301F884A6EF5E443392D5B89515DBAA

Function 6D20D9C5 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc6b4b3884e6ef5d3358a446244ad6ff15749e5e4fbdc0c4b413403109f1dfb
Instruction ID: f649c492d19b791a5ca3f2373e31b4f7e18fae6c7c3a9088939cc48d120249b9
Opcode Fuzzy Hash: edc6b4b3884e6ef5d3358a446244ad6ff15749e5e4fbdc0c4b413403109f1dfb
Instruction Fuzzy Hash: 2C516BB564A3268FC318DF69C490A1AB7E0FF88604F0589BDED599B391D731E845CBC2

Function 6D1EBE90 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21d2bd92460e9580ed94769d15fe942447703848ec9a4f16d473aa87b463e64
Instruction ID: 3bab41332b2b70a11847131954f8bf2f7384b84dfb880cdf162945079deeda9d
Opcode Fuzzy Hash: f21d2bd92460e9580ed94769d15fe942447703848ec9a4f16d473aa87b463e64
Instruction Fuzzy Hash: 9241C374908F058FC346DE79C49031AB7E2BFD6384F54872DE95A6B352EB719882CA42

Function 6D1EFBC0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fa138c3f2bfc6ae846e9549a72792f793fc7f5d4fb7060899f1c01d4709b14
Instruction ID: 367d56c3c75ddf8dd03f218cecac879e414742e089b169d2a569bbf1cd9d5681
Opcode Fuzzy Hash: 26fa138c3f2bfc6ae846e9549a72792f793fc7f5d4fb7060899f1c01d4709b14
Instruction Fuzzy Hash: 1631637381971D8BD300AF499C40159F7E2ABD0B20F5E8A5EDDA417701DBB0AA15CBC7

Function 6D1E90F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed7a373806fca73a0c5aef97407a85b7d240bb52832e660ee0bb5fe2ce66a7a
Instruction ID: 20878c1a39af17c22eec3fc1c72d95f0022525d493fa73154e731839ec994c26
Opcode Fuzzy Hash: 2ed7a373806fca73a0c5aef97407a85b7d240bb52832e660ee0bb5fe2ce66a7a
Instruction Fuzzy Hash: F821F2317042128BDB0CCF39C8F0226B7F3ABCA710B4A882CD455C77A8DAB4A849C746

Function 6D211C90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597b840f6e669b6ffc3e99f7d0204ac012a0c1dd5713fffe21481e3adb1005f
Instruction ID: dff525b2955533183084fd13f81b3f8729e944f41e29c2f90ee61d5bd71e3437
Opcode Fuzzy Hash: a597b840f6e669b6ffc3e99f7d0204ac012a0c1dd5713fffe21481e3adb1005f
Instruction Fuzzy Hash: E3118B7064C24A9FD70ACF20C4A0BA9B7F5BF96708F40886CD6954B790C7399888CB52

Function 6D247280 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cb89b570febef448973a48ecdb59ceee2e6c418d9811251ccdb5d5499bfc48
Instruction ID: cb387e3b1289d228bfaddb1013de65ac018bde2d46790bb615265ebc288e7b0e
Opcode Fuzzy Hash: 75cb89b570febef448973a48ecdb59ceee2e6c418d9811251ccdb5d5499bfc48
Instruction Fuzzy Hash: A2112DB4600B108FC398DF59C0D4E65B3E1FB8D200B4A85BDDB0E8B766C670A855DB85

Function 6D24C0C0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93dcd87ec6e0dd97ad807693b75d1112eef3cd7171af0f4afc554e2d5af3ede1
Instruction ID: 9d3bc8d9df33c838aa5d9319b5aace7c56af68959a754fb9a8a9f444009007f4
Opcode Fuzzy Hash: 93dcd87ec6e0dd97ad807693b75d1112eef3cd7171af0f4afc554e2d5af3ede1
Instruction Fuzzy Hash: 7DC08CF08AA357ADF708CB2CC140306BEF09B81700F80C088E54843200C338C188A604

Function 6D275E79 Relevance: 21.0, APIs: 9, Strings: 3, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 6D275EAB
abort.MSVCRT ref: 6D275EB0
EnterCriticalSection.KERNEL32 ref: 6D275ECF
LeaveCriticalSection.KERNEL32 ref: 6D275EE9
SetEvent.KERNEL32 ref: 6D275EFA
fwrite.MSVCRT ref: 6D275F33
abort.MSVCRT ref: 6D275F38
EnterCriticalSection.KERNEL32 ref: 6D275F4A
LeaveCriticalSection.KERNEL32 ref: 6D275F63

Strings

;, xrefs: 6D275F18
unexpected cgo_bindm on Windows, xrefs: 6D275EA4
runtime: failed to signal runtime initialization complete., xrefs: 6D275F2C

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeaveabortfwrite$Event
String ID: ;$runtime: failed to signal runtime initialization complete.$unexpected cgo_bindm on Windows
API String ID: 3057923235-924395932
Opcode ID: accdb57dde2aa6cb43f26218bc2170e1fb41b02eb0dcba3262551e4a86c5c145
Instruction ID: b51dbbb6db9c7fdaf9be905cdf86059ca1ae864c7ba87fbb1d0c64aee7fd55b5
Opcode Fuzzy Hash: accdb57dde2aa6cb43f26218bc2170e1fb41b02eb0dcba3262551e4a86c5c145
Instruction Fuzzy Hash: 711195B58083459FDB10BF78C10D36EBAF4FB46309F41896CE98597241DB7A5198CB93

Function 6D1E1020 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6D1E12E0,?,?,?,?,?,?,6D1E13A3), ref: 6D1E1057
_amsg_exit.MSVCRT ref: 6D1E1085

Strings

c'm, xrefs: 6D1E1115

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID: c'm
API String ID: 1015461914-2282281871
Opcode ID: c9be4d7a4c2982426798195e3e8b33f9baf0f62aea93e314c76a9e04c2e752af
Instruction ID: 949a924ed7a50c8ede4b054d8070194504be1ae46a50c292258d4d0e448b3f18
Opcode Fuzzy Hash: c9be4d7a4c2982426798195e3e8b33f9baf0f62aea93e314c76a9e04c2e752af
Instruction Fuzzy Hash: A641A2B1A09645DFEB11AF6DC98471ABBF8FB92384F41C52DD544CB208DBB994C4CB82

Function 6D2764A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6D27652D

Strings

Address %p has no image-section, xrefs: 6D2765DB
VirtualQuery failed for %d bytes at address %p, xrefs: 6D2765C7
VirtualProtect failed with code 0x%x, xrefs: 6D27659A
@, xrefs: 6D276578

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: ecee2cf33bcf465aa4bd8a1695fbfd33f5029dd800c439f043964eb6c85f9998
Instruction ID: f268bc8f3317df6b0525cd97fcc2b3512c6228328b39cf186ec1d837da8fa1ef
Opcode Fuzzy Hash: ecee2cf33bcf465aa4bd8a1695fbfd33f5029dd800c439f043964eb6c85f9998
Instruction Fuzzy Hash: 46418AB69443069FC720EF69D8C4A5AFBF4FB85315F01CA29E9589B218E734E444CBD2

Function 6D274AF0 Relevance: 12.2, APIs: 8, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6D274B26
mbstowcs.MSVCRT ref: 6D274B55
_wcsnicmp.MSVCRT ref: 6D274BB2
strtol.MSVCRT ref: 6D274C12
lstrlenA.KERNEL32 ref: 6D274C20
malloc.MSVCRT ref: 6D274C89
SetLastError.KERNEL32 ref: 6D274CA3
free.MSVCRT ref: 6D274CDA

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ErrorLast_wcsnicmpfreelstrlenmallocmbstowcsstrlenstrtol
String ID:
API String ID: 533997002-0
Opcode ID: 48155007f92fcc230adaa6282cb97c6dd293364e79463af2242444660cbba986
Instruction ID: dbb6a1335a8083179d145df79417b11c101b3122e3e814d0236725f0a0c3ed54
Opcode Fuzzy Hash: 48155007f92fcc230adaa6282cb97c6dd293364e79463af2242444660cbba986
Instruction Fuzzy Hash: CD51D176A483198FD720DF29D48066AF7E5FBC8305F05893EE988D7200E775D94ACB92

Function 6D275CB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 6D275CD2
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6D275D89), ref: 6D275CEB
fwrite.MSVCRT ref: 6D275D20
abort.MSVCRT ref: 6D275D25

Strings

=, xrefs: 6D275D05
runtime: failed to create runtime initialization wait event., xrefs: 6D275D19

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionabortfwrite
String ID: =$runtime: failed to create runtime initialization wait event.
API String ID: 2455830200-3519180978
Opcode ID: 86e12355961edc318647d88560b70c0c798bbd2c0546ed9ed2167a55406e901b
Instruction ID: 30ea1a780bd585206ca59283a5119c99d247958a55349ad698d60b1fa646e768
Opcode Fuzzy Hash: 86e12355961edc318647d88560b70c0c798bbd2c0546ed9ed2167a55406e901b
Instruction Fuzzy Hash: E7F0CDB14043029FE710BF64C51932ABAF4EB41345F81886CD89496240DB7D9088CB53

Function 6D27655C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6D27652D
VirtualProtect.KERNEL32 ref: 6D276587
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D3253A8), ref: 6D276594

Part of subcall function 6D277220: fwrite.MSVCRT ref: 6D27724F
Part of subcall function 6D277220: vfprintf.MSVCRT ref: 6D27726F
Part of subcall function 6D277220: abort.MSVCRT ref: 6D277274

Strings

VirtualProtect failed with code 0x%x, xrefs: 6D27659A
@, xrefs: 6D276578

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$@
API String ID: 1616349570-2953866262
Opcode ID: c6613ebf8b13ab69f50fbabe3c87a2b0696240ffdd03740587b5b2054f0c96cd
Instruction ID: 9cd20e2a9f24001cb04060dafae46bbc9da17ab4be97aabcf98c69918df1c55a
Opcode Fuzzy Hash: c6613ebf8b13ab69f50fbabe3c87a2b0696240ffdd03740587b5b2054f0c96cd
Instruction Fuzzy Hash: 3F2139B69443069FD760EF28C884659FBF0FF45315F01CA29D99897268E734D544CB92

Function 6D274D00 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

bsearch.MSVCRT ref: 6D274D5F
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6D275BEF), ref: 6D274D9A
malloc.MSVCRT ref: 6D274DC8
qsort.MSVCRT ref: 6D274E16

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ErrorLastbsearchmallocqsort
String ID:
API String ID: 1451747280-0
Opcode ID: e2b99572bf0d9bcf1e3bdcb43c0a0ce46541b5fb3fb4092d4db74b25a93583c5
Instruction ID: 9fa21b5e3a5112ce9b27a8beb01e6ac9b69e933f6a79de617cb85b54f3ac35a6
Opcode Fuzzy Hash: e2b99572bf0d9bcf1e3bdcb43c0a0ce46541b5fb3fb4092d4db74b25a93583c5
Instruction Fuzzy Hash: B34145756483068FD730DF29D480A2ABBF5FF88315F05896DE8898B314E775E849CB92

Function 6D275850 Relevance: 7.6, APIs: 5, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 6D2758F5
SetLastError.KERNEL32 ref: 6D275917
SetLastError.KERNEL32 ref: 6D27592B

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ErrorLast$LocaleThread
String ID:
API String ID: 2451566642-0
Opcode ID: f85daaf16c200f7ccbbf0e44015664d00cf8f799c543567e6e6cf6897f027090
Instruction ID: 61c9b51c8b68c8241830758f4383c8603bd81c1c6805ecec5236ca48634dedae
Opcode Fuzzy Hash: f85daaf16c200f7ccbbf0e44015664d00cf8f799c543567e6e6cf6897f027090
Instruction Fuzzy Hash: EC21B931658309CFD720EF38C844A66B7F5BF4A314F558938E5A9CB280EB35E845CB52

Function 6D2770C0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6D2770D9
_unlock.MSVCRT ref: 6D277101
calloc.MSVCRT ref: 6D27714F

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction ID: eee9cf211cacf692e5634495a5ecc4549fe59900537d0fdfb11d1f8e98f2fb20
Opcode Fuzzy Hash: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction Fuzzy Hash: F0115E709982068FE7309F68C88076A7BE4FF85354F158A69E498CB385EB74D840CB92

Function 6D275DE0 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 6D275E10
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6D2745D9), ref: 6D275E1C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D2745D9), ref: 6D275E2E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6D2745D9), ref: 6D275E3E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D2745D9), ref: 6D275E50

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 98be021ecf15803845c553815af1e19375ea3ea9fe28d494fc62bed43ccd71a5
Instruction ID: 246e62a5711562a4af0d1f99321489e1af6e07641dfcb780e0f8edafaa89db79
Opcode Fuzzy Hash: 98be021ecf15803845c553815af1e19375ea3ea9fe28d494fc62bed43ccd71a5
Instruction Fuzzy Hash: 2E015275504309DFDB10FF79D98951AFBF8EF42214F414529D99447240DB3AA46CCB93

Function 6D277220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6D27724F
vfprintf.MSVCRT ref: 6D27726F
abort.MSVCRT ref: 6D277274

Strings

Mingw-w64 runtime failure:, xrefs: 6D277248

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: abortfwritevfprintf
String ID: Mingw-w64 runtime failure:
API String ID: 3176311984-2889761391
Opcode ID: 567884ae79a1d7d7a076df70d9b316edeaccc31b6c1042f1277989321e446905
Instruction ID: c1f6c3bf7abc80c4bb6a416455c0655e2865561c01f5a6f7dd89d4fabdbaa5e4
Opcode Fuzzy Hash: 567884ae79a1d7d7a076df70d9b316edeaccc31b6c1042f1277989321e446905
Instruction Fuzzy Hash: E1E0C2B088C3089ED320AF64C08565EBAE4FF89348F02C92CE1D847245C7788484CB93

Function 6D2765F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D1E12A5), ref: 6D276709

Strings

Unknown pseudo relocation bit size %d., xrefs: 6D276799
Unknown pseudo relocation protocol version %d., xrefs: 6D276864

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: d1fdbdd4d68aa39a09b85b2610ae43b59470fd0cb2e916aa28eb431cbb241a2b
Instruction ID: 7aa7f618bf6eafb79bf5c02d6333459f53041df83687e8d30dae3b2cbaac87b7
Opcode Fuzzy Hash: d1fdbdd4d68aa39a09b85b2610ae43b59470fd0cb2e916aa28eb431cbb241a2b
Instruction Fuzzy Hash: 54610434E4420A9FCB70DFA8C4C0769B7B6FF8531AF508529D9149B308D775AA46CBC2

Function 6D275BC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6D275C28

Part of subcall function 6D274D00: bsearch.MSVCRT ref: 6D274D5F

fprintf.MSVCRT ref: 6D275C5C

Strings

$, xrefs: 6D275C0D

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: bsearchfprintffwrite
String ID: $
API String ID: 1110293247-3993045852
Opcode ID: d691d613d3fb448683ca2553735132ce4b7f86a7474e4e2d5848e95f79663a1d
Instruction ID: d1639e49f665114e6f40ce3cfd34bd551aed633c293ceb632fc8617380d821c8
Opcode Fuzzy Hash: d691d613d3fb448683ca2553735132ce4b7f86a7474e4e2d5848e95f79663a1d
Instruction Fuzzy Hash: A20117B489C315CBD720AF28944826AFBE0FF48318F46892DE8C897240E3758440CB63

Function 6D274E50 Relevance: 5.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 6D274E72
free.MSVCRT ref: 6D274EB2
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,6D2753DA), ref: 6D274EDB
HeapFree.KERNEL32 ref: 6D274EF0

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: Heapfree$FreeProcess
String ID:
API String ID: 3425746932-0
Opcode ID: d97af89b28aa6937671491ea2f61d4a768579569bf8108e9f8de27327a571fe9
Instruction ID: d6ceca21ded268396afe95879296e169d00dfc58778791d41fc23ee7038f7d0e
Opcode Fuzzy Hash: d97af89b28aa6937671491ea2f61d4a768579569bf8108e9f8de27327a571fe9
Instruction Fuzzy Hash: 5221E7B5A047128BDB20EF25D1C471ABBE5BF88215F15C96DE8998B309D734D845CB82

Function 6D276870 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6D27687E
TlsGetValue.KERNEL32 ref: 6D2768A5
GetLastError.KERNEL32 ref: 6D2768AC
LeaveCriticalSection.KERNEL32 ref: 6D2768CC

Memory Dump Source

Source File: 00000003.00000002.1545226155.000000006D1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D1E0000, based on PE: true

Associated: 00000003.00000002.1545206165.000000006D1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545308722.000000006D278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545329674.000000006D279000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545351406.000000006D27A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545374531.000000006D27F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545445999.000000006D328000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D32E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545466803.000000006D333000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545511561.000000006D346000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545534060.000000006D34D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545553037.000000006D34E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1545571755.000000006D351000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d1e0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 1f123590dc12cb239e824d57c477e389fbae8109a8623d34fca2d243820ed03a
Instruction ID: c57d7c819eb4b2c98e4a4deea6ea9180568d1aa0a2de47519ee62a97b8b73479
Opcode Fuzzy Hash: 1f123590dc12cb239e824d57c477e389fbae8109a8623d34fca2d243820ed03a
Instruction Fuzzy Hash: 1DF0A47590030A9FDB20BF7CC8C9A6A7BB8EA45295B054568DD8497205EB34E45CCBE3

Analysis Process: rundll32.exePID: 5552, Parent PID: 2768COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 6D035FB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_beginthread.MSVCRT ref: 6D035FD6
_errno.MSVCRT ref: 6D035FE1
_errno.MSVCRT ref: 6D035FE8
fprintf.MSVCRT ref: 6D036008
abort.MSVCRT ref: 6D03600D
Sleep.KERNEL32 ref: 6D036026

Strings

runtime: failed to create new OS thread (%d), xrefs: 6D035FF9

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: _errno$Sleep_beginthreadabortfprintf
String ID: runtime: failed to create new OS thread (%d)
API String ID: 1261927973-3231778263
Opcode ID: 7cd95498feee0c905f0bba0d36ae1340b0e365a23b14351b335b859cec9dacb3
Instruction ID: c1ead3ccada2da2f0ed470e5155a0bcbc501a6e99d0b092ce82e472e01f8ac31
Opcode Fuzzy Hash: 7cd95498feee0c905f0bba0d36ae1340b0e365a23b14351b335b859cec9dacb3
Instruction Fuzzy Hash: 71016D74408326DFD7007F69D88872EBBF4EF86320F43492DE58583260C7709440DAA3

Function 6D00CEA0 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 6D00CEC8

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction ID: cb090b5f4a9b1e7a49aa4cf414030b1464c0b68a7e1920abc975b6d50006655f
Opcode Fuzzy Hash: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction Fuzzy Hash: 20E0E571505640CFDB15DF18C2C1316BBE1EB48A00F0485A8DE098F74AD734ED10CB92

Non-executed Functions

Function 6D036300 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D03634F
UnhandledExceptionFilter.KERNEL32 ref: 6D03635F
GetCurrentProcess.KERNEL32 ref: 6D036368
TerminateProcess.KERNEL32 ref: 6D036379
abort.MSVCRT ref: 6D036382

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 8bbdd7b5e7ccf2e9f19f4092c3d1b57c2c2277c43577d621ff4e4b6e6af6d423
Instruction ID: a67e94563b746c6370d1cfabcec8790bf8254522009dd9206c8c0e17eae4e1f4
Opcode Fuzzy Hash: 8bbdd7b5e7ccf2e9f19f4092c3d1b57c2c2277c43577d621ff4e4b6e6af6d423
Instruction Fuzzy Hash: 4511A7B5904205DFDB00FF69D14576ABBF1BB45304F41852DE948C7351EBB49944CF92

Function 6D0362FC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D03634F
UnhandledExceptionFilter.KERNEL32 ref: 6D03635F
GetCurrentProcess.KERNEL32 ref: 6D036368
TerminateProcess.KERNEL32 ref: 6D036379
abort.MSVCRT ref: 6D036382

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: fffcd914e8e1b426044f2e174771d88a6c0c3c36ec9adacb9cef2d30dce4006e
Instruction ID: 53119b6480ac0a0a169d27900350c3c1a13bb17561d6220408cd233a3aba47ec
Opcode Fuzzy Hash: fffcd914e8e1b426044f2e174771d88a6c0c3c36ec9adacb9cef2d30dce4006e
Instruction Fuzzy Hash: AD11B3B5804206DFDB00FF6AE149769BBF1BB06300F41862DE949C7341EBB49944CFA2

Function 6D035E79 Relevance: 21.0, APIs: 9, Strings: 3, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 6D035EAB
abort.MSVCRT ref: 6D035EB0
EnterCriticalSection.KERNEL32 ref: 6D035ECF
LeaveCriticalSection.KERNEL32 ref: 6D035EE9
SetEvent.KERNEL32 ref: 6D035EFA
fwrite.MSVCRT ref: 6D035F33
abort.MSVCRT ref: 6D035F38
EnterCriticalSection.KERNEL32 ref: 6D035F4A
LeaveCriticalSection.KERNEL32 ref: 6D035F63

Strings

runtime: failed to signal runtime initialization complete., xrefs: 6D035F2C
unexpected cgo_bindm on Windows, xrefs: 6D035EA4
;, xrefs: 6D035F18

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeaveabortfwrite$Event
String ID: ;$runtime: failed to signal runtime initialization complete.$unexpected cgo_bindm on Windows
API String ID: 3057923235-924395932
Opcode ID: 2721269e3de2d76480f0faff15622f45258cbce2f55a655de858d99fcdfef448
Instruction ID: 712809af5921a4e76f4e7787d75ad322bed58c5b0b0e5da5a88d3dcbd4bc6e24
Opcode Fuzzy Hash: 2721269e3de2d76480f0faff15622f45258cbce2f55a655de858d99fcdfef448
Instruction Fuzzy Hash: 5811A4B5808251DFEB00BF79D10E32EBAF4BB45304F42891CE98597245DBB5A158CFA3

Function 6D0364A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6D03652D

Strings

@, xrefs: 6D036578
VirtualQuery failed for %d bytes at address %p, xrefs: 6D0365C7
VirtualProtect failed with code 0x%x, xrefs: 6D03659A
Address %p has no image-section, xrefs: 6D0365DB

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: 77d2dc340c2fc35b19a7868a9581fb4398634c0d0a7090f6aceaf62e6e5aa7f7
Instruction ID: b696e064027648769a617fdfa33ff20184ad7d797a66fa154bbb03f8f9993eb9
Opcode Fuzzy Hash: 77d2dc340c2fc35b19a7868a9581fb4398634c0d0a7090f6aceaf62e6e5aa7f7
Instruction Fuzzy Hash: 49415BB69043129FE700EF69E48571AFBF0FB85354F42CA2DE9589B215E770E444CBA2

Function 6CFA13E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6CFA13F0
LoadLibraryA.KERNEL32 ref: 6CFA1406
GetProcAddress.KERNEL32 ref: 6CFA1425
GetProcAddress.KERNEL32 ref: 6CFA1437

Strings

__register_frame_info, xrefs: 6CFA141A
libgcc_s_dw2-1.dll, xrefs: 6CFA13E9, 6CFA13FF
__deregister_frame_info, xrefs: 6CFA142C

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: efba1bd71a6ec0eca683e222030f3244deedd536189898fad870fed811ad7372
Instruction ID: 89a64a7e3e0d8ea00a4646cd83330c200569ef8d03c25bcd1852658cf6ca7aae
Opcode Fuzzy Hash: efba1bd71a6ec0eca683e222030f3244deedd536189898fad870fed811ad7372
Instruction Fuzzy Hash: 3F011EB5809315DFD710BFBDA60A31EBEF8AB46755F02856DD88987200DB7094148BA3

Function 6D034AF0 Relevance: 12.2, APIs: 8, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6D034B26
mbstowcs.MSVCRT ref: 6D034B55
_wcsnicmp.MSVCRT ref: 6D034BB2
strtol.MSVCRT ref: 6D034C12
lstrlenA.KERNEL32 ref: 6D034C20
malloc.MSVCRT ref: 6D034C89
SetLastError.KERNEL32 ref: 6D034CA3
free.MSVCRT ref: 6D034CDA

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorLast_wcsnicmpfreelstrlenmallocmbstowcsstrlenstrtol
String ID:
API String ID: 533997002-0
Opcode ID: 5d00aac3864163652111c7654a910e4bfe13d8c15166267f84e4bf8c8604f38b
Instruction ID: 4a202f2b2f46d8e159116b5a94e5ad29fbc43cab268ec21c630205a2171ea9a0
Opcode Fuzzy Hash: 5d00aac3864163652111c7654a910e4bfe13d8c15166267f84e4bf8c8604f38b
Instruction Fuzzy Hash: B751A6756083269FE740DF29D48036EB7E5FBC8304F46892EE998DB200E776D545CB92

Function 6D036060 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6D03606F
fwrite.MSVCRT ref: 6D0360BD
abort.MSVCRT ref: 6D0360C2
free.MSVCRT ref: 6D0360E5

Part of subcall function 6D035FB0: _beginthread.MSVCRT ref: 6D035FD6
Part of subcall function 6D035FB0: _errno.MSVCRT ref: 6D035FE1
Part of subcall function 6D035FB0: _errno.MSVCRT ref: 6D035FE8
Part of subcall function 6D035FB0: fprintf.MSVCRT ref: 6D036008
Part of subcall function 6D035FB0: abort.MSVCRT ref: 6D03600D

Strings

runtime/cgo: out of memory in thread_start, xrefs: 6D0360B6
+, xrefs: 6D0360A2

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: _errnoabort$_beginthreadfprintffreefwritemalloc
String ID: +$runtime/cgo: out of memory in thread_start
API String ID: 2633710936-1802439445
Opcode ID: 75dd01a5f585020ae9889190f4bf368c9797b307fdffa1664d2abc41ccbbde1c
Instruction ID: 080c21f5643f0c6f589d1f6837b82ea17421b464af088f8c008a40af83661f1b
Opcode Fuzzy Hash: 75dd01a5f585020ae9889190f4bf368c9797b307fdffa1664d2abc41ccbbde1c
Instruction Fuzzy Hash: CF21E5B4908711CFD700AF29D58461ABBF4FF89304F46899DEA888B326D3759840CF92

Function 6D035CB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 6D035CD2
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6D035D89), ref: 6D035CEB
fwrite.MSVCRT ref: 6D035D20
abort.MSVCRT ref: 6D035D25

Strings

runtime: failed to create runtime initialization wait event., xrefs: 6D035D19
=, xrefs: 6D035D05

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionabortfwrite
String ID: =$runtime: failed to create runtime initialization wait event.
API String ID: 2455830200-3519180978
Opcode ID: d5814695b6e2310706c765d664f659c5d0456d0facb5657572edc2accf6461bc
Instruction ID: cd429b8d801458a45d7f3995882a738a6f52ca5a359ad12064133a92c707e2e1
Opcode Fuzzy Hash: d5814695b6e2310706c765d664f659c5d0456d0facb5657572edc2accf6461bc
Instruction Fuzzy Hash: 18F0C9B0808302DFE700BF69D51932EBAF4BB41344F82895CD8998A280DBB991548F53

Function 6CFA1020 Relevance: 9.1, APIs: 6, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6CFA12E0,?,?,?,?,?,?,6CFA13A3), ref: 6CFA1057
_amsg_exit.MSVCRT ref: 6CFA1085

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 71652288e25ea94356bfb31c3fc80946343a508a208b376040852f1f08a509b1
Instruction ID: 6e6cce696cac4a4c4e2523a67f703d74fb86d61090955bc0406c3b95b5a81ebc
Opcode Fuzzy Hash: 71652288e25ea94356bfb31c3fc80946343a508a208b376040852f1f08a509b1
Instruction Fuzzy Hash: 6141AE72608244CBEB00AFAAD48470BB7F5FB82748F12CA2DD5548B644DBB5C482CB93

Function 6D03655C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6D03652D
VirtualProtect.KERNEL32 ref: 6D036587
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D0E53A8), ref: 6D036594

Part of subcall function 6D037220: fwrite.MSVCRT ref: 6D03724F
Part of subcall function 6D037220: vfprintf.MSVCRT ref: 6D03726F
Part of subcall function 6D037220: abort.MSVCRT ref: 6D037274

Strings

@, xrefs: 6D036578
VirtualProtect failed with code 0x%x, xrefs: 6D03659A

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$@
API String ID: 1616349570-2953866262
Opcode ID: 97e8950c80a025038bc46adea240b935086222b01aab93ffd75b5efa5fcfac14
Instruction ID: 622bd31f76f5b4ee472783cda8cacefb0df26ddc880623f15539f764b0a347c8
Opcode Fuzzy Hash: 97e8950c80a025038bc46adea240b935086222b01aab93ffd75b5efa5fcfac14
Instruction Fuzzy Hash: 512114B68083128FE700EF29D489719BBF0FB84314F42CA2DE9989B258E770D5448B92

Function 6D035B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6D035B34
FormatMessageA.KERNEL32 ref: 6D035B79
fprintf.MSVCRT ref: 6D035BA2
LocalFree.KERNEL32 ref: 6D035BAE

Strings

Erro: %s, xrefs: 6D035B93

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessagefprintf
String ID: Erro: %s
API String ID: 659079672-2412703935
Opcode ID: bcfdcdd194f72bb31272ac1a187a012fb048e00b829f31681fb36db948dcd96f
Instruction ID: b6a68291f09893421d4b036f25f66c495346106cc4d8f18a42fe11ce7c78cd81
Opcode Fuzzy Hash: bcfdcdd194f72bb31272ac1a187a012fb048e00b829f31681fb36db948dcd96f
Instruction Fuzzy Hash: E1019DB4408302DFE700AF69D58831EBBF0BB98349F018A1DE8D896250D7B982488F93

Function 6D034D00 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

bsearch.MSVCRT ref: 6D034D5F
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6D035BEF), ref: 6D034D9A
malloc.MSVCRT ref: 6D034DC8
qsort.MSVCRT ref: 6D034E16

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorLastbsearchmallocqsort
String ID:
API String ID: 1451747280-0
Opcode ID: 8df4163c1fc56df463872578181824e63f056d19ec0bfe6c7dd83c01f7c575b4
Instruction ID: f3726d8690514ea81f2a2d049e8c89df5ebb6772147bff2e37417d3e0bb127bf
Opcode Fuzzy Hash: 8df4163c1fc56df463872578181824e63f056d19ec0bfe6c7dd83c01f7c575b4
Instruction Fuzzy Hash: FF415B75A083129FE710DF29D48072AB7F5FF88314F06892DE8898B714E775E854CB92

Function 6D035850 Relevance: 7.6, APIs: 5, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 6D0358F5
SetLastError.KERNEL32 ref: 6D035917
SetLastError.KERNEL32 ref: 6D03592B

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorLast$LocaleThread
String ID:
API String ID: 2451566642-0
Opcode ID: 026d44420009034860c6988a266122c44096d6ebf819ff37147dc3d91f64ae33
Instruction ID: 641631b120be2bb29516fe888ebe434df9a58f96d35e7c31465bc85c418a0ae9
Opcode Fuzzy Hash: 026d44420009034860c6988a266122c44096d6ebf819ff37147dc3d91f64ae33
Instruction Fuzzy Hash: 2221D774614206CBE700EB39D84976677F0FF49314F468928E5A9CB290EB75E809CB52

Function 6D0370C0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6D0370D9
_unlock.MSVCRT ref: 6D037101
calloc.MSVCRT ref: 6D03714F

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction ID: eecd00800fddf7e9ac07304e6d6ecf8701185e0e61bc8e8e3e00a2b8ebc2568d
Opcode Fuzzy Hash: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction Fuzzy Hash: CA115E71908222CFF7009F6CC88076A7BE4FF85354F568A69E598CB385EB74D840CB52

Function 6D036250 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6D036289
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFA13B9), ref: 6D03629A
GetCurrentThreadId.KERNEL32 ref: 6D0362A2
GetTickCount.KERNEL32 ref: 6D0362AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFA13B9), ref: 6D0362B9

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 84505eafaae587b386f30304fc7ceb8dc26961244bfa2a11ecf8b91ad03ed1f8
Instruction ID: aa01ed1ba078856b66c40604cd81f5a3ca7421f915e61161451b3c7ef2a40690
Opcode Fuzzy Hash: 84505eafaae587b386f30304fc7ceb8dc26961244bfa2a11ecf8b91ad03ed1f8
Instruction Fuzzy Hash: B4115EB55053028BDB10EF79E48874BBBF5FB89254F464E39E444C7200EB31D9488B92

Function 6D035DE0 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 6D035E10
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E1C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E2E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E3E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E50

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: b659e394d53e915b44db5ca1b153161ded35e8c1219786b967dcea9ff281f972
Instruction ID: 75bd92f05904712af5d1138305d126be69855629d33e2425f9a61e37eeca29ef
Opcode Fuzzy Hash: b659e394d53e915b44db5ca1b153161ded35e8c1219786b967dcea9ff281f972
Instruction Fuzzy Hash: F00175B5914305CFDB00FF7DE58961ABBF9AF46210F42052DD8904B254DBB1A568CFA3

Function 6D037220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6D03724F
vfprintf.MSVCRT ref: 6D03726F
abort.MSVCRT ref: 6D037274

Strings

Mingw-w64 runtime failure:, xrefs: 6D037248

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: abortfwritevfprintf
String ID: Mingw-w64 runtime failure:
API String ID: 3176311984-2889761391
Opcode ID: b0844b673c652b9d01a816dead33ec162ec3093ae28a1c52970c96a58c67cd52
Instruction ID: f278134a0dbe02ea98288a5555501b065a245129d2abd9d6ae0bb38349695003
Opcode Fuzzy Hash: b0844b673c652b9d01a816dead33ec162ec3093ae28a1c52970c96a58c67cd52
Instruction Fuzzy Hash: EDE0AEB080C31ADEE300AF65C08531EBAE4AF88348F43891CE2C847251C77894848B63

Function 6D0365F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFA12A5), ref: 6D036709

Strings

Unknown pseudo relocation protocol version %d., xrefs: 6D036864
Unknown pseudo relocation bit size %d., xrefs: 6D036799

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 780b2633585ce91cc049221a9564f8a4a67b7f1483a874d214b6a7030a93a323
Instruction ID: 07d7daae529d722dc15c26c51d93214a2ef3219ed4e743c4ff9b9ba38db5cd85
Opcode Fuzzy Hash: 780b2633585ce91cc049221a9564f8a4a67b7f1483a874d214b6a7030a93a323
Instruction Fuzzy Hash: 0E61EF35A042278FEB00DFA8D4C0769B7B1FF85354B92CA2DD8459B306D3B0A8118BD2

Function 6D035BC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6D035C28

Part of subcall function 6D034D00: bsearch.MSVCRT ref: 6D034D5F

fprintf.MSVCRT ref: 6D035C5C

Strings

$, xrefs: 6D035C0D

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: bsearchfprintffwrite
String ID: $
API String ID: 1110293247-3993045852
Opcode ID: d3b8fe110cd33dd1b2988d4173d61a1a022aab9060be1ce692eb729da8693c73
Instruction ID: 6739c13200b01a4936a4b36870c4d26e59515aa09f16b680695747168f630984
Opcode Fuzzy Hash: d3b8fe110cd33dd1b2988d4173d61a1a022aab9060be1ce692eb729da8693c73
Instruction Fuzzy Hash: 8501C5B981C322DFE700AF69944936EBBE4AF48358F43896DE9C897241E775C440CB53

Function 6D034E50 Relevance: 5.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 6D034E72
free.MSVCRT ref: 6D034EB2
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,6D0353DA), ref: 6D034EDB
HeapFree.KERNEL32 ref: 6D034EF0

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: Heapfree$FreeProcess
String ID:
API String ID: 3425746932-0
Opcode ID: 3390865ff85d0b5f092ea770ccbfb8640d95086a12b6b7bb5e29a78f16f3254e
Instruction ID: a3a6bb79fca4a873a92eee24565d36daffe320853111629be77ac5dd8faf0526
Opcode Fuzzy Hash: 3390865ff85d0b5f092ea770ccbfb8640d95086a12b6b7bb5e29a78f16f3254e
Instruction Fuzzy Hash: A221E5B5A08212DBEB00EF25D1C471ABBE1BF88204F16C96CE8898F309D735D844CF82

Function 6D036870 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6D03687E
TlsGetValue.KERNEL32 ref: 6D0368A5
GetLastError.KERNEL32 ref: 6D0368AC
LeaveCriticalSection.KERNEL32 ref: 6D0368CC

Memory Dump Source

Source File: 0000000D.00000002.1641855228.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 0000000D.00000002.1641736017.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642238941.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642361552.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642482495.000000006D03A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642595417.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1642969931.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643084610.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643308459.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643419931.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643531858.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000D.00000002.1643638296.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 58f87414ffa2aec1ac285bc12c42cb409f9ecd809bde30b01f29ecc7ac57e513
Instruction ID: e16fa7c0565141f27c6a33359c7655fe2a698f7feadc23692463e87a80932af4
Opcode Fuzzy Hash: 58f87414ffa2aec1ac285bc12c42cb409f9ecd809bde30b01f29ecc7ac57e513
Instruction Fuzzy Hash: ACF044B59042168FEB007F6DD489A1ABBB4EE49350B06066CDD4497305EF70E559CBE3

Analysis Process: rundll32.exePID: 1872, Parent PID: 2768COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 6D035FB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_beginthread.MSVCRT ref: 6D035FD6
_errno.MSVCRT ref: 6D035FE1
_errno.MSVCRT ref: 6D035FE8
fprintf.MSVCRT ref: 6D036008
abort.MSVCRT ref: 6D03600D
Sleep.KERNEL32 ref: 6D036026

Strings

runtime: failed to create new OS thread (%d), xrefs: 6D035FF9

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: _errno$Sleep_beginthreadabortfprintf
String ID: runtime: failed to create new OS thread (%d)
API String ID: 1261927973-3231778263
Opcode ID: 7cd95498feee0c905f0bba0d36ae1340b0e365a23b14351b335b859cec9dacb3
Instruction ID: c1ead3ccada2da2f0ed470e5155a0bcbc501a6e99d0b092ce82e472e01f8ac31
Opcode Fuzzy Hash: 7cd95498feee0c905f0bba0d36ae1340b0e365a23b14351b335b859cec9dacb3
Instruction Fuzzy Hash: 71016D74408326DFD7007F69D88872EBBF4EF86320F43492DE58583260C7709440DAA3

Function 6D00CEA0 Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 6D00CEC8

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction ID: cb090b5f4a9b1e7a49aa4cf414030b1464c0b68a7e1920abc975b6d50006655f
Opcode Fuzzy Hash: a2cfa61b4501b04a2c5f40c8367aff7a2baaadd22eedac0d36916a775c4c6aab
Instruction Fuzzy Hash: 20E0E571505640CFDB15DF18C2C1316BBE1EB48A00F0485A8DE098F74AD734ED10CB92

Non-executed Functions

Function 6D036300 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D03634F
UnhandledExceptionFilter.KERNEL32 ref: 6D03635F
GetCurrentProcess.KERNEL32 ref: 6D036368
TerminateProcess.KERNEL32 ref: 6D036379
abort.MSVCRT ref: 6D036382

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 8bbdd7b5e7ccf2e9f19f4092c3d1b57c2c2277c43577d621ff4e4b6e6af6d423
Instruction ID: a67e94563b746c6370d1cfabcec8790bf8254522009dd9206c8c0e17eae4e1f4
Opcode Fuzzy Hash: 8bbdd7b5e7ccf2e9f19f4092c3d1b57c2c2277c43577d621ff4e4b6e6af6d423
Instruction Fuzzy Hash: 4511A7B5904205DFDB00FF69D14576ABBF1BB45304F41852DE948C7351EBB49944CF92

Function 6D0362FC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6D03634F
UnhandledExceptionFilter.KERNEL32 ref: 6D03635F
GetCurrentProcess.KERNEL32 ref: 6D036368
TerminateProcess.KERNEL32 ref: 6D036379
abort.MSVCRT ref: 6D036382

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: fffcd914e8e1b426044f2e174771d88a6c0c3c36ec9adacb9cef2d30dce4006e
Instruction ID: 53119b6480ac0a0a169d27900350c3c1a13bb17561d6220408cd233a3aba47ec
Opcode Fuzzy Hash: fffcd914e8e1b426044f2e174771d88a6c0c3c36ec9adacb9cef2d30dce4006e
Instruction Fuzzy Hash: AD11B3B5804206DFDB00FF6AE149769BBF1BB06300F41862DE949C7341EBB49944CFA2

Function 6D035E79 Relevance: 21.0, APIs: 9, Strings: 3, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 6D035EAB
abort.MSVCRT ref: 6D035EB0
EnterCriticalSection.KERNEL32 ref: 6D035ECF
LeaveCriticalSection.KERNEL32 ref: 6D035EE9
SetEvent.KERNEL32 ref: 6D035EFA
fwrite.MSVCRT ref: 6D035F33
abort.MSVCRT ref: 6D035F38
EnterCriticalSection.KERNEL32 ref: 6D035F4A
LeaveCriticalSection.KERNEL32 ref: 6D035F63

Strings

;, xrefs: 6D035F18
unexpected cgo_bindm on Windows, xrefs: 6D035EA4
runtime: failed to signal runtime initialization complete., xrefs: 6D035F2C

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeaveabortfwrite$Event
String ID: ;$runtime: failed to signal runtime initialization complete.$unexpected cgo_bindm on Windows
API String ID: 3057923235-924395932
Opcode ID: 2721269e3de2d76480f0faff15622f45258cbce2f55a655de858d99fcdfef448
Instruction ID: 712809af5921a4e76f4e7787d75ad322bed58c5b0b0e5da5a88d3dcbd4bc6e24
Opcode Fuzzy Hash: 2721269e3de2d76480f0faff15622f45258cbce2f55a655de858d99fcdfef448
Instruction Fuzzy Hash: 5811A4B5808251DFEB00BF79D10E32EBAF4BB45304F42891CE98597245DBB5A158CFA3

Function 6D0364A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6D03652D

Strings

VirtualProtect failed with code 0x%x, xrefs: 6D03659A
@, xrefs: 6D036578
Address %p has no image-section, xrefs: 6D0365DB
VirtualQuery failed for %d bytes at address %p, xrefs: 6D0365C7

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: 77d2dc340c2fc35b19a7868a9581fb4398634c0d0a7090f6aceaf62e6e5aa7f7
Instruction ID: b696e064027648769a617fdfa33ff20184ad7d797a66fa154bbb03f8f9993eb9
Opcode Fuzzy Hash: 77d2dc340c2fc35b19a7868a9581fb4398634c0d0a7090f6aceaf62e6e5aa7f7
Instruction Fuzzy Hash: 49415BB69043129FE700EF69E48571AFBF0FB85354F42CA2DE9589B215E770E444CBA2

Function 6CFA13E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6CFA13F0
LoadLibraryA.KERNEL32 ref: 6CFA1406
GetProcAddress.KERNEL32 ref: 6CFA1425
GetProcAddress.KERNEL32 ref: 6CFA1437

Strings

__register_frame_info, xrefs: 6CFA141A
__deregister_frame_info, xrefs: 6CFA142C
libgcc_s_dw2-1.dll, xrefs: 6CFA13E9, 6CFA13FF

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: efba1bd71a6ec0eca683e222030f3244deedd536189898fad870fed811ad7372
Instruction ID: 89a64a7e3e0d8ea00a4646cd83330c200569ef8d03c25bcd1852658cf6ca7aae
Opcode Fuzzy Hash: efba1bd71a6ec0eca683e222030f3244deedd536189898fad870fed811ad7372
Instruction Fuzzy Hash: 3F011EB5809315DFD710BFBDA60A31EBEF8AB46755F02856DD88987200DB7094148BA3

Function 6D034AF0 Relevance: 12.2, APIs: 8, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6D034B26
mbstowcs.MSVCRT ref: 6D034B55
_wcsnicmp.MSVCRT ref: 6D034BB2
strtol.MSVCRT ref: 6D034C12
lstrlenA.KERNEL32 ref: 6D034C20
malloc.MSVCRT ref: 6D034C89
SetLastError.KERNEL32 ref: 6D034CA3
free.MSVCRT ref: 6D034CDA

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorLast_wcsnicmpfreelstrlenmallocmbstowcsstrlenstrtol
String ID:
API String ID: 533997002-0
Opcode ID: 5d00aac3864163652111c7654a910e4bfe13d8c15166267f84e4bf8c8604f38b
Instruction ID: 4a202f2b2f46d8e159116b5a94e5ad29fbc43cab268ec21c630205a2171ea9a0
Opcode Fuzzy Hash: 5d00aac3864163652111c7654a910e4bfe13d8c15166267f84e4bf8c8604f38b
Instruction Fuzzy Hash: B751A6756083269FE740DF29D48036EB7E5FBC8304F46892EE998DB200E776D545CB92

Function 6D036060 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 6D03606F
fwrite.MSVCRT ref: 6D0360BD
abort.MSVCRT ref: 6D0360C2
free.MSVCRT ref: 6D0360E5

Part of subcall function 6D035FB0: _beginthread.MSVCRT ref: 6D035FD6
Part of subcall function 6D035FB0: _errno.MSVCRT ref: 6D035FE1
Part of subcall function 6D035FB0: _errno.MSVCRT ref: 6D035FE8
Part of subcall function 6D035FB0: fprintf.MSVCRT ref: 6D036008
Part of subcall function 6D035FB0: abort.MSVCRT ref: 6D03600D

Strings

+, xrefs: 6D0360A2
runtime/cgo: out of memory in thread_start, xrefs: 6D0360B6

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: _errnoabort$_beginthreadfprintffreefwritemalloc
String ID: +$runtime/cgo: out of memory in thread_start
API String ID: 2633710936-1802439445
Opcode ID: 75dd01a5f585020ae9889190f4bf368c9797b307fdffa1664d2abc41ccbbde1c
Instruction ID: 080c21f5643f0c6f589d1f6837b82ea17421b464af088f8c008a40af83661f1b
Opcode Fuzzy Hash: 75dd01a5f585020ae9889190f4bf368c9797b307fdffa1664d2abc41ccbbde1c
Instruction Fuzzy Hash: CF21E5B4908711CFD700AF29D58461ABBF4FF89304F46899DEA888B326D3759840CF92

Function 6D035CB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 6D035CD2
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6D035D89), ref: 6D035CEB
fwrite.MSVCRT ref: 6D035D20
abort.MSVCRT ref: 6D035D25

Strings

runtime: failed to create runtime initialization wait event., xrefs: 6D035D19
=, xrefs: 6D035D05

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionabortfwrite
String ID: =$runtime: failed to create runtime initialization wait event.
API String ID: 2455830200-3519180978
Opcode ID: d5814695b6e2310706c765d664f659c5d0456d0facb5657572edc2accf6461bc
Instruction ID: cd429b8d801458a45d7f3995882a738a6f52ca5a359ad12064133a92c707e2e1
Opcode Fuzzy Hash: d5814695b6e2310706c765d664f659c5d0456d0facb5657572edc2accf6461bc
Instruction Fuzzy Hash: 18F0C9B0808302DFE700BF69D51932EBAF4BB41344F82895CD8998A280DBB991548F53

Function 6CFA1020 Relevance: 9.1, APIs: 6, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6CFA12E0,?,?,?,?,?,?,6CFA13A3), ref: 6CFA1057
_amsg_exit.MSVCRT ref: 6CFA1085

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 71652288e25ea94356bfb31c3fc80946343a508a208b376040852f1f08a509b1
Instruction ID: 6e6cce696cac4a4c4e2523a67f703d74fb86d61090955bc0406c3b95b5a81ebc
Opcode Fuzzy Hash: 71652288e25ea94356bfb31c3fc80946343a508a208b376040852f1f08a509b1
Instruction Fuzzy Hash: 6141AE72608244CBEB00AFAAD48470BB7F5FB82748F12CA2DD5548B644DBB5C482CB93

Function 6D03655C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6D03652D
VirtualProtect.KERNEL32 ref: 6D036587
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D0E53A8), ref: 6D036594

Part of subcall function 6D037220: fwrite.MSVCRT ref: 6D03724F
Part of subcall function 6D037220: vfprintf.MSVCRT ref: 6D03726F
Part of subcall function 6D037220: abort.MSVCRT ref: 6D037274

Strings

VirtualProtect failed with code 0x%x, xrefs: 6D03659A
@, xrefs: 6D036578

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$@
API String ID: 1616349570-2953866262
Opcode ID: 97e8950c80a025038bc46adea240b935086222b01aab93ffd75b5efa5fcfac14
Instruction ID: 622bd31f76f5b4ee472783cda8cacefb0df26ddc880623f15539f764b0a347c8
Opcode Fuzzy Hash: 97e8950c80a025038bc46adea240b935086222b01aab93ffd75b5efa5fcfac14
Instruction Fuzzy Hash: 512114B68083128FE700EF29D489719BBF0FB84314F42CA2DE9989B258E770D5448B92

Function 6D035B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6D035B34
FormatMessageA.KERNEL32 ref: 6D035B79
fprintf.MSVCRT ref: 6D035BA2
LocalFree.KERNEL32 ref: 6D035BAE

Strings

Erro: %s, xrefs: 6D035B93

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessagefprintf
String ID: Erro: %s
API String ID: 659079672-2412703935
Opcode ID: bcfdcdd194f72bb31272ac1a187a012fb048e00b829f31681fb36db948dcd96f
Instruction ID: b6a68291f09893421d4b036f25f66c495346106cc4d8f18a42fe11ce7c78cd81
Opcode Fuzzy Hash: bcfdcdd194f72bb31272ac1a187a012fb048e00b829f31681fb36db948dcd96f
Instruction Fuzzy Hash: E1019DB4408302DFE700AF69D58831EBBF0BB98349F018A1DE8D896250D7B982488F93

Function 6D034D00 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

bsearch.MSVCRT ref: 6D034D5F
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6D035BEF), ref: 6D034D9A
malloc.MSVCRT ref: 6D034DC8
qsort.MSVCRT ref: 6D034E16

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorLastbsearchmallocqsort
String ID:
API String ID: 1451747280-0
Opcode ID: 8df4163c1fc56df463872578181824e63f056d19ec0bfe6c7dd83c01f7c575b4
Instruction ID: f3726d8690514ea81f2a2d049e8c89df5ebb6772147bff2e37417d3e0bb127bf
Opcode Fuzzy Hash: 8df4163c1fc56df463872578181824e63f056d19ec0bfe6c7dd83c01f7c575b4
Instruction Fuzzy Hash: FF415B75A083129FE710DF29D48072AB7F5FF88314F06892DE8898B714E775E854CB92

Function 6D035850 Relevance: 7.6, APIs: 5, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 6D0358F5
SetLastError.KERNEL32 ref: 6D035917
SetLastError.KERNEL32 ref: 6D03592B

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ErrorLast$LocaleThread
String ID:
API String ID: 2451566642-0
Opcode ID: 026d44420009034860c6988a266122c44096d6ebf819ff37147dc3d91f64ae33
Instruction ID: 641631b120be2bb29516fe888ebe434df9a58f96d35e7c31465bc85c418a0ae9
Opcode Fuzzy Hash: 026d44420009034860c6988a266122c44096d6ebf819ff37147dc3d91f64ae33
Instruction Fuzzy Hash: 2221D774614206CBE700EB39D84976677F0FF49314F468928E5A9CB290EB75E809CB52

Function 6D0370C0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6D0370D9
_unlock.MSVCRT ref: 6D037101
calloc.MSVCRT ref: 6D03714F

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction ID: eecd00800fddf7e9ac07304e6d6ecf8701185e0e61bc8e8e3e00a2b8ebc2568d
Opcode Fuzzy Hash: 4d3c068b07ec5fce6d9273f5b487f9c815bb7a17f2cdc34182bbc4932eb09fa6
Instruction Fuzzy Hash: CA115E71908222CFF7009F6CC88076A7BE4FF85354F568A69E598CB385EB74D840CB52

Function 6D036250 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6D036289
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFA13B9), ref: 6D03629A
GetCurrentThreadId.KERNEL32 ref: 6D0362A2
GetTickCount.KERNEL32 ref: 6D0362AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFA13B9), ref: 6D0362B9

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 84505eafaae587b386f30304fc7ceb8dc26961244bfa2a11ecf8b91ad03ed1f8
Instruction ID: aa01ed1ba078856b66c40604cd81f5a3ca7421f915e61161451b3c7ef2a40690
Opcode Fuzzy Hash: 84505eafaae587b386f30304fc7ceb8dc26961244bfa2a11ecf8b91ad03ed1f8
Instruction Fuzzy Hash: B4115EB55053028BDB10EF79E48874BBBF5FB89254F464E39E444C7200EB31D9488B92

Function 6D035DE0 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 6D035E10
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E1C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E2E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E3E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D0345D9), ref: 6D035E50

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: b659e394d53e915b44db5ca1b153161ded35e8c1219786b967dcea9ff281f972
Instruction ID: 75bd92f05904712af5d1138305d126be69855629d33e2425f9a61e37eeca29ef
Opcode Fuzzy Hash: b659e394d53e915b44db5ca1b153161ded35e8c1219786b967dcea9ff281f972
Instruction Fuzzy Hash: F00175B5914305CFDB00FF7DE58961ABBF9AF46210F42052DD8904B254DBB1A568CFA3

Function 6D037220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6D03724F
vfprintf.MSVCRT ref: 6D03726F
abort.MSVCRT ref: 6D037274

Strings

Mingw-w64 runtime failure:, xrefs: 6D037248

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: abortfwritevfprintf
String ID: Mingw-w64 runtime failure:
API String ID: 3176311984-2889761391
Opcode ID: b0844b673c652b9d01a816dead33ec162ec3093ae28a1c52970c96a58c67cd52
Instruction ID: f278134a0dbe02ea98288a5555501b065a245129d2abd9d6ae0bb38349695003
Opcode Fuzzy Hash: b0844b673c652b9d01a816dead33ec162ec3093ae28a1c52970c96a58c67cd52
Instruction Fuzzy Hash: EDE0AEB080C31ADEE300AF65C08531EBAE4AF88348F43891CE2C847251C77894848B63

Function 6D0365F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFA12A5), ref: 6D036709

Strings

Unknown pseudo relocation bit size %d., xrefs: 6D036799
Unknown pseudo relocation protocol version %d., xrefs: 6D036864

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 780b2633585ce91cc049221a9564f8a4a67b7f1483a874d214b6a7030a93a323
Instruction ID: 07d7daae529d722dc15c26c51d93214a2ef3219ed4e743c4ff9b9ba38db5cd85
Opcode Fuzzy Hash: 780b2633585ce91cc049221a9564f8a4a67b7f1483a874d214b6a7030a93a323
Instruction Fuzzy Hash: 0E61EF35A042278FEB00DFA8D4C0769B7B1FF85354B92CA2DD8459B306D3B0A8118BD2

Function 6D035BC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6D035C28

Part of subcall function 6D034D00: bsearch.MSVCRT ref: 6D034D5F

fprintf.MSVCRT ref: 6D035C5C

Strings

$, xrefs: 6D035C0D

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: bsearchfprintffwrite
String ID: $
API String ID: 1110293247-3993045852
Opcode ID: d3b8fe110cd33dd1b2988d4173d61a1a022aab9060be1ce692eb729da8693c73
Instruction ID: 6739c13200b01a4936a4b36870c4d26e59515aa09f16b680695747168f630984
Opcode Fuzzy Hash: d3b8fe110cd33dd1b2988d4173d61a1a022aab9060be1ce692eb729da8693c73
Instruction Fuzzy Hash: 8501C5B981C322DFE700AF69944936EBBE4AF48358F43896DE9C897241E775C440CB53

Function 6D034E50 Relevance: 5.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 6D034E72
free.MSVCRT ref: 6D034EB2
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,6D0353DA), ref: 6D034EDB
HeapFree.KERNEL32 ref: 6D034EF0

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: Heapfree$FreeProcess
String ID:
API String ID: 3425746932-0
Opcode ID: 3390865ff85d0b5f092ea770ccbfb8640d95086a12b6b7bb5e29a78f16f3254e
Instruction ID: a3a6bb79fca4a873a92eee24565d36daffe320853111629be77ac5dd8faf0526
Opcode Fuzzy Hash: 3390865ff85d0b5f092ea770ccbfb8640d95086a12b6b7bb5e29a78f16f3254e
Instruction Fuzzy Hash: A221E5B5A08212DBEB00EF25D1C471ABBE1BF88204F16C96CE8898F309D735D844CF82

Function 6D036870 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6D03687E
TlsGetValue.KERNEL32 ref: 6D0368A5
GetLastError.KERNEL32 ref: 6D0368AC
LeaveCriticalSection.KERNEL32 ref: 6D0368CC

Memory Dump Source

Source File: 00000011.00000002.1639071137.000000006CFA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CFA0000, based on PE: true

Associated: 00000011.00000002.1638973207.000000006CFA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639377076.000000006D038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639480450.000000006D039000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639589789.000000006D03D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1639711151.000000006D03F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640092148.000000006D0E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640177623.000000006D0F3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640372094.000000006D106000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640735993.000000006D10D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640812057.000000006D10E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000011.00000002.1640903790.000000006D111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6cfa0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 58f87414ffa2aec1ac285bc12c42cb409f9ecd809bde30b01f29ecc7ac57e513
Instruction ID: e16fa7c0565141f27c6a33359c7655fe2a698f7feadc23692463e87a80932af4
Opcode Fuzzy Hash: 58f87414ffa2aec1ac285bc12c42cb409f9ecd809bde30b01f29ecc7ac57e513
Instruction Fuzzy Hash: ACF044B59042168FEB007F6DD489A1ABBB4EE49350B06066CDD4497305EF70E559CBE3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dRs2BksGEy.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 2768, Parent PID: 4084

General

Chronological Activities

Analysis Process: conhost.exePID: 5896, Parent PID: 2768

General

Chronological Activities

Analysis Process: cmd.exePID: 1608, Parent PID: 2768

General

Chronological Activities

Analysis Process: rundll32.exePID: 5424, Parent PID: 2768

Windows Analysis Report
dRs2BksGEy.dll

Function 6D275FB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40
sleepCOMMON

Function 6D276060 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66
fileCOMMON

Function 6D24CEA0 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Function 6D274F30 Relevance: 33.8, APIs: 17, Strings: 2, Instructions: 564
memoryCOMMON

Function 6D1F59F0 Relevance: 18.5, Strings: 14, Instructions: 1019
COMMON

Function 6D2093F0 Relevance: 16.9, Strings: 13, Instructions: 643
COMMON

Function 6D211570 Relevance: 16.4, Strings: 13, Instructions: 150
COMMON