Edit tour

Windows Analysis Report
nPSsgqs7aI.dll

Overview

General Information

Sample name:	nPSsgqs7aI.dll renamed because original name is a hash value
Original sample name:	827c0481e7070126aeb5670f97ee8f6a77d875f5c2ed650c42b7895630b5b9ac.dll
Analysis ID:	1544801
MD5:	bce4c69682df8274f69bcaf30dce1a0f
SHA1:	552af521520e6633024547de86373f45492794d7
SHA256:	827c0481e7070126aeb5670f97ee8f6a77d875f5c2ed650c42b7895630b5b9ac
Tags:	2024bankerdllgolangloadermekotiouser-johnk3r
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6620 cmdline: loaddll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2604 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 6512 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6152 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 6392 cmdline: rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 432 cmdline: rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1264 cmdline: rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6348 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarCreate MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7160 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarDestroy MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6644 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarFreeRec MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3228 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6624 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6092 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeResize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7100 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkePaint2 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1472 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeKillFocus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2764 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeIsDirty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1560 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeInitialize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7116 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeGetCaretRect MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5612 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseWheelEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3276 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4712 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyUpEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6536 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyPressEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6204 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyDownEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6668 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireContextMenuEvent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1532 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFinalize MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1436 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeDestroyWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6784 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeCreateWebView MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5480 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",dbkFCallWrapperAddr MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 2072 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 1868 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 528 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",TMethodImplementationIntercept MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6524 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 348 cmdline: rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarRecognize MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nPSsgqs7aI.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: nPSsgqs7aI.dll

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Source: nPSsgqs7aI.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D1C4 FindFirstFileW,FindClose,	4_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_03FED1C4 FindFirstFileW,FindClose,	32_2_03FED1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_03FECBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_03FECBF8

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4fe5a735f3c962f33a38b504d643f44a7c78b75_7522e4b5_06ff90e2-e6f0-44ef-b625-a2f7a4cbee48\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_59fcf98f4ce235a4ae89e5da4a4e624a8715c64d_7522e4b5_4c337851-2bf0-4da8-aaf0-4358efc93e59\

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004EA1D8 GetClipboardData,CopyEnhMetaFileW,GetEnhMetaFileHeader,

4_2_004EA1D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004EAA7C GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

4_2_004EAA7C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F6444	4_2_004F6444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F6704	4_2_004F6704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004E6918	4_2_004E6918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004B0F64	4_2_004B0F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004B10A8	4_2_004B10A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0043B4C4	4_2_0043B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004FFD00	4_2_004FFD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004EFE80	4_2_004EFE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F1FC4	4_2_004F1FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004F5F80	4_2_004F5F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040D6444	32_2_040D6444
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040D6704	32_2_040D6704
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_04090F64	32_2_04090F64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040C6918	32_2_040C6918
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_0401B4C4	32_2_0401B4C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040910A8	32_2_040910A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040DFD00	32_2_040DFD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040CFE80	32_2_040CFE80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040D5F80	32_2_040D5F80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_040D1FC4	32_2_040D1FC4

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 648

Source: nPSsgqs7aI.dll

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: nPSsgqs7aI.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal60.winDLL@63/13@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004E5AA0 GetLastError,FormatMessageW,

4_2_004E5AA0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004219D8 GetDiskFreeSpaceW,

4_2_004219D8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004AA910 FindResourceW,LoadResource,SizeofResource,LockResource,

4_2_004AA910

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5480
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6512
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess528

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e40c8e73-a9f6-4d95-a360-a605fb00282e

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarCreate

Source: nPSsgqs7aI.dll

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarCreate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 648
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarCreate
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarDestroy
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarFreeRec
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeResize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkePaint2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeKillFocus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeIsDirty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeInitialize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeGetCaretRect
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseWheelEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyUpEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyPressEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyDownEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireContextMenuEvent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFinalize
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeDestroyWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeCreateWebView
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",TMethodImplementationIntercept
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarRecognize
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 640
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 640
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarCreate	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarDestroy	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarFreeRec	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeResize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkePaint2	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeKillFocus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeIsDirty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeInitialize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeGetCaretRect	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseWheelEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyUpEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyPressEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyDownEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireContextMenuEvent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFinalize	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeDestroyWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeCreateWebView	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",dbkFCallWrapperAddr	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",__dbk_fcall_wrapper	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",TMethodImplementationIntercept	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarRecognize	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: nPSsgqs7aI.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: nPSsgqs7aI.dll

Static file information: File size 1270784 > 1048576

Source: nPSsgqs7aI.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10cc00

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0050985C LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_0050985C

Source: nPSsgqs7aI.dll

Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E000 push 0050E0DEh; ret	4_2_0050E0D6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E47C push 0050E519h; ret	4_2_0050E511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00460068 push ecx; mov dword ptr [esp], edx	4_2_00460069
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00504014 push 0050403Ah; ret	4_2_00504032
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004380A4 push ecx; mov dword ptr [esp], eax	4_2_004380A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_005041A4 push 005041CAh; ret	4_2_005041C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00466248 push ecx; mov dword ptr [esp], ecx	4_2_0046624C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00464264 push ecx; mov dword ptr [esp], ecx	4_2_00464268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004BE2E4 push ecx; mov dword ptr [esp], edx	4_2_004BE2E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004BA2F8 push ecx; mov dword ptr [esp], edx	4_2_004BA2FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C42F4 push ecx; mov dword ptr [esp], edx	4_2_004C42F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004682FC push ecx; mov dword ptr [esp], ecx	4_2_00468300
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C0340 push ecx; mov dword ptr [esp], edx	4_2_004C0341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00502340 push 00502398h; ret	4_2_00502390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050A3D4 push 0050A43Eh; ret	4_2_0050A436
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0043A3D0 push ecx; mov dword ptr [esp], eax	4_2_0043A3D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050239C push ecx; mov dword ptr [esp], ecx	4_2_005023A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00464450 push ecx; mov dword ptr [esp], ecx	4_2_00464454
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E540 push 0050E5F6h; ret	4_2_0050E5EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C460C push ecx; mov dword ptr [esp], edx	4_2_004C460D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E610 push 0050E671h; ret	4_2_0050E669
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0050E740 push 0050E7DCh; ret	4_2_0050E7D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046670C push ecx; mov dword ptr [esp], edx	4_2_0046670D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0046671C push ecx; mov dword ptr [esp], edx	4_2_0046671D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004827C4 push 00482826h; ret	4_2_0048281E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004648E4 push ecx; mov dword ptr [esp], eax	4_2_004648E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0042E970 push 0042EA60h; ret	4_2_0042EA58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004C2A30 push ecx; mov dword ptr [esp], edx	4_2_004C2A31
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00508B74 push 00508C02h; ret	4_2_00508BFA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00468B60 push ecx; mov dword ptr [esp], edx	4_2_00468B61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00462CE0 push ecx; mov dword ptr [esp], ecx	4_2_00462CE4

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.5 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040D1C4 FindFirstFileW,FindClose,	4_2_0040D1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0040CBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040CBF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_03FED1C4 FindFirstFileW,FindClose,	32_2_03FED1C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 32_2_03FECBF8 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	32_2_03FECBF8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040EE84 GetSystemInfo,

4_2_0040EE84

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4fe5a735f3c962f33a38b504d643f44a7c78b75_7522e4b5_06ff90e2-e6f0-44ef-b625-a2f7a4cbee48\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_59fcf98f4ce235a4ae89e5da4a4e624a8715c64d_7522e4b5_4c337851-2bf0-4da8-aaf0-4358efc93e59\

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_4-48172
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node			graph_32-48544

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004B8000 IsDebuggerPresent,RaiseException,

4_2_004B8000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0050985C LoadLibraryW,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_0050985C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00508F84 FreeLibrary,VirtualFree,GetProcessHeap,HeapFree,VirtualFree,

4_2_00508F84

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_004079E8 cpuid

4_2_004079E8

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	4_2_0040D2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_0040C79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00428FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_0042920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00425334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_00425380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	32_2_03FED2FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	32_2_03FEC79C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_04008FD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	32_2_0400920C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_04005334
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	32_2_04005380

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00423868 GetLocalTime,

4_2_00423868

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0040C520 InitializeCriticalSection,GetVersion,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,

4_2_0040C520

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nPSsgqs7aI.dll	47%	ReversingLabs	Win32.Trojan.Midie
nPSsgqs7aI.dll	100%	Avira	TR/Redcap.gjmpo

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544801
Start date and time:	2024-10-29 18:57:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nPSsgqs7aI.dll renamed because original name is a hash value
Original Sample Name:	827c0481e7070126aeb5670f97ee8f6a77d875f5c2ed650c42b7895630b5b9ac.dll
Detection:	MAL
Classification:	mal60.winDLL@63/13@0/0
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 91% Number of executed functions: 34 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 528 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: nPSsgqs7aI.dll

Simulations

Behavior and APIs

Time	Type	Description
13:58:13	API Interceptor	1x Sleep call for process: loaddll32.exe modified
13:58:28	API Interceptor	3x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4fe5a735f3c962f33a38b504d643f44a7c78b75_7522e4b5_06ff90e2-e6f0-44ef-b625-a2f7a4cbee48\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8692967886435748
Encrypted:	false
SSDEEP:	192:MreiwOz2E0BU/wjeTNzuiF7Z24IO84ci:dihz2/BU/wjeZzuiF7Y4IO84ci
MD5:	FC61A3DAC3472747B2943C85A21EAB63
SHA1:	72564B6CCD2400684939FE04101595F088BA2F87
SHA-256:	5C0BE31249529335F82FB55DDCF3ED18641A948A3D8A264FC46D8CEDD434AC1C
SHA-512:	AB94CEDD76EC6D52373E0360017A4209227069DC3C773D455B5F7B9CBEF9F8FA0F940D5677E0EAEE25CBBA1C89BAE293B8E2CDE35CB0EC289F9711A9903747C2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.8.2.8.4.1.2.5.4.3.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.8.2.8.4.5.1.6.0.5.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.f.f.9.0.e.2.-.e.6.f.0.-.4.4.e.f.-.b.6.2.5.-.a.2.f.7.a.4.c.b.e.e.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.0.8.0.0.5.2.-.e.4.0.3.-.4.2.2.d.-.a.d.5.1.-.8.8.0.3.0.0.f.0.d.7.9.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.7.0.-.0.0.0.1.-.0.0.1.4.-.9.4.8.5.-.c.2.1.9.2.c.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4fe5a735f3c962f33a38b504d643f44a7c78b75_7522e4b5_2763e2eb-1d33-43a1-bd9d-45aa672f8944\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8692172163902017
Encrypted:	false
SSDEEP:	96:8sFo6iuhVyisj94s/CqtG6tQXIDcQvc6QcEVcw3cE/O/a/z+HbHg/BQAS/YyNl4q:l7iuOi2E0BU/wjeTNzuiF7Z24IO84ci
MD5:	936642FA2DEF443D6D1922C8DDAB515C
SHA1:	5A96F1D9A812224EBB8D78904F7788683840A8BA
SHA-256:	485981C988F277F906DAC988B847E8B1CA43DD8A40D5FFC94AAFBB2196D818CB
SHA-512:	F4E43A63B5E957103916C7E7F0825D789824F48678518E26D4D998A5A48B7CF3B1BB33C8A63062C1C4FB294D3FA1BB8074D2B7E29949DB3CC35FEB75526A1BFF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.8.2.9.4.1.4.3.4.6.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.8.2.9.5.3.1.5.3.2.1.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.6.3.e.2.e.b.-.1.d.3.3.-.4.3.a.1.-.b.d.9.d.-.4.5.a.a.6.7.2.f.8.9.4.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.f.b.c.8.d.c.-.7.7.e.d.-.4.d.0.a.-.a.e.4.6.-.4.0.d.d.e.2.0.5.e.0.4.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.6.8.-.0.0.0.1.-.0.0.1.4.-.0.8.b.f.-.6.7.1.f.2.c.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_59fcf98f4ce235a4ae89e5da4a4e624a8715c64d_7522e4b5_4c337851-2bf0-4da8-aaf0-4358efc93e59\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8637262064902956
Encrypted:	false
SSDEEP:	192:NyviiOP2T0BU/wjeTNzuiF7Z24IO8dci:OiDP2ABU/wjeZzuiF7Y4IO8dci
MD5:	2EAAB6CEC761D3F5A79CC523267E65B3
SHA1:	43CCEC59C837BBAEBFA06B6DEADECF45D1591E8F
SHA-256:	68126EA9A71170CF9B94AEC196ED8E5D69E5D0D42B86A5C1AE1D163690958227
SHA-512:	E51BD95D5418D6169C5927BBA5236C47F6F426A0316E211AE816620325C0A031C8CF93B203599B6F173341EB2B45B92D30CDE57F82611AB3D6B7E71E4D9B4452
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.9.8.2.9.4.3.4.1.1.1.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.9.8.2.9.5.3.7.2.3.6.3.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.3.3.7.8.5.1.-.2.b.f.0.-.4.d.a.8.-.a.a.f.0.-.4.3.5.8.e.f.c.9.3.e.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.e.e.7.1.b.5.-.3.7.9.9.-.4.d.6.0.-.b.a.9.1.-.3.1.9.1.1.a.5.5.7.e.9.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.1.0.-.0.0.0.1.-.0.0.1.4.-.b.2.4.3.-.6.a.1.f.2.c.2.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER100F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.448744456146174
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGJg77aI9QZVWpW8VYiYm8M4JCdP+nF0+q8vjP+OGScShhd:uIjfcI7Cq7V+JpqKqOJ3hhd
MD5:	15EFF61ACAB8317AD02D3499C711B8F1
SHA1:	2189398AA7F4A945DE5F832B0851934FB42EA3AD
SHA-256:	AC4BC1A4EF21C5B82AA4B1CEDE412EF02843A4BC8BC13D4E546A243E086BB0AC
SHA-512:	2B1E30A42920C9FD394E557144AFA4C7BB3C40176DA44D6CB0EDC676FAADE863CC84B991BB8F5B8BA528DD740EA01BA0E44B0DAFFDA03D5863A698D7CCF7F649
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565020" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3642.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:58:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42348
Entropy (8bit):	1.9588600429865077
Encrypted:	false
SSDEEP:	96:5r8l4qeLr+JFQ9p6qIK/SYXf0Ib/oi75I4v4lK4zDKD9+E3lVn6E4K/RzWIkWIqD:al3GpXDAO5H4aMmIk/RfcX5VWOoN
MD5:	AF118AAA7353A97B46D42D73914E6754
SHA1:	CF4FED0D372AA4B429D982F1B64F8A67C2F372BE
SHA-256:	7EBC2DAD6814641C870E8DE39D85E58BE7D540D6662F786EF4DD73031C913CD8
SHA-512:	E3BC20B60F0E1F8122B8E812F437D4E6C6C2DE147D5DDF320CFD38F5A4477C03056B620C5E2F1D4BA378DC0B02DE7935477FEAF0846B42EB4FB924DF54752839
Malicious:	false
Preview:	MDMP..a..... .......6"!g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T.......h...5"!g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37A9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:58:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43372
Entropy (8bit):	1.9868172694637067
Encrypted:	false
SSDEEP:	192:LLlwvoXxGO5H4Jnkxiv10rOvn80py8Qji2ttR:1BR5HgnkUvWrOv80py9t
MD5:	7BB4234C36C0E47DBDFE9A61FDC0AD16
SHA1:	E233F0E25D1373E4DDB4085E6B8BB9AF13622238
SHA-256:	DA950C645941D747AD004BE44AEC1388C9D0BF561B4832A8454E762D79395D68
SHA-512:	6F756A4DB598E6459E91A15FE298ABA34A84B2751BA1D818EE4A0B61F97A19259E03D0FC196DEF067EBD61DDD600140CE125031BA1DCAEECB8894D5B0BD198BB
Malicious:	false
Preview:	MDMP..a..... .......7"!g.........................................)..........T.......8...........T......................................................................................................................eJ......,.......GenuineIntel............T...........5"!g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3902.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.6924834499143517
Encrypted:	false
SSDEEP:	192:R6l7wVeJUQ6IUnFQ6YYP62gmf8EWprF89bCgsfPWm:R6lXJT6IUnFQ6YY62gmf8EBCzf3
MD5:	5249BA6BE0BB8411A4AE36B13F09DF8C
SHA1:	5AD4916D6E18326EDE42757D9103017D0E6A27D8
SHA-256:	468A8FAE67F47E80822B7E8B26BA708EC63B933B883FC7888AADDB33788E46BB
SHA-512:	F8207B98F46717A5200B814EC9C6FD9585284B3A63EA32A6FD5CF383F06B1DE3EB8C1FAD517FAF55CD1D422467982447982E16272EBE0DE80A80E8F43256FD42
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3980.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.450680579289292
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGJg77aI9QZVWpW8VY9Ym8M4JCdP+nFlW+q8vjP+mGScSWd:uIjfcI7Cq7VdJpHWKqmJ3Wd
MD5:	F470B6A1BB6CA9CEA88A78A12CADCB16
SHA1:	2F75AC0CDED1EC18308F3F969AC737C700CD6880
SHA-256:	9A2575763539F5BA9CE9B59BE3CD818080F5711168178BD800D23304A37B862E
SHA-512:	85E702696D5D9B0261233173091F10A4D6F77F78F7CBB614534DCE6CC0430B5A7BF5C8FAF2C7AEF0C435316CBD46F87A94BC2C9EC094AED0C232CF26E3C4457C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565020" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39AE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.6955802827300306
Encrypted:	false
SSDEEP:	192:R6l7wVeJCB6IUc6YYN67gmfT4Wprt89bLvsfXZm:R6lXJ06IUc6Ya67gmfT4ZLUfE
MD5:	37224DD2AD0BFF8E6A6E6D0016036C31
SHA1:	72386DBBCFCF31C1F378D3C8F5BC63887A279D72
SHA-256:	5194CCAC8426317CD44BBC2D7818A016B9E8FD423B5B9962E6C93D8AE621D655
SHA-512:	F09DBDCC6F1F3ED73D8CD64A08CE8BCBD0CB71186EB22A8F259D91E394E6DCFCC3D5C93D541E8418F36ABA77DF8391EB58624A965BE6F3B611F4DB7E74945880
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39EE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4650
Entropy (8bit):	4.465103649580766
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGJg77aI9QZVWpW8VY4Ym8M4JCdP5Fd+q8/NHLu1GScSvd:uIjfcI7Cq7VIJSoLu1J3vd
MD5:	CB288B1D94DBECD0D7BB371F319FB843
SHA1:	F344C80163A24E1DB61E8EA448C72DA8C37E74DE
SHA-256:	7232DEB39FD688CCC129B4C66489D9FE253697CD2D6836E76963D283362AA547
SHA-512:	4457D1CE6C24FB71682F483856AF2EEADC1CDAA29C70070351044763BB21646E507A27F2E7DC8501DD82109062672940C2B5F125834EE90FB6C605A7DA5588A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="565020" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF22.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 29 17:58:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	44764
Entropy (8bit):	1.900925883118158
Encrypted:	false
SSDEEP:	192:wy5LoXUjRO5H4zdgfCSUembRU1EuhYFlApJ18:LjE5H5fYU1Yl1
MD5:	A7829765D1459BED7849269D954FEBF1
SHA1:	55B75CA75EE66AEFD3BB647BEBD9487D29D1F664
SHA-256:	CA9D89C78C330AFD3778BCFE75009D7C70E4555582A90DE3B7DD3DE2CCE0020B
SHA-512:	65AB7582C0D190804B98CF1DEF82710D1A9F912C82226B71B885016DCCDEC8FA91E8972EEB72AC759D6C0D7D664795FD4355455A9A5BF27FDC98B7ECD731597C
Malicious:	false
Preview:	MDMP..a..... .......,"!g.........................................)..........T.......8...........T.......................................................................................................................eJ......,.......GenuineIntel............T.......p...+"!g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.6902932952636704
Encrypted:	false
SSDEEP:	192:R6l7wVeJ116IUZ6Ymar6ggmf8EWprp89bz+sfKRm:R6lXJX6IUZ6Yn6ggmf8EFz9fF
MD5:	DBCA82CDC39D5960712474586667ABAD
SHA1:	44D86409CC3FC68B16338C6078213FA636799A75
SHA-256:	9B10626E0C0ED58DBE86982177D1571884EC3D816AD88B5E7721029B44A7B669
SHA-512:	B1B64B2B959DC3CCE1E8A18E8EE6A854CE2C08E48A9522F9060A38C0ABBCDEC7046B76B7F6A930D16BCE49D2D8BBD54BD4883FB8702D2ECA38509DF13D2EE7FC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.1.2.<./.P.i.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4222640020427955
Encrypted:	false
SSDEEP:	6144:USvfpi6ceLP/9skLmb0OTyWSPHaJG8nAgeMZMMhA2fX4WABlEnNP0uhiTw:fvloTyW+EZMM6DFyl03w
MD5:	710A356617CD8D6A12907E391FE0E715
SHA1:	AD9ACE015CCF2B131B580577E0D89EF7862ABD05
SHA-256:	45C1A448A72A25563ACAC78394C044E30CA5A67540CBB74EE5F65ED3CDC01675
SHA-512:	F7ED69EB6B1844F4B7E58474815CECFBF24F2DC8FFDFFCFE53DFEE7E286A3460F7CE74463434D0521D6991402779A224B4F1F7DD2829B6BA6394B621D55051A7
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....,*.............................................................................................................................................................................................................................................................................................................................................. D.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.648312679988379
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 95.46% Win32 EXE PECompact compressed (generic) (41571/9) 3.96% Win16/32 Executable Delphi generic (2074/23) 0.20% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19%
File name:	nPSsgqs7aI.dll
File size:	1'270'784 bytes
MD5:	bce4c69682df8274f69bcaf30dce1a0f
SHA1:	552af521520e6633024547de86373f45492794d7
SHA256:	827c0481e7070126aeb5670f97ee8f6a77d875f5c2ed650c42b7895630b5b9ac
SHA512:	8b246ef8211a0bf6b07eb23fd133440ea28aa9c5938ff5c53e8c2f7accbff250dbe2340e7c024cb701efe0a3b7efba5a5f10b69a4161271c1f355ec815668d19
SSDEEP:	24576:2GkMq/UR+FgcAf11t36U2cjDzNYTiVKh:ER3F2DKU9Dz2TiVK
TLSH:	F2455C62F245A43EC4AA0A364977AD50583FB7A2755AEC1E57F4088CCE395802F3E74F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x50eec8
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x66F1D369 [Mon Sep 23 20:45:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6327992c879b906e750778c69d550fed

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC0h
mov eax, 0050A49Ch
call 00007FBF28F357F5h
call 00007FBF28F2EC10h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x122000	0x2a4	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11f000	0x1c46	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13d000	0x4600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x18530	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11f5a4	0x464	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x121000	0x366	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10ca70	0x10cc00	d5563d8ec2e70394f921fe0438f73419	False	0.3667796148255814	data	6.491792421307068	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x10e000	0xee0	0x1000	edf08fe45e8d7d5f958843c4bc764c78	False	0.53369140625	data	6.063300178048254	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10f000	0x8fa0	0x9000	b8e5ff3659969d4e16d65cfbf8ad68f2	False	0.6367458767361112	data	6.628585878233501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x118000	0x6314	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x11f000	0x1c46	0x1e00	bd166391d3b2991897d3f90ec0b419cb	False	0.32083333333333336	data	4.974350011480841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x121000	0x366	0x400	9c7b1e6fd492c18332b403fa3ad29c2e	False	0.3544921875	data	3.0967012674854977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x122000	0x2a4	0x400	86fe18ac696dfb54b2708504b658011b	False	0.40625	data	3.998429714056988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rdata	0x123000	0x44	0x200	c9f8bfa36b2dc5163b75d3196d251b45	False	0.15625	data	1.1660636886017055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0x18530	0x18600	9e2ba324db339f177ac8f71567ea24b2	False	0.5806089743589744	data	6.710879323203894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x13d000	0x4600	0x4600	fbe2a758a8154369f2d0a8c52a20974b	False	0.27354910714285713	data	3.6883072451441445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x13d460	0x31c	DOS executable (COM, 0x8C-variant)			0.4258793969849246
RT_STRING	0x13d77c	0xb5c	data			0.2548143053645117
RT_STRING	0x13e2d8	0x428	data			0.37406015037593987
RT_STRING	0x13e700	0x3c4	data			0.37655601659751037
RT_STRING	0x13eac4	0x3cc	data			0.2757201646090535
RT_STRING	0x13ee90	0x394	data			0.4334061135371179
RT_STRING	0x13f224	0x4e4	data			0.35303514376996803
RT_STRING	0x13f708	0x374	data			0.3563348416289593
RT_STRING	0x13fa7c	0x454	data			0.38898916967509023
RT_STRING	0x13fed0	0x1ec	data			0.3983739837398374
RT_STRING	0x1400bc	0xc4	data			0.6428571428571429
RT_STRING	0x140180	0x170	data			0.5597826086956522
RT_STRING	0x1402f0	0x334	data			0.41585365853658535
RT_STRING	0x140624	0x408	data			0.3168604651162791
RT_STRING	0x140a2c	0x36c	data			0.4018264840182648
RT_STRING	0x140d98	0x2b8	data			0.4367816091954023
RT_RCDATA	0x141050	0x10	data			1.5
RT_RCDATA	0x141060	0x374	data			0.5950226244343891
RT_RCDATA	0x1413d4	0x2	data	English	United States	5.0
RT_VERSION	0x1413d8	0x1f4	data	English	United States	0.49

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc, FreeLibrary
user32.dll	ReleaseDC, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, LoadImageW, LoadIconW, GetSystemMetrics, GetSysColor, GetIconInfo, GetDC, GetClipboardData, FrameRect, FillRect, DrawTextExW, DrawIconEx, DrawFocusRect, DestroyIcon, CreateIcon, CopyIcon, CharUpperBuffW, CharUpperW, CharLowerBuffW
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, SetWinMetaFileBits, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, RoundRect, ResizePalette, Rectangle, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixel, GetPaletteEntries, GetObjectW, GetNearestPaletteIndex, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutW, ExtFloodFill, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, Chord, BitBlt, ArcTo, Arc, AngleArc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReadFile, RaiseException, IsDebuggerPresent, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, IsBadReadPtr, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVersionExW, GetTickCount, GetThreadPriority, GetThreadLocale, GetStdHandle, GetProcessHeap, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateFileW, CreateEventW, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	CoCreateInstance, IsEqualGUID
msvcrt.dll	memset, memcpy

Exports

Name	Ordinal	Address
BarCreate	4	0x50a490
BarDestroy	5	0x50a48c
BarFreeRec	6	0x50a488
BarRecognize	7	0x50a484
TMethodImplementationIntercept	3	0x45f330
__dbk_fcall_wrapper	2	0x41041c
dbkFCallWrapperAddr	1	0x51b630
wkeCreateWebView	13	0x50a46c
wkeDestroyWebView	8	0x50a480
wkeFinalize	9	0x50a47c
wkeFireContextMenuEvent	16	0x50a460
wkeFireKeyDownEvent	12	0x50a470
wkeFireKeyPressEvent	14	0x50a468
wkeFireKeyUpEvent	23	0x50a444
wkeFireMouseEvent	15	0x50a464
wkeFireMouseWheelEvent	17	0x50a45c
wkeGetCaretRect	20	0x50a450
wkeInitialize	22	0x50a448
wkeIsDirty	21	0x50a44c
wkeKillFocus	19	0x50a454
wkePaint2	24	0x50a440
wkeResize	11	0x50a474
wkeSetDirty	10	0x50a478
wkeSetFocus	18	0x50a458

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 18:58:23.708153963 CET	53	54565	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	13:58:03
Start date:	29/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll"
Imagebase:	0x4e0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:58:03
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:58:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:58:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarCreate
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:58:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",#1
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:58:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 648
Imagebase:	0xa70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:58:06
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarDestroy
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:58:09
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nPSsgqs7aI.dll,BarFreeRec
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarCreate
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarDestroy
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarFreeRec
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetFocus
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeSetDirty
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeResize
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkePaint2
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeKillFocus
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeIsDirty
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeInitialize
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeGetCaretRect
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseWheelEvent
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:58:12
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireMouseEvent
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyUpEvent
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyPressEvent
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireKeyDownEvent
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFireContextMenuEvent
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeFinalize
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeDestroyWebView
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",wkeCreateWebView
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",dbkFCallWrapperAddr
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",__dbk_fcall_wrapper
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",TMethodImplementationIntercept
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nPSsgqs7aI.dll",BarRecognize
Imagebase:	0x2e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:58:13
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 640
Imagebase:	0xa70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:58:14
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 640
Imagebase:	0xa70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.6%
Total number of Nodes:	332
Total number of Limit Nodes:	36

Executed Functions

Function 0040D2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040D3BC,?,?), ref: 0040D337

Part of subcall function 0040D1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
Part of subcall function 0040D1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction ID: 31cc6c2f53d714b9faa06a3b986118d36ba9187928ad3646f11bb52bdd509fcd
Opcode Fuzzy Hash: bb5aebafb1050cca1833a86485a25d2ce173cc466728c947d737821306c0bec7
Instruction Fuzzy Hash: DD113670E042099BDF00EFA5D952AAEB3B4EF45304F50447EB904B73C2D7785E098669

Function 0040D1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040D222,?,00000001), ref: 0040D1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,0040D222,?,00000001), ref: 0040D207

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction ID: f2706f95e4b90df003fff4208de2c5c05cd5cdeba3f5e8022b992bb7b9acb03d
Opcode Fuzzy Hash: fd6b56c6bec8101a1a2edd49b896a968750317b75b60eb436ea3e7407fe2b467
Instruction Fuzzy Hash: 80F08271944608BEDB20FBB5DC5299EB7FCEB48314BA005BAB404F31D2EB389E14995D

Function 0040EE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0040EE88

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: 4e8efc271a9064b51e8e7fb51594f2112b3c6a5914667696f4d1ddbf71e3eb2d
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 72A012208088000EC408A7194C4350F31805941118FC40624785CA92C2E619896546EF

Function 0040CDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D00D,?,?), ref: 0040CE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D,?,?), ref: 0040CE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040CEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040CEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040CEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040CF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040D00D), ref: 0040CF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001), ref: 0040CF6F
RegCloseKey.ADVAPI32(?,0040CFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040CFF0,?,80000001,Software\Embarcadero\Locales), ref: 0040CFEA

Strings

Software\Borland\Delphi\Locales, xrefs: 0040CEFA
Software\Borland\Locales, xrefs: 0040CEDC
Software\Embarcadero\Locales, xrefs: 0040CE60, 0040CE82
Software\CodeGear\Locales, xrefs: 0040CEA0, 0040CEBE

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction ID: 80583e44c54d8f6c8431ac525ce0e8cce3f8a82ce7c118a8e5b64ed8406c3328
Opcode Fuzzy Hash: f7c917e479dc5b8b684dcf2a59e43bffe3130ab6fea02e13758483d346620e00
Instruction Fuzzy Hash: DC512675A40609BEEB20DBA5CC82FAFB7BCDB08704F504077BA04F61C1D6789D059A5D

Function 0040CAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000,00000000), ref: 0040CAD2
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CAF6
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF,?,?,00000000,00000000), ref: 0040CB05
IsValidLocale.KERNEL32(00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB17
EnterCriticalSection.KERNEL32(0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB74
LeaveCriticalSection.KERNEL32(0051AC10,0051AC10,00000000,00000002,0051AC10,0051AC10,00000000,0040CBB8,?,?,?,00000000,?,0040D480,00000000,0040D4DF), ref: 0040CB9D

Strings

en-GB,en,en-US,, xrefs: 0040CAE2, 0040CB89

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction ID: dbd07ac227d82710da470fa0a9828874cbe6fbb8e5c29b4c0eb771d3e90eaa4c
Opcode Fuzzy Hash: 16983b795ea3f6d15511b6f3b7a2fd081026003eab2b4e0bc2c7165cd39925dc
Instruction Fuzzy Hash: 59214220740744D7EA12B77AA85376E36A4EB45718F50853BB000B72C2D9BD9D418ADF

Function 004EEE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 004EEE3A

Part of subcall function 004EEDD0: GetDC.USER32(00000000), ref: 004EEDD9
Part of subcall function 004EEDD0: SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
Part of subcall function 004EEDD0: GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
Part of subcall function 004EEDD0: ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Strings

MS Shell Dlg 2, xrefs: 004EEEA4
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 004EEE90
Tahoma, xrefs: 004EEE5C

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 3e989dd22528e993a8f094909ded440fcce72ae8fe55bb623e6ec587366682e7
Instruction ID: 1ff446588a6e6a0fa4dd5297cfc109956efff4a3f0478c3220450b82ea8a73ab
Opcode Fuzzy Hash: 3e989dd22528e993a8f094909ded440fcce72ae8fe55bb623e6ec587366682e7
Instruction Fuzzy Hash: 1D11D030600149AFC711EF6BCC12A9E7BB5EB45705F90847BF400A7791DB39AD01CB18

Function 0040961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00409653

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction ID: 57d564f7514a768ac0d6b140dc1e0ae383663f7c9c7dd69698fd604fdf563357
Opcode Fuzzy Hash: 5a2d98b2b9303db085ca7903a3e8743554e309b17d8937ec0eab1567879db523
Instruction Fuzzy Hash: FF516B706002449BDB25EF6AC88479B7BE1AF59314F14843FE809AA3D3D779DC88CB59

Function 0050E000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E02D

Part of subcall function 0040C520: InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
Part of subcall function 0040C520: GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
Part of subcall function 0040C520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
Part of subcall function 0040C520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Part of subcall function 0040EE84: GetSystemInfo.KERNEL32 ref: 0040EE88

GetCommandLineW.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E092

Part of subcall function 00405244: GetStartupInfoW.KERNEL32 ref: 00405255

GetACP.KERNEL32(00000400,00000000,0050E0D7), ref: 0050E0A6
GetCurrentThreadId.KERNEL32 ref: 0050E0BA

Part of subcall function 0040EE98: GetVersion.KERNEL32(0050E0C9,00000400,00000000,0050E0D7), ref: 0040EE98

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction ID: b63630b870325ab19e945f9b7a74bc4420f07e9680e2ed97b13d29786ef075bf
Opcode Fuzzy Hash: da96efc90d0f3f823da1e0c30568e20cb602c22b5ccd4f7319bb0d9d278b2238
Instruction Fuzzy Hash: 3411217040478889D720FF72AC1A2693AA4FB19308710C87ED1006A2E2DFBD540CEF6E

Function 004D915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D91D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,004D931F), ref: 004D924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004D92BC

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction ID: ad3af0877aad2f918cc60e01b05eab59aa261d8504b712c7e441bbb361f6d9d3
Opcode Fuzzy Hash: 297e97f5790f3bfbe46446021c8049ae68c7a4fb6bdd877cd8b5aad7bbb95b8b
Instruction Fuzzy Hash: 87515431B00208BFDB11EBA5C852B9EB7FAAB48304F15446FB444E3382DA7D9F069759

Function 00427884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00427984), ref: 004278C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 00427902
VerQueryValueW.VERSION(?,00427998,?,?,00000000,?,00000000,?,00000000,00427967,?,00000000,?,00000000,00427984), ref: 0042791C

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction ID: c637f2b1f86e41ba3c57f6c02bd3706f471a10e856d15e50b91235f572eefc7d
Opcode Fuzzy Hash: d254ea856f19eca79d65d9f3d227b80f169b0e93736270e157245cabf41f0a7c
Instruction Fuzzy Hash: BC3141B5A04319AFEB00DFA9D881DAEB7F8EB48704B9144BAF544E3241D778DE40CB65

Function 004D9EDC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,004D9BB9), ref: 004D9F07

Strings

8DA, xrefs: 004D9F26

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: 8DA
API String ID: 3660427363-1089967677
Opcode ID: 62b5dd27d72dd0d9c1c038acb69b9933a80f44869dcc94b569568e39bbe6ba57
Instruction ID: 39c98cee85b92a318de15d9b41cd990746fee319e790c38c5fa8baae42c46660
Opcode Fuzzy Hash: 62b5dd27d72dd0d9c1c038acb69b9933a80f44869dcc94b569568e39bbe6ba57
Instruction Fuzzy Hash: A3015271600208AFDB00EFA9DC81ADEB7A89B59314F0081ABF914DB342DA759E0587A5

Function 0040D3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D473
GetSystemDefaultUILanguage.KERNEL32(00000000,0040D4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040D566,00000000,?,00000105), ref: 0040D49B

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction ID: 914cf1b0947d833fcc03ff50d5076885400eec8b7426a2207ce03941fa5f7576
Opcode Fuzzy Hash: e5fbb9e0fc620f56b36578c07845851fe2fed8148833940ec20a2950b4b279a8
Instruction Fuzzy Hash: DB31EB30E142099BDB10EFA9C891BAEB7B5EF44304F50457BE400B72D2D778AD498A59

Function 0040D4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction ID: 258510d9c4dee0299c5f3f79c4fbca46c564eaaadbdb9c5c4e3057b0bb4fa4ad
Opcode Fuzzy Hash: 783f705d58062fb5f8e85dc88ba71afedba3f43c8334a4a5c8ebaaa4e4aa5bf8
Instruction Fuzzy Hash: 3F114F70E4461CABDB10EB94CC86BDE73B8DB04304F5144BAB508B72D1EA785F858A99

Function 00405600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,00405C17), ref: 00405617

Strings

@., xrefs: 00405652, 00405670

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction ID: 7dac567e4a07de2f06f580edb35680116b9bdba5c2a0860377bbd693bdd19f0d
Opcode Fuzzy Hash: e9bd031fac14de1d523f3f0fd1d0bc821c44dc6a8c79c950d7b754ab0e602f81
Instruction Fuzzy Hash: 49F0AFF2B003004FD7248F789D407A67AD4FB08324F10827FE908EB798DBB488048B84

Function 004D8EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EB1
RegCloseKey.ADVAPI32(00000000,?,004D8F0C,?,?,00000000,004D9123,00000000,00000000,00000000,?,?,00000000,004D9139), ref: 004D8EBA

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: 6f4c2654893a1a96a1da4be1dd0c350b83e18a7e628d6434c516513760379d46
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: 40D067B1E042049ADF60EF7AC9C5A577BDC6F44315B08C4ABB808DF247DA3CD9409B28

Function 004D98DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,004D9AE0,00000000,004D9C1C), ref: 004D990D

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction ID: bf80709a24f295cc4fff76cdf4c79f612c8773d4563c6b2b62db8eae0a0485ee
Opcode Fuzzy Hash: ad67be82557188437bc6127552a9993e0998d0cde0f580ab283647e522f4a4dc
Instruction Fuzzy Hash: 3CF01C623052046FD344FA6E9C81F6B66DC9B88754F10843FB248C7342D964DC058375

Function 0040C278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00400000,?,0000020A), ref: 0040C296

Part of subcall function 0040D4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D528
Part of subcall function 0040D4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040D5A6,?,00400000,0050FC1C), ref: 0040D579

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: dd2aa8039920255b97d322d6193c29fca073ce87a4a4145dda77fc50cf625817
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 07E0ED71E003109BCB10DF98C9C5A4737D8AB08754F0446A6AD14DF387D775DD148BD5

Non-executed Functions

Function 004EAA7C Relevance: 48.5, APIs: 32, Instructions: 501windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EAAFC
GetDC.USER32(00000000), ref: 004EAB0D
CreateCompatibleDC.GDI32(00000000), ref: 004EAB1E
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EAB6A
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004EAB8E
SelectObject.GDI32(?,?), ref: 004EADE6
SelectPalette.GDI32(?,00000000,00000000), ref: 004EAE26
RealizePalette.GDI32(?), ref: 004EAE32
SetTextColor.GDI32(?,00000000), ref: 004EAE9B
SetBkColor.GDI32(?,00000000), ref: 004EAEB6
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,004EB046,?,00000000,004EB068,?,00000000,004EB079), ref: 004EAEFF
FillRect.USER32(?,00000000,00000000), ref: 004EAE83

Part of subcall function 004E32AC: GetSysColor.USER32(?), ref: 004E32B6

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 004EAF21
CreateCompatibleDC.GDI32(00000000), ref: 004EAF34
SelectObject.GDI32(004EB33B,00000000), ref: 004EAF57
SelectPalette.GDI32(004EB33B,00000000,00000000), ref: 004EAF73
RealizePalette.GDI32(004EB33B), ref: 004EAF7E
SetTextColor.GDI32(004EB33B,00000000), ref: 004EAF9C
SetBkColor.GDI32(004EB33B,00000000), ref: 004EAFB7
BitBlt.GDI32(?,00000000,00000000,?,?,004EB33B,00000000,00000000,00CC0020), ref: 004EAFDF
SelectPalette.GDI32(004EB33B,00000000,000000FF), ref: 004EAFF1
SelectObject.GDI32(004EB33B,00000000), ref: 004EAFFB
DeleteDC.GDI32(004EB33B), ref: 004EB016

Part of subcall function 004E45BC: EnterCriticalSection.KERNEL32(-00000008), ref: 004E45E4
Part of subcall function 004E45BC: CreateBrushIndirect.GDI32(?), ref: 004E4671
Part of subcall function 004E45BC: LeaveCriticalSection.KERNEL32(?,004E46A5,-00000008), ref: 004E4698

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapCriticalRealizeSectionText$BrushDeleteEnterFillIndirectLeaveRectTable
String ID:
API String ID: 3271313764-0
Opcode ID: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction ID: 35a244f6f23a8f79e02010a3497fee76c02ec5d27261e314751b2550eb949676
Opcode Fuzzy Hash: fe2f7d032ca60ba23a25b8aee0731278cea1c8a05eae85922534dd69cbd64bb5
Instruction Fuzzy Hash: 47121975A00248AFDB10DFAAC885F9EB7B9EF08315F118456F914EB291C778EE80CB55

Function 0040C520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C525
GetVersion.KERNEL32(0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,0051AC10,0050E037,00000400,00000000,0050E0D7), ref: 0040C58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040C594

Strings

SetThreadPreferredUILanguages, xrefs: 0040C56A
kernel32.dll, xrefs: 0040C555, 0040C56F, 0040C589
GetThreadPreferredUILanguages, xrefs: 0040C550
GetThreadUILanguage, xrefs: 0040C584

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction ID: 8edfc10a46b7400df28ad4f2c85025a5e0675a444164cbed82ad90a550fe5e83
Opcode Fuzzy Hash: 3eb0d1b683875d0a4e7ed686173063676bd5968c29d9e357da0c930b2f0c2479
Instruction Fuzzy Hash: 15F05EB8951B10BADA023772AD8375F3680DA1070CB20853BB100790D2DEBC19549E9E

Function 004FFD00 Relevance: 20.0, APIs: 10, Strings: 1, Instructions: 742windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004FFE79
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 004FFEC0
DeleteObject.GDI32(00000000), ref: 004FFEDE
DeleteDC.GDI32(00000000), ref: 004FFEE7
SelectObject.GDI32(00000000,00000000), ref: 004FFF18
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FFF47
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 00500607
SelectObject.GDI32(00000000,?), ref: 00500614
DeleteObject.GDI32(00000000), ref: 0050061D
DeleteDC.GDI32(00000000), ref: 00500626

Strings

4iQ, xrefs: 004FFE65

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DeleteObject$CreateSelect$CompatibleSection
String ID: 4iQ
API String ID: 1283611041-1953506770
Opcode ID: 1b5bd847662937d3a3ccdb4810d50a7cbb119010eb40f76180beefef71812fea
Instruction ID: be9d6b00bfd07e6650375709e39552807e6f3c9f16d22f912302f9deee62be0b
Opcode Fuzzy Hash: 1b5bd847662937d3a3ccdb4810d50a7cbb119010eb40f76180beefef71812fea
Instruction Fuzzy Hash: 81528D71E042598FCB15CFA9C881BEDBBF2FF45300F1481AAE458EB2D2C638A945DB14

Function 0040CBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041A5A8,?,?), ref: 0040CC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040CC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD26
FindClose.KERNEL32(?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041A5A8,?,?), ref: 0040CD89

Strings

kernel32.dll, xrefs: 0040CC10
\, xrefs: 0040CD56
GetLongPathNameW, xrefs: 0040CC20

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction ID: 182d901b7ba620ca83dfe24b28ff924219823170be1df94bbfac5eeb8ceb1ef4
Opcode Fuzzy Hash: 047ad798f282a4f53d2bfa85006bf39dd452bc892cd983c7192c00f70524a19f
Instruction Fuzzy Hash: 73417F71A00618DBDB20EBA4CCC5ADEB3B5AF84314F1846BA9504F72C1E77CAE45CB49

Function 0050985C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00509AC1,?,00000000,?,00000000), ref: 005098DE
IsBadReadPtr.KERNEL32(?,00000014), ref: 00509A92

Strings

BuildImportTable: GetProcAddress failed, xrefs: 00509A65
BuildImportTable: can't load library: , xrefs: 00509925
BuildImportTable: ReallocMemory failed, xrefs: 00509970

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: 89089be05972bbc63be8d4fa309831fb6fe85f2192c3cd50ce398ffdd9c04fc7
Instruction ID: 544e6b471694efd6b91277a09a6994113d20e5353a683e067cc16b90e8d00dc6
Opcode Fuzzy Hash: 89089be05972bbc63be8d4fa309831fb6fe85f2192c3cd50ce398ffdd9c04fc7
Instruction Fuzzy Hash: 02715C70A00205AFDB10DB69C886BEEBBF9FB89310F4084A9F155EB296D774AD458B50

Function 00508F84 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,00509E89,?,?,?,?,?,00000000,00000000), ref: 00508FF4
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,00509E89,?,?,?,?,?,00000000,00000000), ref: 00509023
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,00509E89,?,?,?,?,?,00000000,00000000), ref: 0050902E
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,00509E89,?,?,?,?,?,00000000,00000000), ref: 00509034
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,00509E89,?,?,?,?,?,00000000,00000000), ref: 00509074

Strings

lQ, xrefs: 00509039, 00509053, 00509066

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID: lQ
API String ID: 565514093-2549691525
Opcode ID: b08f94bd98a233a4d17dc2dbb37ca5a8a203f0f3e16311f8885d4769abc3b336
Instruction ID: 4518375d8375331e60380aff280aa0e88f73e35d35f8eaaae96a14fe11ff4c2e
Opcode Fuzzy Hash: b08f94bd98a233a4d17dc2dbb37ca5a8a203f0f3e16311f8885d4769abc3b336
Instruction Fuzzy Hash: 9D319074604605AFD320EF69CC88F6ABBA8FF88714F108659F554CB292CB70EC4587E0

Function 004AA910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000,?), ref: 004AA95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,004AA7FE,00000000), ref: 004AA965

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: cb9b2a388fffd021e353bf4cf2117ea65373932cb549638ab777629fd56d0805
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 96F062B26042047F5744EE5EA841D5B7BECDE5A264310011FF908D7207DA38ED51837D

Function 0040C79C Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C846
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C862
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040C901,?,0041A5A8,?,00000000), ref: 0040C873

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction ID: 2a28b5b25d505860436f04a2e6c8396a795a98c7f85c76968f02c108a8d9c51a
Opcode Fuzzy Hash: d62bc5ecf4585d0b78f38a216359797881bb5583d195145a11d1f228b605bdfe
Instruction Fuzzy Hash: BB319C71A0061CEBDB20EB55DC81BDE77B9EB44705F6042BAA508B32D0D6395E80DE59

Function 004EA1D8 Relevance: 4.6, APIs: 3, Instructions: 51fileclipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32(0000000E), ref: 004EA1E5
CopyEnhMetaFileW.GDI32(00000000,00000000), ref: 004EA207
GetEnhMetaFileHeader.GDI32(?,0000006C,?,00000000,00000000), ref: 004EA219

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID:
API String ID: 1752724394-0
Opcode ID: 8b16d8c7a66d7a50bd3bc120d85c0e81c41265ab6c9e86269915d1be8eae12fd
Instruction ID: aea61b579b12049da75c96bfe0ce68d4ce55fb0606cfa38e7b8f88c73018f3b7
Opcode Fuzzy Hash: 8b16d8c7a66d7a50bd3bc120d85c0e81c41265ab6c9e86269915d1be8eae12fd
Instruction Fuzzy Hash: 14115E726003449FC710DFAEC885A9AB7F8EF49315F10466EE509DB352DA74EC48CB95

Function 004EFE80 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 783COMMON

Download Yara Rule

Strings

jjj, xrefs: 004F0654

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: jjj
API String ID: 0-2289343631
Opcode ID: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction ID: 0e6e8520d3be3831dee58035f3478674022d586b9291955b557444e96a04ac11
Opcode Fuzzy Hash: 379f3ad564931047c85a0e8324c1b925258155478eac1b2c346929ac29ebc0ac
Instruction Fuzzy Hash: CB723970600204CFDB29CF19D9C0B677BA2FB95315F14869AD9464F38BC738E856CB6A

Function 004F1FC4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 699COMMON

Download Yara Rule

Strings

9Q, xrefs: 004F22AF

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: 9Q
API String ID: 0-4141447236
Opcode ID: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction ID: 872c69647381f06e73c0189917d9e5469cc943f97499b4375cee1c22dc96545a
Opcode Fuzzy Hash: c85e39b14b60b4e960e998f2343e0d1547b2847ac62002dfaddbb849c39a277c
Instruction Fuzzy Hash: 40626D70900209DFDB19CF58C984BBEBBB1BF88304F15819ADD559B386C778D985CB89

Function 004B8000 Relevance: 3.1, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(00000000,004B80BB), ref: 004B8032
RaiseException.KERNEL32(406D1388,00000000,00000004,00001000,00000000,004B808D,?,00000000,004B80BB), ref: 004B807E

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise
String ID:
API String ID: 1899633966-0
Opcode ID: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction ID: aa851b4e1d0f37632037c728c599de388d05abd6bc809da2430ac8adde4c7f7f
Opcode Fuzzy Hash: 918f654b1989dfd3ee398986ac0d4d5983e76a9e6b43d16da8286ca8f312fc4d
Instruction Fuzzy Hash: 7A11D671A14208AFD710EF65DC52ADEBBFCEB48704F61447BE500E3651EB785E04CA68

Function 004E5AA0 Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000,004EB33B,?,00000000,00000054,?,00000000,?), ref: 004E5AC0
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,004E5B3C,?,00000000,?,004E5B54,00000000,004EB19B,00000000), ref: 004E5AE6

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction ID: c91c4b4c8320e0c1e530085dddd9d5d25a400c360d6da16a75b1d286b8cd0c3b
Opcode Fuzzy Hash: 3d658324b1b03f1d33dfdd215c91ea1b99e4dd16f5471f85141302732c58e772
Instruction Fuzzy Hash: 7401AC707147455FE721FB628D92F9977A8DB04709F5044BAF704E62C3EAB86D40891D

Function 004219D8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 004219F9

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction ID: 0ac6486f21f903cb75f282dfc890b26380fbcd4d5ccfbab9b17402b0b1878633
Opcode Fuzzy Hash: 7055af4c37e798c4eedd1ab66a3f56a97fac90cff517f4e9d1e1818016eb5d1c
Instruction Fuzzy Hash: 6011CCB5A00209AFDB04CF99C8819AFB7F9EFC8704B14C56AA509E7354E6319A41CBA4

Function 00425334 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction ID: 4ace5e9765896cc83d0c08b398fcb6cdb51b1f9deae2cd3a8e1490c56280457a
Opcode Fuzzy Hash: ea3b3c1b5a1cf1a130d0f040b5935ae3e0cd2e837d4e3e09926aa746a21f6665
Instruction Fuzzy Hash: DEE0D87171071817D714A9599C86DFBB25CAB88340F4045BFBE05D7383EDB49E4446ED

Function 0042920C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00428FB4,00000002,?,?,0042958D,004257FD,?,00000000,0042583E,?,?,?,00000000,00000000), ref: 00429239

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction ID: 63fa091e9d080db82cecbc2cc5fa61dc70d90b6f989caf0edc4abe69f196ef62
Opcode Fuzzy Hash: cca9abc3a11610917688cb0633c448d3797570d25fd4a641b53c3c50ab693acf
Instruction Fuzzy Hash: A0E02662B415319BC120B7BA1E43B9A7A024F81BA4F08857BF498DF3C3EA6D0C0541FE

Function 00425380 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction ID: 9eed19484239e9ca95c0a1dfbed1db1bf7cda38a4e2fdab08b9ea4c2367ee6e5
Opcode Fuzzy Hash: e6b6a51cb939c12e8be8693ad0cf5385fb4deb90edb709e785ba876ef48dd5f6
Instruction Fuzzy Hash: 0BD05EA631922036E210915B7E45DBB5ADCDBC47B2F14483FBE48CA201D2A4CC059275

Function 00428FD0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,00429086,?,00000000,004291D3), ref: 00428FEB

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction ID: a303c1cb07ff97bfd8ef16a179b2a7490fc3f5062c6a27ca45c0f37d97ec2e54
Opcode Fuzzy Hash: e4b498ff0c44464bb9c319f2c4cdb7eba90f2cd8f1e1edfbafd7f3df4e5c9a38
Instruction Fuzzy Hash: F6D0A7E1B2420023E30426548C42B6722889B84704F10443C7784973C0EE7C591552BF

Function 00423868 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0042386C

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction ID: 8da0d5d7dce6a760fb6fb5968247694cf968f8d8edeffb1c78389c91dfcd4fca
Opcode Fuzzy Hash: 4c927502ff6ca848d6d79f783507b1be3d95d0ac7cdb7b449a5a22e2f4b00210
Instruction Fuzzy Hash: 25A0125044582011814037190C0317570405840621FC40789B8F8403D1E91E026040D7

Function 004F6704 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F670A

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction ID: b43b3417401406a326c0658d495f7bfac22fcab4f87dfe3d4983a9788a7a34dd
Opcode Fuzzy Hash: e390bb8781cfb50e0bf67600d25b5dc8b096431c9f5b13ce083519ddae5a6ed1
Instruction Fuzzy Hash: 84814D77D105774BE7628E28C8043A17392AFDC39DF6B42B4ED04ABA42D536BD5386C0

Function 004F6444 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

xGQ, xrefs: 004F644A

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: xGQ
API String ID: 0-116873306
Opcode ID: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction ID: 9cfbf6d39703a2f841c89ad7d8bc5bd644356b16f8883d5035a763e39ed3e34d
Opcode Fuzzy Hash: 6bc0205b4ab2c64538ca0b113fa78fac9b85d5e4605181a21ca93e4cce34d19d
Instruction Fuzzy Hash: DB711877D204775BEB609E68C8043617392EF8925CF6B46B4DE04BBA42C636BD539AC0

Function 0043B4C4 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction ID: 0e1373ad738d05412743fbfe0b30fd2dda4791c2bd02ca1af8785a3d2d390580
Opcode Fuzzy Hash: 96dbd05c6a5cda271e1d6996937e8b3347f306cca49e2da1ac7c058721fcefef
Instruction Fuzzy Hash: 8702BE32910235DFDB96CF6AC040109B7B6FF8A72472A82D6D854AB229D370BE51DFD1

Function 004F5F80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction ID: 3b8a4b9bdbcbb050131b8f531c600d22b301e14a5b3c7c96b4b24d21a3266e97
Opcode Fuzzy Hash: 3c8e7f5fa08233c9cf6af3f4da3c8a8b0854dd8decd54ec8197df6d450736b3b
Instruction Fuzzy Hash: 2871A53238978207E7288E7D9CE02B7EAD35FC531872EC97D95DAC3F42D979A4164248

Function 004B0F64 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: b7ad73d6065eefe40be1e3c61ddaa82719b5b59149f48ac65b38381fd691009e
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: F8418E31B002558BDB58EE2DC8D16A6B7A2AF94254B18C675DCA88F70BC938DD42C7A0

Function 004B10A8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction ID: 9a75494c871b48b3840d49ff1b59f6b632724ee8b9803b4084a2a4f9b95828cd
Opcode Fuzzy Hash: d7b4a472199e05cc7d5662b025e4d780bd874dc3e3dcfc1069f2e998be189936
Instruction Fuzzy Hash: 40419336A002559BDB48DE5DC8D1696B7A3BFC8314B19C675DCA88F70BC938DE02C7A0

Function 004E6918 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction ID: 2dc40e0aa77415d55bc0616e35fc77692ce9a422371aba29c42deb2143eb0115
Opcode Fuzzy Hash: 2bc20041c257ff7d61a283088bfa9f2de2708563aa29e0e00101f28d62c41ba6
Instruction Fuzzy Hash: EEE0016420010A8ED348BF38C1098A2B3E3EFECA1038BC4D0D44A9F23EF622C481C300

Function 004079E8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Function 004FABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 004FABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 004FABE7
SelectObject.GDI32(00000000,00000000), ref: 004FABEE
CreateCompatibleDC.GDI32(?), ref: 004FAC22
CreateCompatibleDC.GDI32(?), ref: 004FAC2E
CreateCompatibleDC.GDI32(?), ref: 004FAC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004FAC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004FAC6B
SelectObject.GDI32(?,?), ref: 004FAC7B
SelectObject.GDI32(?,?), ref: 004FAC8B
SelectObject.GDI32(?,?), ref: 004FAC9B
SetBkColor.GDI32(00000000,?), ref: 004FACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 004FACCC
SetBkColor.GDI32(00000000,?), ref: 004FACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 004FACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004FAD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 004FAD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 004FAD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 004FAD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 004FAD90
SelectObject.GDI32(?,?), ref: 004FAD9D
DeleteObject.GDI32(00000000), ref: 004FADA3
SelectObject.GDI32(?,?), ref: 004FADB0
DeleteObject.GDI32(00000000), ref: 004FADB6
SelectObject.GDI32(?,?), ref: 004FADC3
DeleteObject.GDI32(00000000), ref: 004FADC9
SelectObject.GDI32(00000000,?), ref: 004FADD3
DeleteObject.GDI32(00000000), ref: 004FADD9
DeleteDC.GDI32(?), ref: 004FADE2
DeleteDC.GDI32(?), ref: 004FADEB
DeleteDC.GDI32(?), ref: 004FADF4
DeleteDC.GDI32(00000000), ref: 004FADFA

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: 825b2a03bc1370e51723bfade82acbff92c39003225e20d7aaefe19e3380dd92
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 82815BB2E40218BADB10DEE9CD85FDFBBBCAB09715F104459F604FB241D675AE408BA4

Function 0042EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0042EFA5

Part of subcall function 0042EF70: GetProcAddress.KERNEL32(00000000), ref: 0042EF89

Strings

VarAdd, xrefs: 0042EFF5
VarR4FromStr, xrefs: 0042F0E7
VarMul, xrefs: 0042F021
VarBoolFromStr, xrefs: 0042F13F
VarR8FromStr, xrefs: 0042F0FD
VarBstrFromDate, xrefs: 0042F16B
VarBstrFromBool, xrefs: 0042F181
oleaut32.dll, xrefs: 0042EFA0
VarSub, xrefs: 0042F00B
VarAnd, xrefs: 0042F079
VarXor, xrefs: 0042F0A5
VariantChangeTypeEx, xrefs: 0042EFB3
VarOr, xrefs: 0042F08F
VarCmp, xrefs: 0042F0BB
VarMod, xrefs: 0042F063
VarNot, xrefs: 0042EFDF
VarDateFromStr, xrefs: 0042F113
VarBstrFromCy, xrefs: 0042F155
VarNeg, xrefs: 0042EFC9
VarIdiv, xrefs: 0042F04D
VarI4FromStr, xrefs: 0042F0D1
VarDiv, xrefs: 0042F037
VarCyFromStr, xrefs: 0042F129

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction ID: 4d8a8b603ccf47e63391c59ab7cad31be334c78caf3acb6b5dd0fd78b8a56fbb
Opcode Fuzzy Hash: 51ba0cccc0257aa61a896f7588f8220aaff411b585e609356873e0dfdd144972
Instruction Fuzzy Hash: 15412761708239AA53046B6FBE0146677F8EA567103E1C4BBB404CBA69DB3CBC89573D

Function 004E5CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 004E5D2F
SelectObject.GDI32(?,?), ref: 004E5D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,004E5DB4,?,?), ref: 004E5D88
SelectObject.GDI32(?,?), ref: 004E5DA2
DeleteObject.GDI32(?), ref: 004E5DAE
CreateCompatibleDC.GDI32(00000000), ref: 004E5DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004E5DE3
SelectObject.GDI32(?,?), ref: 004E5DF8
SelectPalette.GDI32(?,10080D96,00000000), ref: 004E5E0C
SelectPalette.GDI32(?,?,00000000), ref: 004E5E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 004E5E33
SelectPalette.GDI32(?,10080D96,000000FF), ref: 004E5E49
RealizePalette.GDI32(?), ref: 004E5E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004E5E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 004E5E99
SetTextColor.GDI32(?,00000000), ref: 004E5EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 004E5EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 004E5EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 004E5F00
SetTextColor.GDI32(?,?), ref: 004E5F0A
SetBkColor.GDI32(?,?), ref: 004E5F14
SelectObject.GDI32(?,00000000), ref: 004E5F27
DeleteObject.GDI32(?), ref: 004E5F30
SelectPalette.GDI32(?,00000000,00000000), ref: 004E5F52
DeleteDC.GDI32(?), ref: 004E5F5B

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: 118953fea359356e25d164f27b8e78a2380bae261493a7d6a12787465145b049
Instruction ID: d88ae2ed45a29931f472a69d662a1bc6b4062899916de74d0cc4df68cf7f53a5
Opcode Fuzzy Hash: 118953fea359356e25d164f27b8e78a2380bae261493a7d6a12787465145b049
Instruction Fuzzy Hash: B98192B2A00209AFDB50DEA9CC85EEF7BEDAB0D715F100559F618E7240C238AE408B65

Function 004EB140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 004EB163
GetDC.USER32(00000000), ref: 004EB191
CreateCompatibleDC.GDI32(?), ref: 004EB1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004EB1BD
SelectObject.GDI32(?,00000000), ref: 004EB1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 004EB1F9
CreateCompatibleDC.GDI32(?), ref: 004EB207
SelectObject.GDI32(00000000,00000000), ref: 004EB24F
SelectPalette.GDI32(00000000,?,00000000), ref: 004EB262
RealizePalette.GDI32(00000000), ref: 004EB26B
SelectPalette.GDI32(?,?,00000000), ref: 004EB277
RealizePalette.GDI32(?), ref: 004EB280
SetBkColor.GDI32(00000000,00000000), ref: 004EB28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 004EB2AE
SetBkColor.GDI32(00000000,00000000), ref: 004EB2B8
SelectObject.GDI32(00000000,00000000), ref: 004EB2CB
DeleteObject.GDI32(00000000), ref: 004EB2D7
DeleteDC.GDI32(00000000), ref: 004EB2ED
SelectObject.GDI32(?,00000000), ref: 004EB308
DeleteDC.GDI32(00000000), ref: 004EB324
ReleaseDC.USER32(00000000,00000000), ref: 004EB335

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction ID: a297371bd76699a261ad6334b1a26cfdb4486747052644e0b66a5fa1a439e62f
Opcode Fuzzy Hash: 12377b0042ab6e2186f72ca2209710d3867943cee396a54fa97a17432a339029
Instruction Fuzzy Hash: 1E51FF72E00355BBDB10DAEACC56FEFB7BCEF09705F10445AB614E7281D6789A408B94

Function 004EC71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC9A4
CreateCompatibleDC.GDI32(00000001), ref: 004ECA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 004ECA1E
SelectObject.GDI32(?,00000000), ref: 004ECA28
SelectPalette.GDI32(?,?,00000000), ref: 004ECA58
RealizePalette.GDI32(?), ref: 004ECA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 004ECA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,004ECAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 004ECA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 004ECAC8
SelectObject.GDI32(?,?), ref: 004ECAD5
DeleteObject.GDI32(00000000), ref: 004ECADB

Strings

BM, xrefs: 004EC83D
(, xrefs: 004EC8D2

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 24ffa62903cace97ccb9cd167c5186e28ab8cab10cdbcb0507e3edb45a177ad6
Instruction ID: 8ce06293ba12aceaa71df6670ee523447cf40af7f930d923d2d6c38dff7d997c
Opcode Fuzzy Hash: 24ffa62903cace97ccb9cd167c5186e28ab8cab10cdbcb0507e3edb45a177ad6
Instruction Fuzzy Hash: 61E16E70A002589FDF04DFAAC885BAEBBF5FF49305F10856AF904A7391D7389941CB58

Function 004EB698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB6DB
RealizePalette.GDI32(?), ref: 004EB6EA
GetStretchBltMode.GDI32(00000000), ref: 004EB6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB70D
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB74F
SetStretchBltMode.GDI32(?,00000004), ref: 004EB75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 004EB775
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EB792
CreateCompatibleDC.GDI32(00000000), ref: 004EB7F3
SelectObject.GDI32(?,?), ref: 004EB808
SelectObject.GDI32(?,00000000), ref: 004EB867
DeleteDC.GDI32(00000000), ref: 004EB876

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction ID: 489584e9c4cd725b990482e09af51c0bca80148c9d3d35cd6fb0d49a7a8e8351
Opcode Fuzzy Hash: 230a5d8b8307ea4118e7af7672871789c69a95fa8ce89b2824e3c90030dde8aa
Instruction Fuzzy Hash: 76A1D8B1600245AFDB40EFAAC985F9AB7E8EF08305F504559F605E7652D738ED40CBA4

Function 00509364 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

BTMemoryLoadLibary: dll dos header is not valid, xrefs: 005093AC
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 005093F1
PE, xrefs: 005093E0
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 0050957D
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 00509448
BTMemoryLoadLibary: Can't attach library, xrefs: 005095A8
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 00509530
MZ, xrefs: 0050939F

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: 4e08f846a6d00f54f017fa59201d6ed23f295b0ceed85bb3955be9a15fe67e3f
Instruction ID: fce96e51b3eb03009c858daf774fb6ac5e9d3634793c6b7f0665502640984bee
Opcode Fuzzy Hash: 4e08f846a6d00f54f017fa59201d6ed23f295b0ceed85bb3955be9a15fe67e3f
Instruction Fuzzy Hash: 13717C71B04205AFDB25DFAADC81BAEBBF5FF88304F0084AAF504E7286D674D9058B55

Function 004E5B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E5B6F
CreateCompatibleDC.GDI32(00000000), ref: 004E5B79
GetObjectW.GDI32(?,00000018,?), ref: 004E5B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004E5BB0
GetDC.USER32(00000000), ref: 004E5BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004E5BE9
ReleaseDC.USER32(00000000,00000000), ref: 004E5C0F
SelectObject.GDI32(?,?), ref: 004E5C2A
SelectObject.GDI32(?,00000000), ref: 004E5C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 004E5C65
SelectObject.GDI32(?,00000000), ref: 004E5C73
SelectObject.GDI32(?,00000000), ref: 004E5C81
DeleteDC.GDI32(?), ref: 004E5C97
DeleteDC.GDI32(?), ref: 004E5CA0

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction ID: 17c9c49937640a7ee63a15ab90711d013368aaab887e413720973401a1c3c297
Opcode Fuzzy Hash: aef1841c4e128ff32c9b36ede18983638337cbd9838766df907cc8eb69374be7
Instruction Fuzzy Hash: 3D410C72E40754BFDB10EAE9C952FAFB7BCAB09705F50045AB600E7281D6789A4087A4

Function 004EB964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 004EB9A7
RealizePalette.GDI32(?), ref: 004EB9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 004EB9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 004EB9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 004EBA0A
SetStretchBltMode.GDI32(?,00000004), ref: 004EBA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 004EBA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 004EBA4D
CreateCompatibleDC.GDI32(00000000), ref: 004EBAAE
SelectObject.GDI32(?,?), ref: 004EBAC3
SelectObject.GDI32(?,00000000), ref: 004EBB22
DeleteDC.GDI32(00000000), ref: 004EBB31

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction ID: 7ad90294f0dfa4864f0bea30e35c96d4e1fa41525923fe95d334a894f78dac22
Opcode Fuzzy Hash: cd1fa1e0ecb1de98fa74186667cffcb93663ecd76ac09dee35a8bf4f5781b3c6
Instruction Fuzzy Hash: 54912971604245AFDB50DFAAC981F9FBBE8AB08305F10455AF505E7651D738ED40CBA4

Function 004EE9A8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 004EE9B4
IsEqualGUID.OLE32(?,00512700), ref: 004EE9D5
IsEqualGUID.OLE32(?,00512710), ref: 004EE9EB

Strings

'Q, xrefs: 004EE9FA
0'Q, xrefs: 004EEA10
P'Q, xrefs: 004EEA3C
@'Q, xrefs: 004EEA26

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Equal
String ID: 'Q$0'Q$@'Q$P'Q
API String ID: 4016716531-2080303212
Opcode ID: 747f021721ff3c2f2f308c36154d945ae8afe7a775471791d2fc46d475a62721
Instruction ID: 668e9c56f971650c12da9d823aa5ee09c5d7c22914e8e6bdbce1990405fd9d8c
Opcode Fuzzy Hash: 747f021721ff3c2f2f308c36154d945ae8afe7a775471791d2fc46d475a62721
Instruction Fuzzy Hash: C21175710085849ADB61DB2BAD80BF72B9D6F5A305F04509BFD844F343D39D894E876E

Function 00425DC8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 00408887
Part of subcall function 00408850: GetTickCount.KERNEL32 ref: 0040889F

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425E60
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425E6B
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EA6
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 00425F42
EnumCalendarInfoW.KERNEL32(00425C8C,00000000,00000000,00000004), ref: 00425F4D
GetThreadLocale.KERNEL32(00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F8A
EnumCalendarInfoW.KERNEL32(00425D30,00000000,00000000,00000003,00425C8C,00000000,00000000,00000004), ref: 00425F95

Strings

[B, xrefs: 00425E21, 00425EDD, 00426014
B.C., xrefs: 00425EF0

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.$[B
API String ID: 1601775584-1960173975
Opcode ID: bdd4197d7eb2ffb02902c54e6afe2c9f4f4249679a561f1a093ff8705a151cfa
Instruction ID: 696a8cbb88cbf135683503293481ae752516e7a6c47e6b4c93b3b9376ce1ac3d
Opcode Fuzzy Hash: bdd4197d7eb2ffb02902c54e6afe2c9f4f4249679a561f1a093ff8705a151cfa
Instruction Fuzzy Hash: 9761F570B006129FE710EF69E885AAA77E5EF44724B51857EF400EB3E1C738AD41DB98

Function 004ED7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004ED0C0: DeleteObject.GDI32(00000000), ref: 004ED206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004ED865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 004ED8E3
GetIconInfo.USER32(00000000,?), ref: 004ED947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 004ED980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,004EDA2B), ref: 004ED9E9
DeleteObject.GDI32(?), ref: 004ED9FF
DeleteObject.GDI32(?), ref: 004EDA08

Strings

, xrefs: 004ED890
,, xrefs: 004ED86A

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction ID: 3b15df45811348dce314f71d9fb3896dfd83895a50164542f8512fd99f32aa23
Opcode Fuzzy Hash: 0c5187b6c173e4ec8a62df78b25059c000a8f0dee15bd527dab433ee5dea9988
Instruction Fuzzy Hash: F4913871B00145AFD700EFAAC885A9EBBF9FF48305F6041AAF505EB251DA34ED45CB94

Function 004253AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253D3
GetThreadLocale.KERNEL32(?,00000001,00000000,00425691,?,?,?,?,00000000,00000000), ref: 004253DC

Part of subcall function 00425380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,00425482,?,00000001,00000000,00425691), ref: 00425393

Part of subcall function 00425334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00425352

Strings

m/d/yy, xrefs: 004254DD
2, xrefs: 0042566D
AMPM, xrefs: 0042560A
AMPM , xrefs: 00425619
mmmm d, yyyy, xrefs: 00425502
:mm, xrefs: 00425629
:mm:ss, xrefs: 00425644

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction ID: ae11f37f10c7c7cc2ece4aa2851bd9592c5e3db29736d4fa45ff2483457f4832
Opcode Fuzzy Hash: ecbc7d69b4f11c979955816f9b11cd38cc839c94d643873308f8a088d78fbf3d
Instruction Fuzzy Hash: 597122307005699BDB01EBA5E881ADE72A6DF84344FD0807BF904EB646DB3CDE16879D

Function 004266A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004264A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
Part of subcall function 004264A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
Part of subcall function 004264A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,004267C5), ref: 00426701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00426746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042674C
GetStdHandle.KERNEL32(000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00426760
WriteFile.KERNEL32(00000000,000000F4,004267E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00426766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 0042678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 004267A4

Strings

tfB, xrefs: 00426711, 004267B9

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: tfB
API String ID: 135118572-130872579
Opcode ID: a0136f777ba58d895bd3e1e672c0e4a7f0cd4caa2196d966552b420903b0b10f
Instruction ID: 9c75294d96735c9fe687749e8061594f53467045c9bc451e3e63c88f9cd22533
Opcode Fuzzy Hash: a0136f777ba58d895bd3e1e672c0e4a7f0cd4caa2196d966552b420903b0b10f
Instruction Fuzzy Hash: B2317375644218BFEB10EB65DC83FDA73BCEB04704F9041A6B604E61D1DA74AE848B6C

Function 004E4AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

CreateCompatibleDC.GDI32(00000000), ref: 004E4B64
SelectObject.GDI32(?,?), ref: 004E4B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 004E4C70
SetTextColor.GDI32(?,00000000), ref: 004E4C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 004E4C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 004E4CC5
SetTextColor.GDI32(?,?), ref: 004E4CD5
SetBkColor.GDI32(?,?), ref: 004E4CE5
SelectObject.GDI32(?,00000000), ref: 004E4D15
DeleteDC.GDI32(?), ref: 004E4D1E

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction ID: 71bf14b9f78042d93af0d274de238ac5bd12102c0260bb26fb2fcf8b95af7db9
Opcode Fuzzy Hash: 17a9f5c396fd801cce45f3af1a2c03a7e908330b3a1013798d2b0e4747143bd7
Instruction Fuzzy Hash: EE919375A00248AFCB40DFAAC981E9EBBF9EF4D315B10449AF505EB661C734EE41CB64

Function 004085C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 004085DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004085E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 004085FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,00408676,?,00000000,?,GetLogicalProcessorInformation), ref: 0040862A

Strings

GetLogicalProcessorInformation, xrefs: 004085D3
kernel32.dll, xrefs: 004085D8
@, xrefs: 0040867D

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction ID: 500c6e41f31b7fdb6d34238680861789b78f08bdeabe16a24c436e355b3d89bb
Opcode Fuzzy Hash: 9b6de5aca907aff7f49779a1cb565253b723d78320fe21404139914b83ab067e
Instruction Fuzzy Hash: E0116370D00208AADB10EBA5CA05B5EB7A4DF04304F1288BFE854B72C1DA7E8E508E59

Function 00410594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0041064C

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction ID: 0ce41ded5bccfca64fbac36b7d610e41f84856dd8e2a7bbc42b78d3b128abe8f
Opcode Fuzzy Hash: 01433c88fba5b4f775e71df606895a677a3445a2bc368d898035e78ffffcbf29
Instruction Fuzzy Hash: 0CA19075A013099FDB20DFA8D881BEEB7B5FF58310F14812AE915A7390DBB4A9C4CB54

Function 00430A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00430AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00430B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00430B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00430BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00430BD8
VariantCopy.OLEAUT32(?), ref: 00430C0D

Strings

, xrefs: 00430A6E

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: c5ac3e0bb315912875ce6d6a8b12eb4200af54bb65bf5f77a9b42e84e07fd96b
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 2C51227590022D9BCB25DB59CC91BDAB3BCAF4C304F0052DAF548E7252D634AF848F65

Function 004E9A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 004E9AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004E9B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 004E9B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 004E9B43

Strings

`, xrefs: 004E9A8B

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction ID: e4881d64baec76ee9eafe246b21c5bc9d5a9281d976d74d65e8b275913b0d6f5
Opcode Fuzzy Hash: 1bc734305bfd0bdb724ca875092e956d4852018e6443de175511f346f92c27bf
Instruction Fuzzy Hash: 8A412275D00248AFDB40DFA9C881AAEB7F9FF48711F50816AF904EB241E7389E40CB64

Function 004061E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406206
WriteFile.KERNEL32(00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040620C
GetStdHandle.KERNEL32(000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 0040622B
WriteFile.KERNEL32(00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?,00000000,?,?,00000000,00406B8F), ref: 00406231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000,?), ref: 00406248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00405354,00000000,?,00000000,00000000,000000F4,00405358,00000000), ref: 0040624E

Strings

TS@, xrefs: 00406218, 00406223

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: TS@
API String ID: 3320372497-1941835897
Opcode ID: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction ID: 82cfcf8d63e4733cb96d407babe502fa205990dff362196b090b8b3cf9cfd937
Opcode Fuzzy Hash: 773f2b01c096205ed1640b90909cb80b96b374e64d656fdce13fcbbb072e403a
Instruction Fuzzy Hash: 9D0162A16486147DE110F2BA9C8AF6F368CDB18724F10077E7618F60D2C5785C449B7A

Function 0040591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 004059D3
Sleep.KERNEL32(0000000A,00000000), ref: 004059E9
Sleep.KERNEL32(00000000), ref: 00405A17
Sleep.KERNEL32(0000000A,00000000), ref: 00405A2D

Strings

@., xrefs: 00405AB4, 00405AD6, 00405BEC, 00405C02

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction ID: a95b6186faaf28ee99436786a323c89c11953a43e3af36f3f78c15d8c677067a
Opcode Fuzzy Hash: ada7fe0ad1e969fa1615a2ce2c1f205a77d44d1215cb1e65cc2c198de2b16ae9
Instruction Fuzzy Hash: 0DC16972601B118FD725CF28D884367BBA1EB95320F1882BFD4059B3D5C778A849DF88

Function 00405CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405912), ref: 00405D36
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405912), ref: 00405D50

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction ID: 4f935fbc936f4d5eb3d08406d1a455a3bc696dbd4939a17767f2164eefdcc051
Opcode Fuzzy Hash: b3bac45a803a588073ab35a9efb47af0939235da5b92122c96ba95b50cef7661
Instruction Fuzzy Hash: 1371D231604B008FE725DB28D888B67BBD4EF95314F14C2BFD844AB3D2D67888459F59

Function 004E6084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E60B2
GetDeviceCaps.GDI32(?,00000068), ref: 004E60CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E60ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 004E6111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 004E612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 004E6143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 004E6163
ReleaseDC.USER32(00000000,?), ref: 004E617B

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction ID: 253042d8ae561a030da4b25cfcc59df415f83bc43ecdec077c49d488911ed581
Opcode Fuzzy Hash: 76daa9d26c080c564ad9041f13802c656f185a4c8ec9210214833560b50aa864
Instruction Fuzzy Hash: 8F2156B1A40218BADB50DFA5DD86F9EB3BCEB08705F510496F704E71C1D679AF408B28

Function 00405E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction ID: 14c4d9104ddc23c6b9370c21b65e9a421d4bec3d23930416dd05d6dcb6f7df23
Opcode Fuzzy Hash: 6090a39ba4113efe279c4ce94d3a27bfd3a3f347abc7f88e99f6aa2524520e12
Instruction Fuzzy Hash: 01C12262710A014BD714AA7D9C8836FB286DBC4325F68823FE645EB3C6DA7CCC458B58

Function 00501CB0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00501CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 00501D28
SelectObject.GDI32(?,?), ref: 00501D38
DeleteObject.GDI32(?), ref: 00501F51
DeleteDC.GDI32(?), ref: 00501F5D

Strings

|O, xrefs: 00501FB6

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID: |O
API String ID: 2986811175-2178481767
Opcode ID: 6c9e4b10af4bfad90ba126e86e16a972fe858d81f26a95e6dc0d306ccf21b480
Instruction ID: a9caf1b8b984823daa7831576d509085e41825b3096970940d4218d7ea8d8843
Opcode Fuzzy Hash: 6c9e4b10af4bfad90ba126e86e16a972fe858d81f26a95e6dc0d306ccf21b480
Instruction Fuzzy Hash: 83B1C575E0060A9FCB04DF99C985AAEBBF5FF48300F2181A5E914A73A1D734AD41CF55

Function 004FC798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC40B
Part of subcall function 004FC400: DeleteDC.GDI32(?), ref: 004FC418
Part of subcall function 004FC400: DeleteObject.GDI32(?), ref: 004FC434

CreateCompatibleDC.GDI32(00000000), ref: 004FC903
CreateHalftonePalette.GDI32(?,00000000), ref: 004FC93E
ResizePalette.GDI32(?,00000001), ref: 004FC973
SelectPalette.GDI32(?,?,00000000), ref: 004FC998
RealizePalette.GDI32(?), ref: 004FC9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 004FC9CE
SelectObject.GDI32(?,00000000), ref: 004FC9E1

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction ID: 4ba82757873bb3c143a4d1742f8b993ef62ffc4f5942cec004fa87537f0c0421
Opcode Fuzzy Hash: 3b39bf79a773d9044507b5f4a6ba50a4e1458e9f25aaa5a6f7355112836dca1f
Instruction Fuzzy Hash: E67137756005289FDB04EF19C4D5F6637E5EF0A305F0541E6F2048F3AAC678E84ACB9A

Function 00408850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408CDC: GetCurrentThreadId.KERNEL32 ref: 00408CDF

GetTickCount.KERNEL32 ref: 00408887
GetTickCount.KERNEL32 ref: 0040889F
GetCurrentThreadId.KERNEL32 ref: 004088CE
GetTickCount.KERNEL32 ref: 004088F9
GetTickCount.KERNEL32 ref: 00408930
GetTickCount.KERNEL32 ref: 0040895A
GetCurrentThreadId.KERNEL32 ref: 004089CA

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction ID: 59fdbd664e4c2a787114e1462c869c0698e504600effbf6fb817d1e717bb5ab3
Opcode Fuzzy Hash: 7d0f63ae373317c5f21e857476dc24018feec28cf215cb5a173da7a4db92fdee
Instruction Fuzzy Hash: BB415E716083419EDB21BE79CA4032BBAD1AB91354F14893FD4D8A73C2EE798881D75B

Function 004EA090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 004EA0F9
GetDC.USER32(00000000), ref: 004EA110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,004EA1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 004EA134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,004EA1AB,?,?,00000000,00000000,00000008,?,00000000,004EA1CB), ref: 004EA167

Strings

`, xrefs: 004EA0C8

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction ID: 560aeff5e142fb22fc32d70ae3aa060d7ef4d96bf65ee7c2df06f2301dcbdb9f
Opcode Fuzzy Hash: b7f937434eb2587f847978740abbd8c81bb9dfc3e5197959b54ccdff63f1a7cc
Instruction Fuzzy Hash: AD318775A00248ABDB00DFD5C882BEEF7B8EF0D705F514496F904EB281D678AE50D7A9

Function 004EA974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004E62F0: GetObjectW.GDI32(00000000,00000004), ref: 004E6307
Part of subcall function 004E62F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 004E632A

GetDC.USER32(00000000), ref: 004EA9B2
CreateCompatibleDC.GDI32(?), ref: 004EA9BE
SelectObject.GDI32(?), ref: 004EA9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,004EAA23,?,?,?,?,00000000), ref: 004EA9EF
SelectObject.GDI32(?,?), ref: 004EAA09
DeleteDC.GDI32(?), ref: 004EAA12
ReleaseDC.USER32(00000000,?), ref: 004EAA1D

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction ID: a90b19bdd86dec3490e2a43e61abe2758ba6d863edaf7bda9a2135b5bf853f90
Opcode Fuzzy Hash: ec8649657c05e97b9ba1c19bfcd01e8d0b09a6ae33e64875ffb60a9979b168a2
Instruction Fuzzy Hash: 54115172E00359BFDB10EFE9C851AEEB7BCEB09705F4044AAF504E7241E6789E5087A4

Function 004098D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?,?), ref: 00409909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?,?,00409AA2,00406F13,00406F5A,?), ref: 0040990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E,?,?,?), ref: 0040992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,0040998E), ref: 00409930

Strings

Error, xrefs: 00409942
Runtime error at 00000000, xrefs: 00409902, 00409947

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction ID: 1cafd5f0b55deffaaa1a260c41e3c473f996b032a313f4f96ee96a2a81eb749b
Opcode Fuzzy Hash: 1f536b54c0f7e54d54e2ef4696db32368710aa63d846f2239d9123bcbb9aa4c9
Instruction Fuzzy Hash: FBF04491A4134479FA3077A55C56F6F2B589704B18F18893FB650782D3CAB84C889766

Function 004E65E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 004E662E
GetSystemMetrics.USER32(0000000C), ref: 004E663A
GetDC.USER32(00000000), ref: 004E6656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004E667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004E668A
ReleaseDC.USER32(00000000,00000000), ref: 004E66C3

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction ID: 4016dc568379c8c19e12672c107d27f7e339e6f7b848dc7462e147759cb92e24
Opcode Fuzzy Hash: 514544e9451769a20b0d63ec12d45414229ecaa25948937d2ba282ff4bb2ffa2
Instruction Fuzzy Hash: BA318474E00244EFEB00DFA6C841AAEBBB5FF49751F11856AF414AB384C6749D41CB65

Function 004E6234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 004E6252
SelectObject.GDI32(00000000,00000000), ref: 004E625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,004EC367), ref: 004E626F
SelectObject.GDI32(00000000,00000000), ref: 004E627B
DeleteDC.GDI32(00000000), ref: 004E6281
CreatePalette.GDI32 ref: 004E62DC

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 687ba0588a677c063a35c7de7b30ba0b67179116ebe1a95d8b245445ea316819
Instruction ID: f9ac28f5a709015cd7dac8c2aac76fc79250ca92cd540129d47a5b8790f0b7a3
Opcode Fuzzy Hash: 687ba0588a677c063a35c7de7b30ba0b67179116ebe1a95d8b245445ea316819
Instruction Fuzzy Hash: 8511E73120434022D210BB679C43BAB72A89FD575AF01842FB64597382E67C8D4943DA

Function 004E6A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E6950: GetObjectW.GDI32(?,00000054), ref: 004E6964

CreateCompatibleDC.GDI32(00000000), ref: 004E6ABE
SelectPalette.GDI32(?,?,00000000), ref: 004E6ADF
RealizePalette.GDI32(?), ref: 004E6AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 004E6B02
SelectPalette.GDI32(?,00000000,00000000), ref: 004E6B2A
DeleteDC.GDI32(?), ref: 004E6B33

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction ID: ce5ef7bc2b447eaaf5ad7ea58a7014afe3a29db5ee430c20c38cefb41b0ea7be
Opcode Fuzzy Hash: 9dbd0a09d7bff179ba26f2c840b696ab711f6e12a27d33c9ec649e9677f75141
Instruction Fuzzy Hash: EF114275E403047FDB10DFAA8C42F9EBBEDDB49701F51806AB514E7281D678AE408768

Function 004EEBA4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 004EECF4

Strings

,, xrefs: 004EEC6A
p'Q, xrefs: 004EEC33
pN, xrefs: 004EEC15, 004EED49
, xrefs: 004EEC8B

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$p'Q$pN
API String ID: 3573556081-239200797
Opcode ID: a36b2ce3a17e244dc4f48a37d014dc17d7f2724a355e9d27d7f455f90c6e9585
Instruction ID: d53bf33184dab82490b91a6833bcc49679d7d0a09c945659e93068311a5a786b
Opcode Fuzzy Hash: a36b2ce3a17e244dc4f48a37d014dc17d7f2724a355e9d27d7f455f90c6e9585
Instruction Fuzzy Hash: 4251C074A00208AFDB40DF9AD881E9EB7F9FB48314F5181A6F914EB362D735AE44CB54

Function 004EE3C8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 004EE4B2

Strings

`'Q, xrefs: 004EE40A
p'Q, xrefs: 004EE3FB
,, xrefs: 004EE468
, xrefs: 004EE483

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,$`'Q$p'Q
API String ID: 3573556081-2603654308
Opcode ID: 0d623d8bb47bc937e364320cc812b0cbe733d440f62dbf9a7760e2fd883d3a9d
Instruction ID: e246d9ab9c4f828bb50ef93b5af18b126cefd7c0b660ce055d72d1820066ec98
Opcode Fuzzy Hash: 0d623d8bb47bc937e364320cc812b0cbe733d440f62dbf9a7760e2fd883d3a9d
Instruction Fuzzy Hash: B74144B1A00104AFDB40DF6AC885A9A77F9EF09318B2141A6FC04EB356D775ED45CB94

Function 004264A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00426654), ref: 004264DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004264FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0042651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 004265B5

Strings

MZP, xrefs: 00426519

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: cda587d1c7dd51f7113a3f7c71fb8e2b8424f2d416027c9f8032f24ff1560667
Instruction ID: d456c73e7132c3c39710e872f0bf7d3f91ce4916627ab0d5e0b6c1b93b785b94
Opcode Fuzzy Hash: cda587d1c7dd51f7113a3f7c71fb8e2b8424f2d416027c9f8032f24ff1560667
Instruction Fuzzy Hash: 70416270A002289FDB20DF65DC81BDDB7F9AB59304F8140FAE508E7241D7799E948F59

Function 004ED0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004ED17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 004ED189
ReleaseDC.USER32(00000000,00000000), ref: 004ED198
DeleteObject.GDI32(00000000), ref: 004ED206

Strings

(, xrefs: 004ED133

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 1d5f83cd09711b1592fb3c5d187764f48b37c6155305721d3b2ac61fe98a51fc
Instruction ID: f8dc7fb0225e0007809e4ec85b127dd46c416083a4cfc2b17fa9816b101fd4e4
Opcode Fuzzy Hash: 1d5f83cd09711b1592fb3c5d187764f48b37c6155305721d3b2ac61fe98a51fc
Instruction Fuzzy Hash: C541AE70E04248EFCB10DFA6C885ADEFBB5EF49305F1480AAE404AB351D6789E45DB99

Function 004B7154 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004B722A,?,?,004B5444,00000001), ref: 004B71CC
GetCurrentThread.KERNEL32 ref: 004B7204
GetCurrentThreadId.KERNEL32 ref: 004B720C

Strings

BnK, xrefs: 004B7221, 004B71D1, 004B71DB
pDA, xrefs: 004B71EB

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CurrentThread$ErrorLast
String ID: BnK$pDA
API String ID: 4172138867-3175749474
Opcode ID: 8db536c4902bcc63ec3ac8b9906052481f87a4bc473b60b0992f67eec6861494
Instruction ID: 29931ac111fce0eb9797ac9b0a9f0cd1aaf37b0830860b7779323239afbeb4a3
Opcode Fuzzy Hash: 8db536c4902bcc63ec3ac8b9906052481f87a4bc473b60b0992f67eec6861494
Instruction Fuzzy Hash: E62108709086456ED701DFB5C8817EABBE4BF89304F44857BE42497782DB389815C7B9

Function 0043690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction ID: 8d3459a469465bc4371695b4e367a65a38b978d34797e4c4e50731b7cb5a1aca
Opcode Fuzzy Hash: 9b1296c92a046bb743362478882edb4bed3443ecb9e909bca9af9b7118eca8f6
Instruction Fuzzy Hash: AFD1C235A00209AFCF00EF95C4918EEFBB9EF0D310F5590A6E840A7251D638AE46DB79

Function 004F0894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 004F08C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 004F08F3
memcpy.MSVCRT(00000000,?,?), ref: 004F0989
memcpy.MSVCRT(00000000,?,?), ref: 004F099F
memcpy.MSVCRT(00000000,?,?), ref: 004F09B5
memcpy.MSVCRT(00000000,?,?), ref: 004F09C9

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: bcd7db05d191351e9405a97d2655ef30d3ed96d280d6279a09f2b3dd0a47b8f8
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: 965175B1600200AFDB14CF69CCC5E6677A8BF88314F08827AEE098F346E735E944CB94

Function 004EC31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EC372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 76c421ad3c698b7ff88da0f61c3aa7df07cb2880bcd4f869b6d47c825d99da29
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: 3D11D3315012D9AEEB20AF27C481BEF3B94AF55357F04505BFC005A281D7BC8DA2C7A9

Function 004E619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004E61B4
GetDeviceCaps.GDI32(?,00000068), ref: 004E61D0
GetPaletteEntries.GDI32(10080D96,00000000,00000008,?), ref: 004E61E8
GetPaletteEntries.GDI32(10080D96,00000008,00000008,?), ref: 004E6200
ReleaseDC.USER32(00000000,?), ref: 004E621C

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction ID: fb62e25858754de89261d63ddcf899fc845c4e56b322bcc1c3ebe9d0414cdd2c
Opcode Fuzzy Hash: e2e0119970b46360f4dbaca9755fcc1ef81ad606db22181b8a12d53334abd375
Instruction Fuzzy Hash: 191108716483447EEB00DFA6EC42FA97FACE719706F40849BF204DA1C1DABA5544C324

Function 0040904A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 0040911E

Strings

,qB, xrefs: 0040906B
hsB, xrefs: 004090F7

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: ,qB$hsB
API String ID: 3192549508-2187915683
Opcode ID: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction ID: 7df4318895a31e83b2a36aa030ba475ccd5b90e95bae95c0b52881597b1f7c6e
Opcode Fuzzy Hash: 1700f64120af452dff93675b6e54fdb508242944783359e32faae08426496f92
Instruction Fuzzy Hash: 834196717042029FE720DF14C888B6BB7E5EB85314F15857AE448AB393C739EC45CB59

Function 00423C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,00423D0B), ref: 00423CB4

Strings

, xrefs: 00423C7A
yyyy, xrefs: 00423C89

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction ID: 4198a1d351d31b9a86c79895a928489856ad1452b39a35c365c2990c697424f4
Opcode Fuzzy Hash: 0809fa2659c157af8da77a48e90bfea0ac0ad0ed8c95e6ae3a57ad6ba9429efe
Instruction Fuzzy Hash: F4217F35A046289BDB10EF95D842AAEB3F8EF08701F91406BF905F7281D63C9F00C76A

Function 0042D69C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(0041F85C,00000001), ref: 0042D6B8
GetCPInfo.KERNEL32(0042D79C,0042C1C5,0041F85C,00000001), ref: 0042D6D9

Strings

\A, xrefs: 0042D6EA
$CA, xrefs: 0042D6E2

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Info
String ID: $CA$\A
API String ID: 1807457897-218779800
Opcode ID: abee861911d58a7033e3eeafc2a9b4d2014ccc218f4630971ae3e286374dfac3
Instruction ID: 3a58187b64d27b69014b85d8f26f214572db709be5b8c621f2483908a4e5df52
Opcode Fuzzy Hash: abee861911d58a7033e3eeafc2a9b4d2014ccc218f4630971ae3e286374dfac3
Instruction Fuzzy Hash: D501C471B00A158FC720EF69A981997BBE4AF05364700852FEC99C7351EA3999048BA9

Function 004E3964 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,004E3BCC), ref: 004E39AC
LeaveCriticalSection.KERNEL32(?,004E3BA3,?,00000000,004E3BCC), ref: 004E3B96

Strings

Default, xrefs: 004E3A5A
-Q, xrefs: 004E3A80

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Default$-Q
API String ID: 3168844106-3821686248
Opcode ID: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction ID: 19d7f923896caa44bc4d2895c7d959a39db7ed687c0c5984d3f2fc8e9670fb4e
Opcode Fuzzy Hash: 1a1d0b3d7fef57fbd369e5ba3f48b81e015b8509224f28914d8de7d590d176ed
Instruction Fuzzy Hash: BA519470A083589FDB02DFA9C845AEEBBF5FF48305F51446AE404A7352D778AE44CB14

Function 004E3ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 004E3EF7
GetObjectW.GDI32(?,00000010,?), ref: 004E3F0A
GetObjectW.GDI32(?,00000000,?), ref: 004E3F63

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction ID: b9ca84249461113418995685c1b411e63f59ddf32e5f5f2b3ba05ad8a3118a75
Opcode Fuzzy Hash: a40579d9f90c76d0c9fca4423f8c07d8447b4155338eb9add3561dc35ea178ad
Instruction Fuzzy Hash: 09319471A047849FD711CF5AC885EAABBF9EF49311F14846EF854DB741D234E9008B64

Function 0040C998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040C9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040CA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040CA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040CA97

Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040CA15), ref: 0040C96B
Part of subcall function 0040C954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040CA15), ref: 0040C988

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction ID: 8d1cb3547ee4b9364daa38f1b6dc697d03ddbece5e120c74778344a30482e11a
Opcode Fuzzy Hash: ab0a3fc87b5d274f299d69668d3c9eef21079eaeea860c77a07499101e2d6c50
Instruction Fuzzy Hash: DF313D70A0021E9BDB10DBA9C8C57AFB7B5EF04304F00427AE555E7291DB789A04CB95

Function 004EA788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E4780
Part of subcall function 004E4778: LeaveCriticalSection.KERNEL32(0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870,?,0051DE34), ref: 004E478D
Part of subcall function 004E4778: EnterCriticalSection.KERNEL32(?,0051DE34,0051DE34,?,004E4858,?,?,?,?,?,?,?,?,00000000,004E4870), ref: 004E4796

Part of subcall function 004EC31C: GetDC.USER32(00000000), ref: 004EC372
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004EC387
Part of subcall function 004EC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 004EC391
Part of subcall function 004EC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,004EA7DB,00000000,004EA867), ref: 004EC3B5
Part of subcall function 004EC31C: ReleaseDC.USER32(00000000,00000000), ref: 004EC3C0

CreateCompatibleDC.GDI32(00000000), ref: 004EA7DD
SelectObject.GDI32(00000000,?), ref: 004EA7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 004EA81F
RealizePalette.GDI32(00000000), ref: 004EA82B

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction ID: 70351cf6032dbd0939f732d494bf93bb1b6777d92977e90662745986a4f58f41
Opcode Fuzzy Hash: e4708b13d4162338c8fa8d9abf0c706dab058b01908a5adb0ec73a38d2e26af5
Instruction Fuzzy Hash: E8310634A00684EFD704EF5AD981D5EB7F5FF48315B6241A6E804AB322C738EE82DB54

Function 004EDF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 004EDFAD
GetObjectW.GDI32(?,00000018,?), ref: 004EDFCE
DeleteObject.GDI32(?), ref: 004EDFFA
DeleteObject.GDI32(?), ref: 004EE003

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction ID: 1a97c13f3edbda2b3c1502a7d4827854aa80e6db8bf7018fb0a338cf34cd0894
Opcode Fuzzy Hash: 7a1785c32ae41643537aa2786bfbdbae53e7e625d4899cd26e3bbc34933ba4e6
Instruction Fuzzy Hash: 32119175A00208AFDB00DFABC982C9EB7F9EB48311B1085AAF904D7351DB75EE00DA94

Function 004EEDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004EEDD9
SelectObject.GDI32(00000000,058A00B4), ref: 004EEDEB
GetTextMetricsW.GDI32(00000000), ref: 004EEDF6
ReleaseDC.USER32(00000000,00000000), ref: 004EEE07

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction ID: a86a7c8164184303e7b2e3849245c9a5924fc7d8bd12fc902a680fb7c4b12911
Opcode Fuzzy Hash: 69fa914ca851ee74fc1149395581ca18b64c37d6fa6240ddf4510f1bbda6b75f
Instruction Fuzzy Hash: 94E04F626027B032D551666B5D86BDB2A4C4F026ABF480116FD44997D1DA0DCE5083FA

Function 00427150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00427356), ref: 004271F0
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00427356), ref: 0042721C

Part of subcall function 0040EDD0: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040EE15

Strings

T@A, xrefs: 00427307

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: T@A
API String ID: 902310565-1700159869
Opcode ID: 284301953d1e6e481a532c393e6be836ac4b0c1abaafadd224fe03bf215fa2d0
Instruction ID: a7ef7301bc3d9c0cf40a5b8feecd3813e60ace2750a0d77308b08e3197a87419
Opcode Fuzzy Hash: 284301953d1e6e481a532c393e6be836ac4b0c1abaafadd224fe03bf215fa2d0
Instruction Fuzzy Hash: FA512934A08269DFDB10DF69DC88AD9B7F4EF48304F4045EAA808A7351D778AE84CF59

Function 00509FB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 0050A001
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 0050A086

Strings

FinalizeSections: VirtualProtect failed, xrefs: 0050A094

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: ae1ffdcb010d23ca9f49d26132327d72a6df7ff3edc21269dc9e8d44bd7b3919
Instruction ID: f388515a7708f7d7a65a5d8f4bc78f2eb459525e9b49133f6d2289461b6de0c8
Opcode Fuzzy Hash: ae1ffdcb010d23ca9f49d26132327d72a6df7ff3edc21269dc9e8d44bd7b3919
Instruction Fuzzy Hash: D5311F746013099FE720DF58C999F9ABBE8BB48784F148584FA54DB3E2D330ED448B92

Function 00428748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,0042BB77,00000000,0042BCB7), ref: 00428707

Strings

A, xrefs: 0042875E
Z, xrefs: 00428763

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: b9253ecd29e492176c38fe4a03f9f14fb6b287faa95297cdab911eb37b575cf8
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: 431136127466200BE720643FAC817FF958A87C63A4F99023FF505D73C1DC5C8C0142D9

Function 00408F1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00408F8A
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_00008F20), ref: 00408FC7

Strings

hsB, xrefs: 00408F45

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB
API String ID: 3192549508-625297667
Opcode ID: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction ID: a3b05377a8d17e60e07457b386e13646049d2c6927d33ce14a72d1f6f32e6c37
Opcode Fuzzy Hash: 71af4e390d5abfd6d2040d1b975c0e968029a7204a6687ef051946c3d04c1d81
Instruction Fuzzy Hash: 1A3180B0604301AFD720DB24C984F2BB7EAEB88714F14857EF548972A2CB38EC45D719

Function 004D8F38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FBC
RegCloseKey.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,004D9018), ref: 004D8FD4

Strings

0DA, xrefs: 004D8FEB

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: CloseCreate
String ID: 0DA
API String ID: 2932200918-1323616133
Opcode ID: a0f19bf8ba203798a6f5818f865e535c35ea911850f269e47917751f477542a0
Instruction ID: 910bbd055cc1c9b7bf883b16012c4ce6209579456e96a1eab725512d80e55f5e
Opcode Fuzzy Hash: a0f19bf8ba203798a6f5818f865e535c35ea911850f269e47917751f477542a0
Instruction Fuzzy Hash: 82215171B04208ABDB11EFA5CC52BAE77F9EB48704F10407BB504E7381EB789E059659

Function 0040945E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 0040947F

Strings

ptB, xrefs: 004094DA
hsB, xrefs: 004094B8

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: hsB$ptB
API String ID: 3192549508-579888589
Opcode ID: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction ID: 1c15842ca407df81533eab869cf356bb1e86fa8830085c109665a44f2841b22d
Opcode Fuzzy Hash: 6040466f00e2c8a053fbe7c5040ef9d1dac393dd0ce99f32a3ea5679555daf94
Instruction Fuzzy Hash: 722187742082059BDB24DF29D884B2B7391AB98710F14C53AA845973D7C73CEC46DB59

Function 004E9928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,004E99F3), ref: 004E99AB

Strings

l, xrefs: 004E9959
EMF, xrefs: 004E994B

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: 341d86e0c6776543a7129d5c129d4a69e55eff3aa90b84875f353d21bb74406e
Instruction ID: d8b59ccd57732e94ff2d5b122cdf495c560b21a665579054683b94a632da62f7
Opcode Fuzzy Hash: 341d86e0c6776543a7129d5c129d4a69e55eff3aa90b84875f353d21bb74406e
Instruction Fuzzy Hash: 84217F71A00244DFCB10EFAAC881A6EB7F5FF49714F55426EE405AB786DB38AD01CB58

Function 00433380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0043338D

Strings

U8C, xrefs: 0043339E
U8C, xrefs: 004333D0

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: U8C$U8C
API String ID: 1927566239-2794899156
Opcode ID: 2bf219fe34d9c24dc34974f115c002bebb6f59059a4f52b7f4042f9b4cd4a705
Instruction ID: b1e442c5de183a7aacccb02b0ee133ba8c43aa8bff35dacbda8296542432f51e
Opcode Fuzzy Hash: 2bf219fe34d9c24dc34974f115c002bebb6f59059a4f52b7f4042f9b4cd4a705
Instruction Fuzzy Hash: 6BF09C75E0421DEBCB40DF99D881AEEBBF8FB09710F008156EA54E7350E774AA44CB95

Function 004339A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004339AD

Strings

>C, xrefs: 004339F0
>C, xrefs: 004339BE

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: InitVariant
String ID: >C$>C
API String ID: 1927566239-3959820462
Opcode ID: 103049f0001b8704505cf99c79934eeb600d4499a48119106208599eb55162a0
Instruction ID: 5ed58aa5db09b4979a1c98424812f62d5ce122125df54411c221c3311fd6cc8b
Opcode Fuzzy Hash: 103049f0001b8704505cf99c79934eeb600d4499a48119106208599eb55162a0
Instruction Fuzzy Hash: 6DF0EC75E0020DABCB00DF99C881ADFB7F8FB08310F008156EA14E7350E774AA44CB95

Function 004289EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0050E4DB,00000000,0050E512), ref: 004289F2

Part of subcall function 004139B0: GetProcAddress.KERNEL32(0043C998,?), ref: 004139DA

Strings

kernel32.dll, xrefs: 004289ED
GetDiskFreeSpaceExW, xrefs: 004289FD

Memory Dump Source

Source File: 00000004.00000002.2282575702.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2282521079.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283173643.000000000050F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283224928.0000000000510000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283287938.0000000000511000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283356775.0000000000513000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283401236.0000000000518000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283468543.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283568733.0000000000520000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283616022.0000000000521000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000522000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2283705047.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction ID: 8ccd786351900723a36e45e0a3bb3a683afe0fdfe4abf5b7f5dbba0d790a7421
Opcode Fuzzy Hash: c7edea2ffbbda9fdc0d07ee16b935c76c2adbbdc0e38b75f3dfa78325f9fbb0d
Instruction Fuzzy Hash: 24D05EB07123624AD760ABA1B882B1E2288A320F06F80013FB20145B26CFFD8848534C

Analysis Process: rundll32.exePID: 5480, Parent PID: 6620COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	331
Total number of Limit Nodes:	24

Executed Functions

Function 03FED2FC Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,03FED3BC,?,?), ref: 03FED32E
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,03FED3BC,?,?), ref: 03FED337

Part of subcall function 03FED1C4: FindFirstFileW.KERNEL32(00000000,?,00000000,03FED222,?,00000001), ref: 03FED1F7
Part of subcall function 03FED1C4: FindClose.KERNEL32(00000000,00000000,?,00000000,03FED222,?,00000001), ref: 03FED207

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 1cdd072077a2f0a679de1d2bca735abcec3cd521e3ccd041a0eb351eea7a04f7
Instruction ID: 2b64f20f41a40377bdba2e9054b9643c63ff80216b661bc84bc8f1cc36c45d31
Opcode Fuzzy Hash: 1cdd072077a2f0a679de1d2bca735abcec3cd521e3ccd041a0eb351eea7a04f7
Instruction Fuzzy Hash: 7E114F78A043199FDF04EFA4DD81AAEB3B9EF49300F5044B9A904EB690DB789E05C665

Function 03FED1C4 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,03FED222,?,00000001), ref: 03FED1F7
FindClose.KERNEL32(00000000,00000000,?,00000000,03FED222,?,00000001), ref: 03FED207

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 36be61987af758da5ed5400380761aa0d0a919e5f7f4c3befee7b14fda8dc141
Instruction ID: 4bd2caca3fe0ea3440851580a6d00833548883d2de1cbfa5c913f0438b754792
Opcode Fuzzy Hash: 36be61987af758da5ed5400380761aa0d0a919e5f7f4c3befee7b14fda8dc141
Instruction Fuzzy Hash: C5F02775500309AFCB20FBB8DC41C8EB3FCEB4921079005B1B414D7590EB34DE009560

Function 03FECDE8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,03FED00D,?,?), ref: 03FECE21
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,03FED00D,?,?), ref: 03FECE6A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,03FED00D,?,?), ref: 03FECE8C
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 03FECEAA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 03FECEC8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 03FECEE6
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 03FECF04
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,03FECFF0,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,03FED00D), ref: 03FECF44
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,03FECFF0,?,80000001), ref: 03FECF6F
RegCloseKey.ADVAPI32(?,03FECFF7,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,03FECFF0,?,80000001,Software\Embarcadero\Locales), ref: 03FECFEA

Strings

Software\Embarcadero\Locales, xrefs: 03FECE60, 03FECE82
Software\CodeGear\Locales, xrefs: 03FECEA0, 03FECEBE
Software\Borland\Delphi\Locales, xrefs: 03FECEFA
Software\Borland\Locales, xrefs: 03FECEDC

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: f6b8c08adcab43d1da24eaf4e51d68fc5d74a4eae677b819860590c53bc780dd
Instruction ID: 29625f1d669a236cc9f603edc824b285c1ba9218d5d176f20136fc9b578b0029
Opcode Fuzzy Hash: f6b8c08adcab43d1da24eaf4e51d68fc5d74a4eae677b819860590c53bc780dd
Instruction Fuzzy Hash: 53514179B4034DBEEB20EAA4CC41FEEB3BCEB09704F544065FB14EA585D7B4DA008665

Function 03FECAB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(040FAC10,00000000,03FECBB8,?,?,?,00000000,?,03FED480,00000000,03FED4DF,?,?,00000000,00000000,00000000), ref: 03FECAD2
LeaveCriticalSection.KERNEL32(040FAC10,040FAC10,00000000,03FECBB8,?,?,?,00000000,?,03FED480,00000000,03FED4DF,?,?,00000000,00000000), ref: 03FECAF6
LeaveCriticalSection.KERNEL32(040FAC10,040FAC10,00000000,03FECBB8,?,?,?,00000000,?,03FED480,00000000,03FED4DF,?,?,00000000,00000000), ref: 03FECB05
IsValidLocale.KERNEL32(00000000,00000002,040FAC10,040FAC10,00000000,03FECBB8,?,?,?,00000000,?,03FED480,00000000,03FED4DF), ref: 03FECB17
EnterCriticalSection.KERNEL32(040FAC10,00000000,00000002,040FAC10,040FAC10,00000000,03FECBB8,?,?,?,00000000,?,03FED480,00000000,03FED4DF), ref: 03FECB74
LeaveCriticalSection.KERNEL32(040FAC10,040FAC10,00000000,00000002,040FAC10,040FAC10,00000000,03FECBB8,?,?,?,00000000,?,03FED480,00000000,03FED4DF), ref: 03FECB9D

Strings

en-GB,en,en-US,, xrefs: 03FECAE2, 03FECB89

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 4b227b9690fd976409159704f942ff3c5bf435af255f1a80326f80c21514f227
Instruction ID: 39a1b29c8393b308874ac05d514d3e62673ae2b8d55af3c851425c36960de46a
Opcode Fuzzy Hash: 4b227b9690fd976409159704f942ff3c5bf435af255f1a80326f80c21514f227
Instruction Fuzzy Hash: E621B72C7A034557DB10F7A88C1171D36999F86A04F554475F208AF752EEB8DC408BE6

Function 040CEE14 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 040CEE3A

Part of subcall function 040CEDD0: GetDC.USER32(00000000), ref: 040CEDD9
Part of subcall function 040CEDD0: SelectObject.GDI32(00000000,058A00B4), ref: 040CEDEB
Part of subcall function 040CEDD0: GetTextMetricsW.GDI32(00000000), ref: 040CEDF6
Part of subcall function 040CEDD0: ReleaseDC.USER32(00000000,00000000), ref: 040CEE07

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 040CEE90
Tahoma, xrefs: 040CEE5C
MS Shell Dlg 2, xrefs: 040CEEA4

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: c7747720a5fb9a9d81f9e9088c316ffe5993a9c9a16c36ec96d5f3d1d6f715a9
Instruction ID: 0233ca9d4d3c3ee43a70137a927ba21520c9aa0b73b254544062700f0d960dbf
Opcode Fuzzy Hash: c7747720a5fb9a9d81f9e9088c316ffe5993a9c9a16c36ec96d5f3d1d6f715a9
Instruction Fuzzy Hash: 51118F30600208EFEB51EFA4CC5199E7BE9EB45608F918478E500BBB50D735BE06DB94

Function 03FE961C Relevance: 6.2, APIs: 4, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 03FE9653

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 561adba454a1a85a321bfaa6bd1640ce5c8c75a197677fa4ac89ead5a2aa879b
Instruction ID: 6945d609a6734f7a8b5e06069a331ddd49e7c88162a68b362393018c9287f664
Opcode Fuzzy Hash: 561adba454a1a85a321bfaa6bd1640ce5c8c75a197677fa4ac89ead5a2aa879b
Instruction Fuzzy Hash: 3751BF74A003069FDB24EF69C88479B77E5EF09324F18846AE9099F251D7BCD884CB71

Function 040EE000 Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadLocale.KERNEL32(00000400,00000000,040EE0D7), ref: 040EE02D

Part of subcall function 03FEC520: InitializeCriticalSection.KERNEL32(040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC525
Part of subcall function 03FEC520: GetVersion.KERNEL32(040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC533
Part of subcall function 03FEC520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC55A
Part of subcall function 03FEC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03FEC560
Part of subcall function 03FEC520: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC574
Part of subcall function 03FEC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03FEC57A
Part of subcall function 03FEC520: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC58E
Part of subcall function 03FEC520: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03FEC594

Part of subcall function 03FEEE84: GetSystemInfo.KERNEL32 ref: 03FEEE88

GetCommandLineW.KERNEL32(00000400,00000000,040EE0D7), ref: 040EE092

Part of subcall function 03FE5244: GetStartupInfoW.KERNEL32 ref: 03FE5255

GetACP.KERNEL32(00000400,00000000,040EE0D7), ref: 040EE0A6
GetCurrentThreadId.KERNEL32 ref: 040EE0BA

Part of subcall function 03FEEE98: GetVersion.KERNEL32(040EE0C9,00000400,00000000,040EE0D7), ref: 03FEEE98

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: b59fd81387f4975a4a37f52c730aed27be62de608f47b0645b4e811af90d8095
Instruction ID: dc7a46c9cbfcc842e761b35a5466eedcd1472a5806d13ac220ecac94d7fb4143
Opcode Fuzzy Hash: b59fd81387f4975a4a37f52c730aed27be62de608f47b0645b4e811af90d8095
Instruction Fuzzy Hash: 2011217A4053449EDB40FFB5AC052543BA4FB06708B95C879D6046EE50EB7D4814CFBA

Function 040B915C Relevance: 4.6, APIs: 3, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,040B931F), ref: 040B91D5
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,040B931F), ref: 040B924B
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 040B92BC

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 05743ec137b8f8df9214e8d4592da79e761c00d6c5f27f24453dbf5f9f64f1d4
Instruction ID: 8cbca13e335c8590dacc70d7e204f85e0d36d4ba94f34406df7738d251a499cb
Opcode Fuzzy Hash: 05743ec137b8f8df9214e8d4592da79e761c00d6c5f27f24453dbf5f9f64f1d4
Instruction Fuzzy Hash: C9518D75B00308AFEB11EBA4CC40BDEB7FAAB44704F118469A584F7361D675AF05A798

Function 04007884 Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,04007984), ref: 040078C9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,04007967,?,00000000,?,00000000,04007984), ref: 04007902
VerQueryValueW.VERSION(?,04007998,?,?,00000000,?,00000000,?,00000000,04007967,?,00000000,?,00000000,04007984), ref: 0400791C

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: 4a91df4ecbd16e84d8dcd139701b6a4d02fb77ef39bb291c272124938e853abf
Instruction ID: 18dfb1908db9c95796caaef0df2d4c8dcd8e8ee071f2c1f991c9d3d6a04814db
Opcode Fuzzy Hash: 4a91df4ecbd16e84d8dcd139701b6a4d02fb77ef39bb291c272124938e853abf
Instruction Fuzzy Hash: A2314F79600349AFDB01DFA9CC81DAEB7F8EB49700B5144B5E944E7250DB78ED00CB21

Function 03FED3C8 Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,03FED4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,03FED566,00000000,?,00000105), ref: 03FED473
GetSystemDefaultUILanguage.KERNEL32(00000000,03FED4DF,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,03FED566,00000000,?,00000105), ref: 03FED49B

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 0f51b04fa8219df9e42c212de721606ed1d7f2e924d22430624394b50275622c
Instruction ID: 50c0aa4dc530a42d8e0a47f96f7762f26ab67433c9e34f0064cdfcc78a184564
Opcode Fuzzy Hash: 0f51b04fa8219df9e42c212de721606ed1d7f2e924d22430624394b50275622c
Instruction Fuzzy Hash: F2311E39E1031A9FDF10EF98CC90AAEF7B9EF55700F5444A6E414ABA50D7B8AD40CB51

Function 03FED4EC Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,03FED5A6,?,03FE0000,040EFC1C), ref: 03FED528
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,03FED5A6,?,03FE0000,040EFC1C), ref: 03FED579

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: bd200aabe2f352e74db6b2383a9b52d47405b0b14a05704c03bf02d9019c83a7
Instruction ID: 7fa5db8b23e34c22dbcae0142607bdb9308ebe8eecffe9cd3dfd8df50e5ecd4e
Opcode Fuzzy Hash: bd200aabe2f352e74db6b2383a9b52d47405b0b14a05704c03bf02d9019c83a7
Instruction Fuzzy Hash: 8A119178A4031C9FDB14EB54CC85BDEB3B8DB05304F4100FAE508A7690EA749F808AA4

Function 03FE5600 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,?,03FE5C17,?,03FE61BC), ref: 03FE5617

Strings

@., xrefs: 03FE5652, 03FE5670

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: @.
API String ID: 4275171209-4201455939
Opcode ID: 89253508b68522b2463bfa7e916e608ea2dae01ccdf2b44df96f915ad1c5ee28
Instruction ID: 96d5f46dff2a51fb4e65b41d9bf1b3b62e7d9d6e0b86fe05f8fc52f68beee8b3
Opcode Fuzzy Hash: 89253508b68522b2463bfa7e916e608ea2dae01ccdf2b44df96f915ad1c5ee28
Instruction Fuzzy Hash: 25F03CB3B003114FEB14EF789940792BAD5EB49354F15827EEA09EBB84D7BC8C018B80

Function 040B8EA0 Relevance: 3.0, APIs: 2, Instructions: 18
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegFlushKey.ADVAPI32(00000000,?,040B8F0C,?,?,00000000,040B9123,00000000,00000000,00000000,?,?,00000000,040B9139), ref: 040B8EB1
RegCloseKey.ADVAPI32(00000000,?,040B8F0C,?,?,00000000,040B9123,00000000,00000000,00000000,?,?,00000000,040B9139), ref: 040B8EBA

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction ID: a4e3d3118d0bb3a611c202e46d291d3c2a683ee6ed83005ee76daa17f00e406f
Opcode Fuzzy Hash: 53487b9075c46a64610a4022df3c6a921f3544410d10f835025151eaea8ac81c
Instruction Fuzzy Hash: DBD067AAA003059EDF90EE79CEC4A877BDCAF04210B08C4A69D58DF16AD778D4408B64

Function 040B9EDC Relevance: 1.6, APIs: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,040B9BB9), ref: 040B9F07

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 66dac43683783cdf6fd9d98dec0897474bd55752c79e0abfa3add44b93bc9ea1
Instruction ID: e4650d1a49071ab401864fd2f11270f8fe35feeaba125d701989a7db28d65c06
Opcode Fuzzy Hash: 66dac43683783cdf6fd9d98dec0897474bd55752c79e0abfa3add44b93bc9ea1
Instruction Fuzzy Hash: 1D014876B00208AFDB40EEA8DC80ADEB7FCDB49214F108176F954EB341D6759E0597A5

Function 040B98DC Relevance: 1.5, APIs: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?,?,040B9AE0,00000000,040B9C1C), ref: 040B990D

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction ID: 7f0ba6d869f598722a916fda5484aab67a63761fa5d475b3976888071427f696
Opcode Fuzzy Hash: 45af8dcbdd2c5adf3947c8e46fc95e82dd974bf530efeb322097dd60e67ff395
Instruction Fuzzy Hash: BBF0C9AA3052046FE754FAAD9C84FABA6DCDB88614F14843AB68CCB251D964DC0983B5

Function 03FEC278 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(03FE0000,?,0000020A), ref: 03FEC296

Part of subcall function 03FED4EC: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,03FED5A6,?,03FE0000,040EFC1C), ref: 03FED528
Part of subcall function 03FED4EC: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,03FED5A6,?,03FE0000,040EFC1C), ref: 03FED579

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction ID: 7c155d3bb08057aae5154d5ca79eb5fcbc50a1d926c875a841e1252e5f628a53
Opcode Fuzzy Hash: d994d483d02e46fdff6fa18ed6b597f72d1d7e29fcadbbba57b44e2c2294e8a2
Instruction Fuzzy Hash: 13E0ED75E003109FCB10DE98C9C5E4677D8AB08654F044591FD18CF346D771D91087D1

Function 03FEEE84 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 03FEEE88

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction ID: c1dfb7a2ae05157b228ab38d1be7c78d1f3b9bd74ad2a28bff33ccd545aa79ce
Opcode Fuzzy Hash: c27e8cf9b7b8b28db5bf16ce19b686b88097b3598cd7681285108ea85b127420
Instruction Fuzzy Hash: 5EA012184085000EC408E7184C4240F31801942018FC40610A85C99281E609C56503DB

Non-executed Functions

Function 03FECBF8 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,03FFA5A8,?,?), ref: 03FECC15
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 03FECC26
FindFirstFileW.KERNEL32(?,?,kernel32.dll,03FFA5A8,?,?), ref: 03FECD26
FindClose.KERNEL32(?,?,?,kernel32.dll,03FFA5A8,?,?), ref: 03FECD38
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,03FFA5A8,?,?), ref: 03FECD44
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,03FFA5A8,?,?), ref: 03FECD89

Strings

GetLongPathNameW, xrefs: 03FECC20
kernel32.dll, xrefs: 03FECC10
\, xrefs: 03FECD56

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 8e8a64f63b1ae3095fcc712948487de7d56439519ce01def55b2edf923abf646
Instruction ID: e745b8a78365b1315bec31f8c8b63837b2ac6a56bf9815185167a61457f116c9
Opcode Fuzzy Hash: 8e8a64f63b1ae3095fcc712948487de7d56439519ce01def55b2edf923abf646
Instruction Fuzzy Hash: 1E41D575E00729DBCB20EFA8CC84ADEB7B9AF45310F1845A5E518EB250E774EE44CB85

Function 040DABB4 Relevance: 49.7, APIs: 33, Instructions: 249windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 040DABD2
CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 040DABE7
SelectObject.GDI32(00000000,00000000), ref: 040DABEE
CreateCompatibleDC.GDI32(?), ref: 040DAC22
CreateCompatibleDC.GDI32(?), ref: 040DAC2E
CreateCompatibleDC.GDI32(?), ref: 040DAC3A
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 040DAC4D
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 040DAC5D
CreateCompatibleBitmap.GDI32(?,?,?), ref: 040DAC6B
SelectObject.GDI32(?,?), ref: 040DAC7B
SelectObject.GDI32(?,?), ref: 040DAC8B
SelectObject.GDI32(?,?), ref: 040DAC9B
SetBkColor.GDI32(00000000,?), ref: 040DACA8
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 040DACCC
SetBkColor.GDI32(00000000,?), ref: 040DACD6
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00330008), ref: 040DACF2
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 040DAD12
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 040DAD2E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,008800C6), ref: 040DAD4F
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 040DAD70
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 040DAD90
SelectObject.GDI32(?,?), ref: 040DAD9D
DeleteObject.GDI32(00000000), ref: 040DADA3
SelectObject.GDI32(?,?), ref: 040DADB0
DeleteObject.GDI32(00000000), ref: 040DADB6
SelectObject.GDI32(?,?), ref: 040DADC3
DeleteObject.GDI32(00000000), ref: 040DADC9
SelectObject.GDI32(00000000,?), ref: 040DADD3
DeleteObject.GDI32(00000000), ref: 040DADD9
DeleteDC.GDI32(?), ref: 040DADE2
DeleteDC.GDI32(?), ref: 040DADEB
DeleteDC.GDI32(?), ref: 040DADF4
DeleteDC.GDI32(00000000), ref: 040DADFA

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Object$CreateDeleteSelect$Compatible$Bitmap$Stretch$Color
String ID:
API String ID: 881050057-0
Opcode ID: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction ID: f0695583f677849baa2c1eae9b5f12ac920a138f997261ee4e2713082647a6d7
Opcode Fuzzy Hash: d06672be3dad3db98e6b51f863aed52956d6e0b67a9b4389ede429620055148c
Instruction Fuzzy Hash: 878143B9E40318BEDB50EAE8CD85FAFB7BCAF09750F104415FA14FB290C665AD008B64

Function 0400EF9C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0400EFA5

Part of subcall function 0400EF70: GetProcAddress.KERNEL32(00000000), ref: 0400EF89

Strings

VarBoolFromStr, xrefs: 0400F13F
VarR4FromStr, xrefs: 0400F0E7
VarR8FromStr, xrefs: 0400F0FD
VarCyFromStr, xrefs: 0400F129
VarMod, xrefs: 0400F063
VarSub, xrefs: 0400F00B
VarNeg, xrefs: 0400EFC9
VarAdd, xrefs: 0400EFF5
VarBstrFromCy, xrefs: 0400F155
VariantChangeTypeEx, xrefs: 0400EFB3
VarI4FromStr, xrefs: 0400F0D1
VarNot, xrefs: 0400EFDF
VarCmp, xrefs: 0400F0BB
VarDateFromStr, xrefs: 0400F113
VarOr, xrefs: 0400F08F
VarBstrFromDate, xrefs: 0400F16B
VarBstrFromBool, xrefs: 0400F181
oleaut32.dll, xrefs: 0400EFA0
VarDiv, xrefs: 0400F037
VarAnd, xrefs: 0400F079
VarIdiv, xrefs: 0400F04D
VarXor, xrefs: 0400F0A5
VarMul, xrefs: 0400F021

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 564c4a87327255abcf4a6f9d3520de00e9095e2795f45fa5cd18d4a54d15b8c7
Instruction ID: eb5368890f3b4ada586ed95fa82320bb9f23a82eb7d149d5e9a77ddc04d76b9c
Opcode Fuzzy Hash: 564c4a87327255abcf4a6f9d3520de00e9095e2795f45fa5cd18d4a54d15b8c7
Instruction Fuzzy Hash: 1F413F6160C2065B7214AB69F80047677D9EB4521CFA0CC3AA445FBBD4DE78FC8267AD

Function 040C5CEC Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 040C5D2F
SelectObject.GDI32(?,?), ref: 040C5D44
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,040C5DB4,?,?), ref: 040C5D88
SelectObject.GDI32(?,?), ref: 040C5DA2
DeleteObject.GDI32(?), ref: 040C5DAE
CreateCompatibleDC.GDI32(00000000), ref: 040C5DC2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 040C5DE3
SelectObject.GDI32(?,?), ref: 040C5DF8
SelectPalette.GDI32(?,18080E31,00000000), ref: 040C5E0C
SelectPalette.GDI32(?,?,00000000), ref: 040C5E1E
SelectPalette.GDI32(?,00000000,000000FF), ref: 040C5E33
SelectPalette.GDI32(?,18080E31,000000FF), ref: 040C5E49
RealizePalette.GDI32(?), ref: 040C5E55
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 040C5E77
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 040C5E99
SetTextColor.GDI32(?,00000000), ref: 040C5EA1
SetBkColor.GDI32(?,00FFFFFF), ref: 040C5EAF
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 040C5EDB
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 040C5F00
SetTextColor.GDI32(?,?), ref: 040C5F0A
SetBkColor.GDI32(?,?), ref: 040C5F14
SelectObject.GDI32(?,00000000), ref: 040C5F27
DeleteObject.GDI32(?), ref: 040C5F30
SelectPalette.GDI32(?,00000000,00000000), ref: 040C5F52
DeleteDC.GDI32(?), ref: 040C5F5B

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: fa2daaef959d28887bbec4893de5fe7b9761973f1a608a7270bb21a59aed3a1a
Instruction ID: 1eaa87c205bd8087baf680e51ebe53a7b114d90d0f648ff3b7798221082733f1
Opcode Fuzzy Hash: fa2daaef959d28887bbec4893de5fe7b9761973f1a608a7270bb21a59aed3a1a
Instruction Fuzzy Hash: 278183BAA00219BFDB50DFA8CD85EAF77FDAF0D614F110559FA18EB250C674AD008B61

Function 040CB140 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 040CB163
GetDC.USER32(00000000), ref: 040CB191
CreateCompatibleDC.GDI32(?), ref: 040CB1A2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 040CB1BD
SelectObject.GDI32(?,00000000), ref: 040CB1D7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 040CB1F9
CreateCompatibleDC.GDI32(?), ref: 040CB207
SelectObject.GDI32(00000000,00000000), ref: 040CB24F
SelectPalette.GDI32(00000000,?,00000000), ref: 040CB262
RealizePalette.GDI32(00000000), ref: 040CB26B
SelectPalette.GDI32(?,?,00000000), ref: 040CB277
RealizePalette.GDI32(?), ref: 040CB280
SetBkColor.GDI32(00000000,00000000), ref: 040CB28A
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 040CB2AE
SetBkColor.GDI32(00000000,00000000), ref: 040CB2B8
SelectObject.GDI32(00000000,00000000), ref: 040CB2CB
DeleteObject.GDI32(00000000), ref: 040CB2D7
DeleteDC.GDI32(00000000), ref: 040CB2ED
SelectObject.GDI32(?,00000000), ref: 040CB308
DeleteDC.GDI32(00000000), ref: 040CB324
ReleaseDC.USER32(00000000,00000000), ref: 040CB335

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 8dea61389a2359ed0b2f4208049c2a5f25fbbc275ba4f4a40018954b6a1b3d17
Instruction ID: fc319f5ad9af14597359ef3973312da74a2259cde7064ca3ae0358f3700fc5aa
Opcode Fuzzy Hash: 8dea61389a2359ed0b2f4208049c2a5f25fbbc275ba4f4a40018954b6a1b3d17
Instruction Fuzzy Hash: 6E51D87AE00319BFDB51EBE8DC55BAEB7F8AF08704F10445AB614FB290D674A9448B60

Function 040CC71C Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 357windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 040CC9A4
CreateCompatibleDC.GDI32(00000001), ref: 040CCA09
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 040CCA1E
SelectObject.GDI32(?,00000000), ref: 040CCA28
SelectPalette.GDI32(?,?,00000000), ref: 040CCA58
RealizePalette.GDI32(?), ref: 040CCA64
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 040CCA88
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,040CCAE1,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 040CCA96
SelectPalette.GDI32(?,00000000,000000FF), ref: 040CCAC8
SelectObject.GDI32(?,?), ref: 040CCAD5
DeleteObject.GDI32(00000000), ref: 040CCADB

Strings

(, xrefs: 040CC8D2
BM, xrefs: 040CC83D

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: adc166ffe73ce151a7ce0698af339e79b8a79439157e378074fb246bcdb780a4
Instruction ID: f9d374a294ca63a4ebebbabc7c02b9dd37ef435936f8a76f2995789f8740e110
Opcode Fuzzy Hash: adc166ffe73ce151a7ce0698af339e79b8a79439157e378074fb246bcdb780a4
Instruction Fuzzy Hash: 8AE11C75A04218EFEF54DFA8C884AAEBBF5FF49304F148569E904FB294D734A844CB61

Function 040CB698 Relevance: 24.3, APIs: 16, Instructions: 265windowCOMMON

Download Yara Rule

APIs

Part of subcall function 040CC31C: GetDC.USER32(00000000), ref: 040CC372
Part of subcall function 040CC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 040CC387
Part of subcall function 040CC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 040CC391
Part of subcall function 040CC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,040CA7DB,00000000,040CA867), ref: 040CC3B5
Part of subcall function 040CC31C: ReleaseDC.USER32(00000000,00000000), ref: 040CC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 040CB6DB
RealizePalette.GDI32(?), ref: 040CB6EA
GetStretchBltMode.GDI32(00000000), ref: 040CB6FC
GetDeviceCaps.GDI32(?,0000000C), ref: 040CB70D
GetDeviceCaps.GDI32(?,0000000E), ref: 040CB71C
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C,00000000), ref: 040CB74F
SetStretchBltMode.GDI32(?,00000004), ref: 040CB75D
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C,00000000), ref: 040CB775
SetStretchBltMode.GDI32(00000000,00000003), ref: 040CB792
CreateCompatibleDC.GDI32(00000000), ref: 040CB7F3
SelectObject.GDI32(?,?), ref: 040CB808
SelectObject.GDI32(?,00000000), ref: 040CB867
DeleteDC.GDI32(00000000), ref: 040CB876

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CapsDevice$ModePaletteSelectStretch$BrushCreateObject$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 28117789-0
Opcode ID: f6a1840ff8491a67506571cf3dbd14384d061bd8851646ac6eac3c6ea6524c35
Instruction ID: 6bb3ba229d8865f47bfe19f63f2e77d5c20f2c070b9402beca83a9d4d1cb0489
Opcode Fuzzy Hash: f6a1840ff8491a67506571cf3dbd14384d061bd8851646ac6eac3c6ea6524c35
Instruction Fuzzy Hash: 2FA10475A00209EFDB80EBA8D981F9EB7F8AF08204F104559FA05EB6A1D734FD44CB60

Function 040E9364 Relevance: 21.2, APIs: 6, Strings: 8, Instructions: 217COMMON

Download Yara Rule

Strings

PE, xrefs: 040E93E0
BTMemoryLoadLibary: Can't attach library, xrefs: 040E95A8
BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid, xrefs: 040E93F1
BTMemoryLoadLibary: BuildImportTable failed, xrefs: 040E9530
MZ, xrefs: 040E939F
BTMemoryLoadLibary: Get DLLEntyPoint failed, xrefs: 040E957D
BTMemoryLoadLibary: dll dos header is not valid, xrefs: 040E93AC
BTMemoryLoadLibary: VirtualAlloc failed, xrefs: 040E9448

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID:
String ID: BTMemoryLoadLibary: BuildImportTable failed$BTMemoryLoadLibary: Can't attach library$BTMemoryLoadLibary: Get DLLEntyPoint failed$BTMemoryLoadLibary: IMAGE_NT_SIGNATURE is not valid$BTMemoryLoadLibary: VirtualAlloc failed$BTMemoryLoadLibary: dll dos header is not valid$MZ$PE
API String ID: 0-3631919656
Opcode ID: 3371e7a5489e70d6da49b17d4bbb68f53b52b026affe3f45e59a58e07a8b5ba8
Instruction ID: 9b8b166f4cdf48300e8041147727ccc7cbcc3758a0348e7d8327f512389b959b
Opcode Fuzzy Hash: 3371e7a5489e70d6da49b17d4bbb68f53b52b026affe3f45e59a58e07a8b5ba8
Instruction Fuzzy Hash: 357171B5B042049FEB54EF6ACC80FAEB7E5EF88304F0084A5EA04FB790D674E9158B51

Function 040C5B58 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 040C5B6F
CreateCompatibleDC.GDI32(00000000), ref: 040C5B79
GetObjectW.GDI32(?,00000018,?), ref: 040C5B99
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 040C5BB0
GetDC.USER32(00000000), ref: 040C5BBC
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 040C5BE9
ReleaseDC.USER32(00000000,00000000), ref: 040C5C0F
SelectObject.GDI32(?,?), ref: 040C5C2A
SelectObject.GDI32(?,00000000), ref: 040C5C39
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 040C5C65
SelectObject.GDI32(?,00000000), ref: 040C5C73
SelectObject.GDI32(?,00000000), ref: 040C5C81
DeleteDC.GDI32(?), ref: 040C5C97
DeleteDC.GDI32(?), ref: 040C5CA0

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: b5ebf9b3a908ff0919a45fc71b2f0956ebde3710e12b4ac3ce49f604e67aacc8
Instruction ID: c51c494d7a448ef08b493a8c81e17cad8c82d7fad8f6f8ef0ec30cee54446619
Opcode Fuzzy Hash: b5ebf9b3a908ff0919a45fc71b2f0956ebde3710e12b4ac3ce49f604e67aacc8
Instruction Fuzzy Hash: 5641B97AA50319BFDB50EBE8CD85FAFB7F8AF09700F510455BA14FB290D674A9408B60

Function 03FEC520 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC525
GetVersion.KERNEL32(040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC533
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC55A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03FEC560
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC574
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03FEC57A
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,040FAC10,040EE037,00000400,00000000,040EE0D7), ref: 03FEC58E
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03FEC594

Strings

SetThreadPreferredUILanguages, xrefs: 03FEC56A
GetThreadPreferredUILanguages, xrefs: 03FEC550
GetThreadUILanguage, xrefs: 03FEC584
kernel32.dll, xrefs: 03FEC555, 03FEC56F, 03FEC589

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 7cb64581742c90b9170fae7bab1aebf8443c9eca0e4501dadeb6435160e1e4b5
Instruction ID: 322d9601915b2379fd3cc936d0eb071975d3496ba82df7eba70bca9ad844bb6b
Opcode Fuzzy Hash: 7cb64581742c90b9170fae7bab1aebf8443c9eca0e4501dadeb6435160e1e4b5
Instruction Fuzzy Hash: F0F0ACEDAA4341AAD610FB709C05A1D3A84DBC650CB148435F33CAE512FEACD5409F56

Function 040CB964 Relevance: 19.8, APIs: 13, Instructions: 255windowCOMMON

Download Yara Rule

APIs

Part of subcall function 040CC31C: GetDC.USER32(00000000), ref: 040CC372
Part of subcall function 040CC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 040CC387
Part of subcall function 040CC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 040CC391
Part of subcall function 040CC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,040CA7DB,00000000,040CA867), ref: 040CC3B5
Part of subcall function 040CC31C: ReleaseDC.USER32(00000000,00000000), ref: 040CC3C0

SelectPalette.GDI32(?,?,000000FF), ref: 040CB9A7
RealizePalette.GDI32(?), ref: 040CB9B6
GetDeviceCaps.GDI32(?,0000000C), ref: 040CB9C8
GetDeviceCaps.GDI32(?,0000000E), ref: 040CB9D7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 040CBA0A
SetStretchBltMode.GDI32(?,00000004), ref: 040CBA18
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 040CBA30
SetStretchBltMode.GDI32(00000000,00000003), ref: 040CBA4D
CreateCompatibleDC.GDI32(00000000), ref: 040CBAAE
SelectObject.GDI32(?,?), ref: 040CBAC3
SelectObject.GDI32(?,00000000), ref: 040CBB22
DeleteDC.GDI32(00000000), ref: 040CBB31

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: c8d87d1a914b383d974dbf7b9704dc58242fd706ac21b8fe76b67333ea9bc09c
Instruction ID: b191e23ec507179d5cae077bb4be308b44789f6679bf39aeef20ab8570b322a2
Opcode Fuzzy Hash: c8d87d1a914b383d974dbf7b9704dc58242fd706ac21b8fe76b67333ea9bc09c
Instruction Fuzzy Hash: EA913575A00249EFDB50EBA8D981F9EBBF8AF08204F104559F605EB691DA74FE40CB60

Function 040CD7A0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

Part of subcall function 040CD0C0: DeleteObject.GDI32(00000000), ref: 040CD206

DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000000), ref: 040CD865
GetDIBits.GDI32(00000000,00000000,00000000,00000000,?,?), ref: 040CD8E3
GetIconInfo.USER32(00000000,?), ref: 040CD947
GetDIBits.GDI32(00000000,?,00000000,00000000,?,00000000,?), ref: 040CD980
SetDIBits.GDI32(00000000,00000000,?,00000000,?,00000000,040CDA2B), ref: 040CD9E9
DeleteObject.GDI32(?), ref: 040CD9FF
DeleteObject.GDI32(?), ref: 040CDA08

Strings

,, xrefs: 040CD86A
, xrefs: 040CD890

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: BitsDeleteObject$Icon$DrawInfo
String ID: $,
API String ID: 1810795657-71045815
Opcode ID: e247b46da2b4d1ecf97ebc04cabb723186f5ad9d4bfd7fdebfff0c5c53e9b87b
Instruction ID: 4a857b5a48abb8a4a0dbae1fed886ea962ccf74616384031320763c476c3fa7f
Opcode Fuzzy Hash: e247b46da2b4d1ecf97ebc04cabb723186f5ad9d4bfd7fdebfff0c5c53e9b87b
Instruction Fuzzy Hash: A691F475B00209EFD750EFA8DC85A9EBBF9FF48204F5041B9E519EB260DA34ED458B90

Function 040053AC Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 216threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,04005691,?,?,?,?,00000000,00000000), ref: 040053D3
GetThreadLocale.KERNEL32(?,00000001,00000000,04005691,?,?,?,?,00000000,00000000), ref: 040053DC

Part of subcall function 04005380: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,04005482,?,00000001,00000000,04005691), ref: 04005393

Part of subcall function 04005334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 04005352

Strings

AMPM, xrefs: 0400560A
2, xrefs: 0400566D
:mm:ss, xrefs: 04005644
:mm, xrefs: 04005629
m/d/yy, xrefs: 040054DD
mmmm d, yyyy, xrefs: 04005502
AMPM , xrefs: 04005619

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-3379564615
Opcode ID: 0d3688689b91d22055de74837119e0812f1cd9cb6faa86c704558266ba8d9d4d
Instruction ID: 9f32e79e7201265670107d86af60d12d70f906fe75e45d68926fa513500bed6b
Opcode Fuzzy Hash: 0d3688689b91d22055de74837119e0812f1cd9cb6faa86c704558266ba8d9d4d
Instruction Fuzzy Hash: FE714334700149ABFF05FBA4DC80ADE76AAEF88308F90C065E504BF685DA35EE069F55

Function 04005DC8 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 199threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03FE8850: GetTickCount.KERNEL32 ref: 03FE8887
Part of subcall function 03FE8850: GetTickCount.KERNEL32 ref: 03FE889F

Part of subcall function 04005334: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 04005352

GetThreadLocale.KERNEL32(00000000,00000004), ref: 04005E60
EnumCalendarInfoW.KERNEL32(04005C8C,00000000,00000000,00000004), ref: 04005E6B
GetThreadLocale.KERNEL32(00000000,00000003,04005C8C,00000000,00000000,00000004), ref: 04005EA6
EnumCalendarInfoW.KERNEL32(04005D30,00000000,00000000,00000003,04005C8C,00000000,00000000,00000004), ref: 04005EB1
GetThreadLocale.KERNEL32(00000000,00000004), ref: 04005F42
EnumCalendarInfoW.KERNEL32(04005C8C,00000000,00000000,00000004), ref: 04005F4D
GetThreadLocale.KERNEL32(00000000,00000003,04005C8C,00000000,00000000,00000004), ref: 04005F8A
EnumCalendarInfoW.KERNEL32(04005D30,00000000,00000000,00000003,04005C8C,00000000,00000000,00000004), ref: 04005F95

Strings

B.C., xrefs: 04005EF0

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: B.C.
API String ID: 1601775584-621294921
Opcode ID: 1eeaacaa655eac5e1c48677bca70aadeec717b8c4848ee9bdf6c0f798c821e39
Instruction ID: 600ab1b3b25ff4554e28510ce1f7d1dea5649213a7098dab5b3aaed06b91354c
Opcode Fuzzy Hash: 1eeaacaa655eac5e1c48677bca70aadeec717b8c4848ee9bdf6c0f798c821e39
Instruction Fuzzy Hash: 09616DB8A00705AFE710EF68DC84EAA7BB5EF48714F108579E910BB7A0C639BD418F50

Function 040C4AC0 Relevance: 15.2, APIs: 10, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 040C4778: EnterCriticalSection.KERNEL32(040FDE34,?,040C4858,?,?,?,?,?,?,?,?,00000000,040C4870,?,040FDE34), ref: 040C4780
Part of subcall function 040C4778: LeaveCriticalSection.KERNEL32(040FDE34,040FDE34,?,040C4858,?,?,?,?,?,?,?,?,00000000,040C4870,?,040FDE34), ref: 040C478D
Part of subcall function 040C4778: EnterCriticalSection.KERNEL32(?,040FDE34,040FDE34,?,040C4858,?,?,?,?,?,?,?,?,00000000,040C4870), ref: 040C4796

CreateCompatibleDC.GDI32(00000000), ref: 040C4B64
SelectObject.GDI32(?,?), ref: 040C4B74
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00CC0020), ref: 040C4C70
SetTextColor.GDI32(?,00000000), ref: 040C4C7E
SetBkColor.GDI32(?,00FFFFFF), ref: 040C4C92
StretchBlt.GDI32(?,?,?,?,?,?,?,?,00000000,?,00E20746), ref: 040C4CC5
SetTextColor.GDI32(?,?), ref: 040C4CD5
SetBkColor.GDI32(?,?), ref: 040C4CE5
SelectObject.GDI32(?,00000000), ref: 040C4D15
DeleteDC.GDI32(?), ref: 040C4D1E

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Color$CriticalSection$EnterObjectSelectStretchText$CompatibleCreateDeleteLeave
String ID:
API String ID: 675119849-0
Opcode ID: aaaf5af86fe9ff0224fa2cbcc1e057f21128cf5a8cd97e4fe350fa9541855f86
Instruction ID: 7ffe2f3b98b512ec20966a94e6fe0e63241447a8d0275aeb9cf00badd8144340
Opcode Fuzzy Hash: aaaf5af86fe9ff0224fa2cbcc1e057f21128cf5a8cd97e4fe350fa9541855f86
Instruction Fuzzy Hash: FF918075A00218EFDB40EFA8C990E9EBBF9FF4D204B544599F918EB260C634ED41CB60

Function 03FE85C8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 03FE85DD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 03FE85E3
GetLogicalProcessorInformation.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 03FE85F6
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 03FE85FF
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,03FE8676,?,00000000,?,GetLogicalProcessorInformation), ref: 03FE862A

Strings

@, xrefs: 03FE867D
GetLogicalProcessorInformation, xrefs: 03FE85D3
kernel32.dll, xrefs: 03FE85D8

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: 7cbc52221f1b8e60b165f662adc48bb56eb65d54aa6fb31bc688d13db097914e
Instruction ID: 51ad6381a9d3d2ede806a411d5d1fa13f472250dd93ac6dd5137ea8e2e6fe45c
Opcode Fuzzy Hash: 7cbc52221f1b8e60b165f662adc48bb56eb65d54aa6fb31bc688d13db097914e
Instruction Fuzzy Hash: D9117C75D0430DAFDB10EBA4CC04AADB7B8EB41A44F1884A5E918EB151D679CE808B51

Function 03FF0594 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 03FF064C

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c85536f4f5210892bb4e6d82181ccf1c686311bc7bb1f14fb98d8e41a1051fd1
Instruction ID: 610557aea4e8dfc362e104850c67b7c8626fe826b941f4a8290d316fa6201db7
Opcode Fuzzy Hash: c85536f4f5210892bb4e6d82181ccf1c686311bc7bb1f14fb98d8e41a1051fd1
Instruction Fuzzy Hash: D3A13176D0130A9FDB14DFA8D980BAEB7F5FF48310F184169EA05AB291DB78A944CF50

Function 040E985C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,040E9AC1,?,00000000,?,00000000), ref: 040E98DE
IsBadReadPtr.KERNEL32(?,00000014), ref: 040E9A92

Strings

BuildImportTable: ReallocMemory failed, xrefs: 040E9970
BuildImportTable: can't load library: , xrefs: 040E9925
BuildImportTable: GetProcAddress failed, xrefs: 040E9A65

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: LibraryLoadRead
String ID: BuildImportTable: GetProcAddress failed$BuildImportTable: ReallocMemory failed$BuildImportTable: can't load library:
API String ID: 1452896035-1384308123
Opcode ID: c161319ce859584b2099c4c3b67ce0342ed135d557433eab2f2b0c11819473d9
Instruction ID: ce474ffefc4e6358bf6c2f78fa9d146ba0aeb456a639da0fe9adc87753e1770b
Opcode Fuzzy Hash: c161319ce859584b2099c4c3b67ce0342ed135d557433eab2f2b0c11819473d9
Instruction Fuzzy Hash: 27718BB4A00204AFEB10EB6ACC80BFEB3F9EF89314F4484A5E155EB250D778BD558B50

Function 04010A54 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 04010AED
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 04010B09
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 04010B42
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 04010BBF
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 04010BD8
VariantCopy.OLEAUT32(?), ref: 04010C0D

Strings

, xrefs: 04010A6E

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction ID: e206fb3f2a88fff49dd282499a02b9550a9e25d32d12622dfe82166e4e10b1d7
Opcode Fuzzy Hash: b24821290767192b64c8f13178bb3ebd50a91d5dafaf8b93d1d09599547c4c5d
Instruction Fuzzy Hash: 3551E975A0062D9BDB62DB58CC80AD9B3FCAF4C208F0041D5E689B7661DA34AFC48F61

Function 040C9A04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 040C9AA6
MulDiv.KERNEL32(?,000009EC,00000000), ref: 040C9AC3
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 040C9AEF
GetEnhMetaFileHeader.GDI32(00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 040C9B0F
DeleteEnhMetaFile.GDI32(00000016), ref: 040C9B30
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,0000006C,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 040C9B43

Strings

`, xrefs: 040C9A8B

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: dc483c7270f0bfa2807f2a850d05e1324299e22c9223d29e9572dc81b8603d85
Instruction ID: da883ad26ca0d0ef8014926846e09b0a79a7b1db7244b6c30ebf6034bcc3c587
Opcode Fuzzy Hash: dc483c7270f0bfa2807f2a850d05e1324299e22c9223d29e9572dc81b8603d85
Instruction Fuzzy Hash: 53410DB5D00218EFDB40DFA9C980AAEBBF9EF48710F518559E904FB250E734AE40CB64

Function 03FE591C Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,03FE61BC), ref: 03FE59D3
Sleep.KERNEL32(0000000A,00000000,?,03FE61BC), ref: 03FE59E9
Sleep.KERNEL32(00000000,?,?,?,03FE61BC), ref: 03FE5A17
Sleep.KERNEL32(0000000A,00000000,?,?,?,03FE61BC), ref: 03FE5A2D

Strings

@., xrefs: 03FE5AB4, 03FE5AD6, 03FE5BEC, 03FE5C02

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID: @.
API String ID: 3472027048-4201455939
Opcode ID: 33d615f09584e65bdc55133f4ca116ea3a447995e8281ab48ec68cae520f7557
Instruction ID: 91027d5514b1a00279f50d7ef8530010a562836071969232609639fdae6ff177
Opcode Fuzzy Hash: 33d615f09584e65bdc55133f4ca116ea3a447995e8281ab48ec68cae520f7557
Instruction Fuzzy Hash: 6EC12373A013528FDB15DF68E884396BBA1EB86328F1882BED44D9F785C778D845C790

Function 03FE5CA0 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 03FE5D36
Sleep.KERNEL32(0000000A,00000000,?), ref: 03FE5D50

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 88da0db914013644463533a608401ba55fe15ed69c39280ca3a23eebc63a34f7
Instruction ID: 4725a871f78e7bedb265fe721d87e3dc182a14afba21db3d5bacf03377e7d445
Opcode Fuzzy Hash: 88da0db914013644463533a608401ba55fe15ed69c39280ca3a23eebc63a34f7
Instruction Fuzzy Hash: 2D71F572A043118FE725DF68CD88B56BBD5EF87318F1882B9D84C8F292D778C8458751

Function 040066A0 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 040064A8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,04006654), ref: 040064DB
Part of subcall function 040064A8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 040064FF
Part of subcall function 040064A8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0400651A
Part of subcall function 040064A8: LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 040065B5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,040067C5), ref: 04006701
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 04006734
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 04006746
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0400674C
GetStdHandle.KERNEL32(000000F4,040067E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 04006760
WriteFile.KERNEL32(00000000,000000F4,040067E0,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 04006766
LoadStringW.USER32(00000000,0000FFEC,?,00000040), ref: 0400678A
MessageBoxW.USER32(00000000,?,?,00002010), ref: 040067A4

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: 5a13fc1f9b25ddbae3f3cf61674d9c480903cd3ba6f7252741695fce914aa2f2
Instruction ID: a23917edb62626b6abea7c6d142ce2f12fe6e710030faf9985d2a97754d23bff
Opcode Fuzzy Hash: 5a13fc1f9b25ddbae3f3cf61674d9c480903cd3ba6f7252741695fce914aa2f2
Instruction Fuzzy Hash: 39317379654308BFFB14DAA4CC42F9A73ACEB04710F504166BB04FB1D0DAB57E508B65

Function 040C6084 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 040C60B2
GetDeviceCaps.GDI32(?,00000068), ref: 040C60CE
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 040C60ED
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 040C6111
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 040C612F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 040C6143
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 040C6163
ReleaseDC.USER32(00000000,?), ref: 040C617B

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: b2a0d73a3fe9a08299c39e8d4244354b0e2561efb7f59d7536acbe55893a3758
Instruction ID: 0b33c7e308a54aeb7f406ce63398b8b095351527eb3bff151265084149f1a561
Opcode Fuzzy Hash: b2a0d73a3fe9a08299c39e8d4244354b0e2561efb7f59d7536acbe55893a3758
Instruction Fuzzy Hash: FD210AB9A40308BADB50DBA4CD85FAE72ACEF48705F510495FB04FA2D0D675AE449B24

Function 03FE5E98 Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d6feb753da92ae44c8b4ca8834a8116179ba38e3509bc4ca8f67cd4d149bc6
Instruction ID: 2e6ee31f733c3d3a2b9dc99538515c4549de424d13081e59a42c4743aef1b5fb
Opcode Fuzzy Hash: a6d6feb753da92ae44c8b4ca8834a8116179ba38e3509bc4ca8f67cd4d149bc6
Instruction Fuzzy Hash: 13C13567B203150BD714EA7C9C8476EB386DBC622AF5C827AE258CF395DB78C9458350

Function 040DC798 Relevance: 10.7, APIs: 7, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 040DC400: DeleteObject.GDI32(?), ref: 040DC40B
Part of subcall function 040DC400: DeleteDC.GDI32(?), ref: 040DC418
Part of subcall function 040DC400: DeleteObject.GDI32(?), ref: 040DC434

CreateCompatibleDC.GDI32(00000000), ref: 040DC903
CreateHalftonePalette.GDI32(?,00000000), ref: 040DC93E
ResizePalette.GDI32(?,00000001), ref: 040DC973
SelectPalette.GDI32(?,?,00000000), ref: 040DC998
RealizePalette.GDI32(?), ref: 040DC9A3
CreateDIBSection.GDI32(?,-00000474,00000000,-00000450,00000000,00000000), ref: 040DC9CE
SelectObject.GDI32(?,00000000), ref: 040DC9E1

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Palette$CreateDeleteObject$Select$CompatibleHalftoneRealizeResizeSection
String ID:
API String ID: 2525607832-0
Opcode ID: e50728733d9a172dccdcd3642236e79194563dd1c3f24786565c7fe917b0911a
Instruction ID: 8cb9992bc69df2498201acfea8c64ebcadf8f800088e9be5305ed369437354b2
Opcode Fuzzy Hash: e50728733d9a172dccdcd3642236e79194563dd1c3f24786565c7fe917b0911a
Instruction Fuzzy Hash: 2B7136792046209FEB44DF28C8D4FA533E5EF4A304F0541E6E6049F3AAC634F84ACB96

Function 03FE8850 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03FE8CDC: GetCurrentThreadId.KERNEL32 ref: 03FE8CDF

GetTickCount.KERNEL32 ref: 03FE8887
GetTickCount.KERNEL32 ref: 03FE889F
GetCurrentThreadId.KERNEL32 ref: 03FE88CE
GetTickCount.KERNEL32 ref: 03FE88F9
GetTickCount.KERNEL32 ref: 03FE8930
GetTickCount.KERNEL32 ref: 03FE895A
GetCurrentThreadId.KERNEL32 ref: 03FE89CA

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 934bf9f7a03847501d54c117d98b21bd577a9c8a39416685ab5c71e410478e77
Instruction ID: 10911cf429efc60f9786e482d2dd020a2a822cd91353de80407f4ba8ece9a85f
Opcode Fuzzy Hash: 934bf9f7a03847501d54c117d98b21bd577a9c8a39416685ab5c71e410478e77
Instruction Fuzzy Hash: 93417F31A083429ED721FE7CC98431EBBD1AF81B94F19896ED4D98B291EB75C580C753

Function 040CA090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 040CA0E2
MulDiv.KERNEL32(?,?,000009EC), ref: 040CA0F9
GetDC.USER32(00000000), ref: 040CA110
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,040CA1CB,?,00000000,?,?,000009EC,?,?,000009EC), ref: 040CA134
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,040CA1AB,?,?,00000000,00000000,00000008,?,00000000,040CA1CB), ref: 040CA167

Strings

`, xrefs: 040CA0C8

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: bc026027dee30b53c517831af95b9e8b020f28842dc8a9ba145f83e2a226227a
Instruction ID: dc9ac503497a0526ac4532667df3f9e11ad4a1c45a05288c24c51476307fcbff
Opcode Fuzzy Hash: bc026027dee30b53c517831af95b9e8b020f28842dc8a9ba145f83e2a226227a
Instruction Fuzzy Hash: 32312F79A00208EBDB00EFE4DC91BAEB7B8EF49704F514455EA04FB250D675AE00DBA5

Function 040CE9A8 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsEqualGUID.OLE32(?,?), ref: 040CE9B4
IsEqualGUID.OLE32(?,040F2700), ref: 040CE9D5
IsEqualGUID.OLE32(?,040F2710), ref: 040CE9EB

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Equal
String ID:
API String ID: 4016716531-0
Opcode ID: 90e42a66ddf7b884c7e3975fa8492d96ec04470b1512994f67de23712dc62135
Instruction ID: db2ddc55a76cb13a8043c7cd02ebe4020cc45d54646f41a2634760ab539f2956
Opcode Fuzzy Hash: 90e42a66ddf7b884c7e3975fa8492d96ec04470b1512994f67de23712dc62135
Instruction Fuzzy Hash: F5112E21105550DEEB92DF28D980BFE379DAF43208F04109AEE457B252E39DB9458BE6

Function 040CA974 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 040C62F0: GetObjectW.GDI32(00000000,00000004), ref: 040C6307
Part of subcall function 040C62F0: GetPaletteEntries.GDI32(00000000,00000000,?,00000028), ref: 040C632A

GetDC.USER32(00000000), ref: 040CA9B2
CreateCompatibleDC.GDI32(?), ref: 040CA9BE
SelectObject.GDI32(?), ref: 040CA9CB
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,040CAA23,?,?,?,?,00000000), ref: 040CA9EF
SelectObject.GDI32(?,?), ref: 040CAA09
DeleteDC.GDI32(?), ref: 040CAA12
ReleaseDC.USER32(00000000,?), ref: 040CAA1D

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: c9c7964be322ebb0f9976b24d5349103f30aaef4b872087a32ac701bb55da1cf
Instruction ID: f2c2fea506f532af4ef51c18e2b14c4da2957b190ca10b28be2c5f282cbaf5cc
Opcode Fuzzy Hash: c9c7964be322ebb0f9976b24d5349103f30aaef4b872087a32ac701bb55da1cf
Instruction Fuzzy Hash: 3211127AE10319BFDB10EBE8CC51BAEB3FCEF09704F4145A5AA04EB250D7759A504B50

Function 03FE98D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03FE998E,?,?,?,?,03FE9AA2,03FE6F13,03FE6F5A,?,?), ref: 03FE9909
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03FE998E,?,?,?,?,03FE9AA2,03FE6F13,03FE6F5A,?), ref: 03FE990F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03FE998E,?,?,?), ref: 03FE992A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,03FE998E), ref: 03FE9930

Strings

Runtime error at 00000000, xrefs: 03FE9902, 03FE9947
Error, xrefs: 03FE9942

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: fa83d28edcde64cbce0ddbc0d9b760fbe8380fb94090133f6f017bf9752e93a2
Instruction ID: e16ec47a221e0fd38139b2962d5ada38b91c116b9ce62ba99d840702ef374b2b
Opcode Fuzzy Hash: fa83d28edcde64cbce0ddbc0d9b760fbe8380fb94090133f6f017bf9752e93a2
Instruction Fuzzy Hash: D0F0F666A41342BDFB20F7A09C06FAF375C8701A1DF18953AB3547C0E1C7EC84808672

Function 040C65E0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 040C662E
GetSystemMetrics.USER32(0000000C), ref: 040C663A
GetDC.USER32(00000000), ref: 040C6656
GetDeviceCaps.GDI32(00000000,0000000E), ref: 040C667D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 040C668A
ReleaseDC.USER32(00000000,00000000), ref: 040C66C3

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 63311655d6a897b1a570061d44bc6923f9c4e4f5d3ffbbd101a53079808ed06c
Instruction ID: d99130f6a5b5e7f38f0a5a2b6f92b206fe5a80b4b01b3973401caaefe23551fe
Opcode Fuzzy Hash: 63311655d6a897b1a570061d44bc6923f9c4e4f5d3ffbbd101a53079808ed06c
Instruction Fuzzy Hash: F6313278A00308EFDB10DFA4C981AAEBBF5FF49710F108569E914AB394D775A940CF65

Function 040C6234 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 040C6252
SelectObject.GDI32(00000000,00000000), ref: 040C625B
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,?,00000000,?,?,040CC367), ref: 040C626F
SelectObject.GDI32(00000000,00000000), ref: 040C627B
DeleteDC.GDI32(00000000), ref: 040C6281
CreatePalette.GDI32 ref: 040C62DC

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: ac1ea9b6d447644a7e942a31a6417f9fcf3d92565d8ae9242bce9c94304120eb
Instruction ID: 273c59c44fc77039d3cb2535c97b99b3e25b5836a7c3d4648435bfabc825a47b
Opcode Fuzzy Hash: ac1ea9b6d447644a7e942a31a6417f9fcf3d92565d8ae9242bce9c94304120eb
Instruction Fuzzy Hash: 72110635304714B6E320B7658C41BAF72E8DFC5314F008C2EFA45EB291E67AA8499396

Function 040C6A9C Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 040C6950: GetObjectW.GDI32(?,00000054), ref: 040C6964

CreateCompatibleDC.GDI32(00000000), ref: 040C6ABE
SelectPalette.GDI32(?,?,00000000), ref: 040C6ADF
RealizePalette.GDI32(?), ref: 040C6AEB
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 040C6B02
SelectPalette.GDI32(?,00000000,00000000), ref: 040C6B2A
DeleteDC.GDI32(?), ref: 040C6B33

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: a7c8f9bef419f3bcfac320c96ab0d1c3f437cb0ece977e9fabcf25cb1ce2ba5a
Instruction ID: 6b90f5c8181fd05b1968877edf6482a38bce2cbd0aab1c75bb936ef6afebe48d
Opcode Fuzzy Hash: a7c8f9bef419f3bcfac320c96ab0d1c3f437cb0ece977e9fabcf25cb1ce2ba5a
Instruction Fuzzy Hash: 2F114F79A00308BFDB10DBA98C91F9EB7ECEF49700F518465BA14EB290DA75A9008B60

Function 03FE61E4 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,03FE5358,00000000,?,00000000,?,?,00000000,03FE6B8F), ref: 03FE6206
WriteFile.KERNEL32(00000000,000000F4,03FE5358,00000000,?,00000000,?,?,00000000,03FE6B8F), ref: 03FE620C
GetStdHandle.KERNEL32(000000F4,03FE5354,00000000,?,00000000,00000000,000000F4,03FE5358,00000000,?,00000000,?,?,00000000,03FE6B8F), ref: 03FE622B
WriteFile.KERNEL32(00000000,000000F4,03FE5354,00000000,?,00000000,00000000,000000F4,03FE5358,00000000,?,00000000,?,?,00000000,03FE6B8F), ref: 03FE6231
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,03FE5354,00000000,?,00000000,00000000,000000F4,03FE5358,00000000,?), ref: 03FE6248
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,03FE5354,00000000,?,00000000,00000000,000000F4,03FE5358,00000000), ref: 03FE624E

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: b80448bd27bc979bf12df9ad3f7e747a5076a8ddd4d20b87fe17232cd0534776
Instruction ID: 26bb2c7c851ddcbd6c1dfb1f296b7ce7a4f0805b2ea5ded5446395b15c773750
Opcode Fuzzy Hash: b80448bd27bc979bf12df9ad3f7e747a5076a8ddd4d20b87fe17232cd0534776
Instruction Fuzzy Hash: 590168992493157DE650F6B89CC4F6F378CDB5A625F104721771CEE0D1C668DC508771

Function 040064A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,04006654), ref: 040064DB
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 040064FF
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 0400651A
LoadStringW.USER32(00000000,0000FFEB,?,00000100), ref: 040065B5

Strings

MZP, xrefs: 04006519

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: f91c7acff6f15d32bedecd0ee737417d2066372b297944ada9c4d308b5011170
Instruction ID: 7b5f8c2ce4cb24848767184887559b25c1c37072cfd8b2299c69ce465f4cc76c
Opcode Fuzzy Hash: f91c7acff6f15d32bedecd0ee737417d2066372b297944ada9c4d308b5011170
Instruction Fuzzy Hash: 63410074A003589FEB20EF64CC81BD9B7FAAB59300F4084E5E508E7254D776AE948F51

Function 040CD0C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 040CD17C
CreateHalftonePalette.GDI32(00000000,00000000), ref: 040CD189
ReleaseDC.USER32(00000000,00000000), ref: 040CD198
DeleteObject.GDI32(00000000), ref: 040CD206

Strings

(, xrefs: 040CD133

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 23130f4ea636d46bdd4e08e34f92422c1c86f4c0c6627e465b16dfb1e034bae6
Instruction ID: 2c2290e5c45928b3466566f8adf8e3d522e51fa0d04d1d012962aff7d56988ee
Opcode Fuzzy Hash: 23130f4ea636d46bdd4e08e34f92422c1c86f4c0c6627e465b16dfb1e034bae6
Instruction Fuzzy Hash: D5417C74A04208EFDB10DFA8C885B9DBBF6EF89304F5040B9E805BB351D674AA45DB51

Function 0401690C Relevance: 7.8, APIs: 5, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298fdfb5c06e744710d6eb4a26d6994f1ca03384204a78f18ba692463a3a426f
Instruction ID: 5983181d25673ceb40f520a48db51c6ce49a541fb7268e5f74f18a63e74dfdb9
Opcode Fuzzy Hash: 298fdfb5c06e744710d6eb4a26d6994f1ca03384204a78f18ba692463a3a426f
Instruction Fuzzy Hash: B3D16035E002499FDB00EF94C8908FDBBFAEF49714F8448A5E840BB660D635BE95DB61

Function 040E1CB0 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 040E1CF9
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 040E1D28
SelectObject.GDI32(?,?), ref: 040E1D38
DeleteObject.GDI32(?), ref: 040E1F51
DeleteDC.GDI32(?), ref: 040E1F5D

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CreateDeleteObject$CompatibleSectionSelect
String ID:
API String ID: 2986811175-0
Opcode ID: ff5cd3b233a55264beacb614e55d7a0cf10ec49d69c70e44d421c6b0bdb07502
Instruction ID: 14c530060c7957fab68210f48428bcc7393cc30a15dafa088b1e5c7a967aad12
Opcode Fuzzy Hash: ff5cd3b233a55264beacb614e55d7a0cf10ec49d69c70e44d421c6b0bdb07502
Instruction Fuzzy Hash: 78B1AFB4E002199FCB04DFA9C984AAEBBF5FF58304F2181A5E914BB365D734AD41CB94

Function 040D0894 Relevance: 7.6, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000038), ref: 040D08C0
memcpy.MSVCRT(00000000,00000000,000016C4), ref: 040D08F3
memcpy.MSVCRT(00000000,?,?), ref: 040D0989
memcpy.MSVCRT(00000000,?,?), ref: 040D099F
memcpy.MSVCRT(00000000,?,?), ref: 040D09B5
memcpy.MSVCRT(00000000,?,?), ref: 040D09C9

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction ID: 8dafb9e3d4d948578033cb75f56285bbe2727b54df2b953ffa3ae51b2918cc5e
Opcode Fuzzy Hash: d948a10c9f1e2417ed34ae8df7b8044f991836d94fef36a5c337458bb54a48b1
Instruction Fuzzy Hash: C05151B1600600EFDB14CF68D8C4A9677A9BF88318F088679ED0D9F396E731E954CB95

Function 040E8F84 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,040E9E89,?,?,?,?,?,00000000,00000000), ref: 040E8FF4
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00000000,040E9E89,?,?,?,?,?,00000000,00000000), ref: 040E9023
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00000000,040E9E89,?,?,?,?,?,00000000,00000000), ref: 040E902E
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,040E9E89,?,?,?,?,?,00000000,00000000), ref: 040E9034
VirtualFree.KERNEL32(?,?,00008000,?,?,?,?,00000000,040E9E89,?,?,?,?,?,00000000,00000000), ref: 040E9074

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Free$HeapVirtual$LibraryProcess
String ID:
API String ID: 565514093-0
Opcode ID: ce159912b8eb18b42996bb7fe61a8724e8d088c543f8a6fff7326915a470a972
Instruction ID: c187b10f50fe80461442d2510017eb91521c287b84c0f65b12fee7cb8b533e81
Opcode Fuzzy Hash: ce159912b8eb18b42996bb7fe61a8724e8d088c543f8a6fff7326915a470a972
Instruction Fuzzy Hash: 763181B9201604AFD760EE6ACC84F76B3E9FF44714F508669E954EB260C730FC2587A0

Function 040CC31C Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 040CC372
GetDeviceCaps.GDI32(00000000,0000000C), ref: 040CC387
GetDeviceCaps.GDI32(00000000,0000000E), ref: 040CC391
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,040CA7DB,00000000,040CA867), ref: 040CC3B5
ReleaseDC.USER32(00000000,00000000), ref: 040CC3C0

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction ID: 3e14e0bdac8ff758bc61c88f4bad30771e61695a6ff8d2bd67e86eff53e5dd48
Opcode Fuzzy Hash: c4a1b20b6082907148ca0743ca9c7e76063a1768cc102af30ff38a7623f7df5f
Instruction Fuzzy Hash: C811BE31205399EEFB71EF65EC407AE3AD4AF45315F041129F9087A280C7B8A9A09BE1

Function 040C619C Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 040C61B4
GetDeviceCaps.GDI32(?,00000068), ref: 040C61D0
GetPaletteEntries.GDI32(18080E31,00000000,00000008,?), ref: 040C61E8
GetPaletteEntries.GDI32(18080E31,00000008,00000008,?), ref: 040C6200
ReleaseDC.USER32(00000000,?), ref: 040C621C

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: c27480ec3f7980fecf3f00400c9627185b3049f5ccdfb353b098f8f4ce4e3db4
Instruction ID: 314fb20d9a56e646dc4478f0b3c7704df675bb60f6728eda7d428470b4b4d8fd
Opcode Fuzzy Hash: c27480ec3f7980fecf3f00400c9627185b3049f5ccdfb353b098f8f4ce4e3db4
Instruction Fuzzy Hash: 3211C839948308BEEB50DFA4DC45F6D7BA8EF49710F4084AAF604EE5C0DABBA404D760

Function 04003C28 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,04003D0B), ref: 04003CAE
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,04003D0B), ref: 04003CB4

Strings

, xrefs: 04003C7A
yyyy, xrefs: 04003C89

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 93b6272d8c3c28d53e3600a81d57d56bbb12ccbb2202c706b41336f240a684d4
Instruction ID: 050bded0e1aada631afc1c7ba604036ba902b08ce4a7cc684fbc652fa1ebaecf
Opcode Fuzzy Hash: 93b6272d8c3c28d53e3600a81d57d56bbb12ccbb2202c706b41336f240a684d4
Instruction Fuzzy Hash: 60217439A10618AFEB11EF58C845AAEB3F9EF49700F5180A6ED05FB290D734AF10C765

Function 040C3ED0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000000,00000000), ref: 040C3EF7
GetObjectW.GDI32(?,00000010,?), ref: 040C3F0A
GetObjectW.GDI32(?,00000000,?), ref: 040C3F63

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-0
Opcode ID: 04b0e0b7003dc0cadb6dfc8277b78ab1c686d8375e4406b8a652dcd602a944d5
Instruction ID: a81205612b619eb1c2bfee4e149a20a21e44995543b8a8dab4a81c854aadc6ac
Opcode Fuzzy Hash: 04b0e0b7003dc0cadb6dfc8277b78ab1c686d8375e4406b8a652dcd602a944d5
Instruction Fuzzy Hash: 9A319E75614748EFD720DF69CC80DAEBBF9EF49610B14C86EED58EB651D230E8009B20

Function 03FEC998 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 03FEC9A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 03FECA07
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 03FECA64
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 03FECA97

Part of subcall function 03FEC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,03FECA15), ref: 03FEC96B
Part of subcall function 03FEC954: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,03FECA15), ref: 03FEC988

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: e33a0f0e08f8726e89c4da39d18aa25d33a6c6aef55bf570cf8622f5de0f1031
Instruction ID: 60fe81e89dd427f348290f91391d3d1916c317f62f808966f84f09ce3456b24e
Opcode Fuzzy Hash: e33a0f0e08f8726e89c4da39d18aa25d33a6c6aef55bf570cf8622f5de0f1031
Instruction Fuzzy Hash: CE313A74E0021B9BDB10DFA8C894AEEB7B9FF44304F044175E565EB290EB789A05CB91

Function 040CA788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 040C4778: EnterCriticalSection.KERNEL32(040FDE34,?,040C4858,?,?,?,?,?,?,?,?,00000000,040C4870,?,040FDE34), ref: 040C4780
Part of subcall function 040C4778: LeaveCriticalSection.KERNEL32(040FDE34,040FDE34,?,040C4858,?,?,?,?,?,?,?,?,00000000,040C4870,?,040FDE34), ref: 040C478D
Part of subcall function 040C4778: EnterCriticalSection.KERNEL32(?,040FDE34,040FDE34,?,040C4858,?,?,?,?,?,?,?,?,00000000,040C4870), ref: 040C4796

Part of subcall function 040CC31C: GetDC.USER32(00000000), ref: 040CC372
Part of subcall function 040CC31C: GetDeviceCaps.GDI32(00000000,0000000C), ref: 040CC387
Part of subcall function 040CC31C: GetDeviceCaps.GDI32(00000000,0000000E), ref: 040CC391
Part of subcall function 040CC31C: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,040CA7DB,00000000,040CA867), ref: 040CC3B5
Part of subcall function 040CC31C: ReleaseDC.USER32(00000000,00000000), ref: 040CC3C0

CreateCompatibleDC.GDI32(00000000), ref: 040CA7DD
SelectObject.GDI32(00000000,?), ref: 040CA7F6
SelectPalette.GDI32(00000000,?,000000FF), ref: 040CA81F
RealizePalette.GDI32(00000000), ref: 040CA82B

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 31a41b770fc1dc29f0373a9d246677e5d8cf0a8cb8d5c69d9587c833b93ab912
Instruction ID: d04fdc7ca38516847e3af290eb615a42ac3e7b6f4c02c08a8869602b4521aa71
Opcode Fuzzy Hash: 31a41b770fc1dc29f0373a9d246677e5d8cf0a8cb8d5c69d9587c833b93ab912
Instruction Fuzzy Hash: 63310338B00648EFE704EB69D980E8DB3F5EF48614B6241A9E804AB321D730FE85DF50

Function 040CDF8C Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 040CDFAD
GetObjectW.GDI32(?,00000018,?), ref: 040CDFCE
DeleteObject.GDI32(?), ref: 040CDFFA
DeleteObject.GDI32(?), ref: 040CE003

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 6ba76c0968e627873919a43a14f7844edcc0b99a35a4a037b1626e7c6d7d7e1b
Instruction ID: b679cdd6d162faad358cb505ecca9e56195d0294102cff228c1fe11e1b3b7f64
Opcode Fuzzy Hash: 6ba76c0968e627873919a43a14f7844edcc0b99a35a4a037b1626e7c6d7d7e1b
Instruction Fuzzy Hash: CB112179B00208EFDB04DFA9D981D9EB7F9EF48310B5484A9AD04EB750DB30ED41DA90

Function 0408A910 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00000000,?,0408A7FE,00000000,?), ref: 0408A927
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,0408A7FE,00000000,?), ref: 0408A941
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,0408A7FE,00000000,?), ref: 0408A95B
LockResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,0408A7FE,00000000), ref: 0408A965

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction ID: 862f32010a8d7b9b97eb8aed6601bf7849ec5574261d0d674f8399daf0a6e4f6
Opcode Fuzzy Hash: fc04eeb3631007fa40f9e630dbcfa29d272b4c52aaff94a3e4b6f83a4223a638
Instruction Fuzzy Hash: 79F069BA6052047F5745FEACAD80D6B77ECEE89164320012BFE48EB305DA34ED014B78

Function 040CEDD0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 040CEDD9
SelectObject.GDI32(00000000,058A00B4), ref: 040CEDEB
GetTextMetricsW.GDI32(00000000), ref: 040CEDF6
ReleaseDC.USER32(00000000,00000000), ref: 040CEE07

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: e099e3ba84493ff61b04322a4e6b617eb52cbeeeafc1912ce86e5070df6e3aac
Instruction ID: 59e55ed2665cf1b26dad0190757e55580146931ab18931b345c2ffe120f85a4a
Opcode Fuzzy Hash: e099e3ba84493ff61b04322a4e6b617eb52cbeeeafc1912ce86e5070df6e3aac
Instruction Fuzzy Hash: 90E0261A6023B07AD691B2748D85BDF368CCF022E5F080126FE00AD2E0DA49CD0093F3

Function 040CEBA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

SetDIBits.GDI32(00000000,00000000), ref: 040CECF4

Strings

,, xrefs: 040CEC6A
, xrefs: 040CEC8B

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: 0a81d547d131dd5b5ed2722e7515b1ad85ccb5a435e3a362be740ac8aa4dd077
Instruction ID: 9ef185f5bb8cbd433fb1c4b838328fedb040c2fca3a77ba1948c3517f26b769a
Opcode Fuzzy Hash: 0a81d547d131dd5b5ed2722e7515b1ad85ccb5a435e3a362be740ac8aa4dd077
Instruction Fuzzy Hash: FE51DC78A10208EFDB40DFA9D880E9EB7F9FB48314F5181A5E914EB361D735AE04CB60

Function 040CE3C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

GetDIBits.GDI32(00000000,00000000,00000000,?,?,0000002C,00000000), ref: 040CE4B2

Strings

,, xrefs: 040CE468
, xrefs: 040CE483

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Bits
String ID: $,
API String ID: 3573556081-71045815
Opcode ID: df3b0f7526de2a617b0095068f39f6ada969dd3e0305b9fd776227a31e930610
Instruction ID: 70b94ba04c57128bb23dded119176d8d71463da04a3bebd50aa22930e48aa59b
Opcode Fuzzy Hash: df3b0f7526de2a617b0095068f39f6ada969dd3e0305b9fd776227a31e930610
Instruction Fuzzy Hash: 694143B5A10208EFDB40DF68C884A9E77F9FF49314B6201A5EC08EB216D6B5FD44CB90

Function 040E9FB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 040EA001
VirtualProtect.KERNEL32(?,?,?,?,?), ref: 040EA086

Strings

FinalizeSections: VirtualProtect failed, xrefs: 040EA094

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: FinalizeSections: VirtualProtect failed
API String ID: 2581862158-3584865983
Opcode ID: 246e8a6269e33d5ec3250ec7e42411177cdc8fd378fb65e496f1c9316dbf5c20
Instruction ID: 8a9bd4739313a4ca50bca88374bb0e17e4e77a9a332e3000f96454cb2a9684e4
Opcode Fuzzy Hash: 246e8a6269e33d5ec3250ec7e42411177cdc8fd378fb65e496f1c9316dbf5c20
Instruction Fuzzy Hash: 043104757013059FE760DF5AC984FAAB7E8AF4C754F158180EA14EB3A1D330F9649B90

Function 04008748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000,0400BB77,00000000,0400BCB7), ref: 04008707

Strings

Z, xrefs: 04008763
A, xrefs: 0400875E

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: CharUpper
String ID: A$Z
API String ID: 9403516-4098844585
Opcode ID: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction ID: b123731b6728a7efa4a962a082a936001129ee0d92a6e79dcba6ce8fca8a98d3
Opcode Fuzzy Hash: 0853d31e4c62cbf45948dc29de724639dcf269313cc23831c9dadc14004e3c7b
Instruction Fuzzy Hash: A21159177457101BF720B43F6C84BFAA5CAEB86260F4AC23AE509DB2C4E848EC015295

Function 040C9928 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetEnhMetaFileBits.GDI32(0000006C,?,00000000,040C99F3), ref: 040C99AB

Strings

EMF, xrefs: 040C994B
l, xrefs: 040C9959

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: BitsFileMeta
String ID: EMF$l
API String ID: 858000408-2398670571
Opcode ID: 14aa57fd673dea7f608491273dbabadea2569087a8afe3f5661638691b07a832
Instruction ID: 04abc5f0c97d86becf88a1ec5e81cba3a569d04d6d97a7f300bb3a2ce9218906
Opcode Fuzzy Hash: 14aa57fd673dea7f608491273dbabadea2569087a8afe3f5661638691b07a832
Instruction Fuzzy Hash: 31213875A00218DFDB50EFADC890AAEB7F5FF88714B554668E404AB244DB34AD018B55

Function 040089EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,040EE4DB,00000000,040EE512), ref: 040089F2

Part of subcall function 03FF39B0: GetProcAddress.KERNEL32(0401C998,?), ref: 03FF39DA

Strings

kernel32.dll, xrefs: 040089ED
GetDiskFreeSpaceExW, xrefs: 040089FD

Memory Dump Source

Source File: 00000020.00000002.2282345336.0000000003FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 03FE0000, based on PE: true

Associated: 00000020.00000002.2282302475.0000000003FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282519102.00000000040EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282567406.00000000040F0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282610254.00000000040F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282650845.00000000040F5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282747254.00000000040F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282789197.00000000040FF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282867391.0000000004100000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2282907342.0000000004101000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004102000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000020.00000002.2283029099.0000000004104000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3fe0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a07008e40cc03c015be6d3e386ac189cd6ea53cb28b36ffef4e001200f9db894
Instruction ID: 0018d27d1f24b8077a736b0107d854a142308576662ccf49ef1d954558e473ef
Opcode Fuzzy Hash: a07008e40cc03c015be6d3e386ac189cd6ea53cb28b36ffef4e001200f9db894
Instruction Fuzzy Hash: 26D05E766007476FF760BEA668807223285FF81A09F00D136A3017DB82C7FDB8104A40

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nPSsgqs7aI.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4fe5a735f3c962f33a38b504d643f44a7c78b75_7522e4b5_06ff90e2-e6f0-44ef-b625-a2f7a4cbee48\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_4fe5a735f3c962f33a38b504d643f44a7c78b75_7522e4b5_2763e2eb-1d33-43a1-bd9d-45aa672f8944\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_59fcf98f4ce235a4ae89e5da4a4e624a8715c64d_7522e4b5_4c337851-2bf0-4da8-aaf0-4358efc93e59\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER100F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3642.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37A9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3902.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3980.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39AE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39EE.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF22.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC0.tmp.WERInternalMetadata.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
nPSsgqs7aI.dll