Edit tour

Windows Analysis Report
Proxy32.exe

Overview

General Information

Sample name:	Proxy32.exe
Analysis ID:	1545401
MD5:	bc50255ce73b64580fcc217e2a3b699a
SHA1:	00431c708367a2125ffe6599c5e9a8b47c8ad259
SHA256:	5704b15d5a1bc9c2f8b3351169362440bcb6901984050f3bb3824437fca13c68
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Proxy32.exe (PID: 6708 cmdline: "C:\Users\user\Desktop\Proxy32.exe" MD5: BC50255CE73B64580FCC217E2A3B699A)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Proxy32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Proxy32.exe

Static PE information: certificate valid

Source: Proxy32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: c:\Program Files\Tyler Technologies\IMS\Proxy32.pdb source: Proxy32.exe

Source: Proxy32.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Proxy32.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: Proxy32.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Proxy32.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Proxy32.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_005165BD

0_2_005165BD

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: String function: 00516B84 appears 36 times

Source: Proxy32.exe, 00000000.00000000.1722601783.0000000000526000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameProxy.exe@ vs Proxy32.exe
Source: Proxy32.exe	Binary or memory string: OriginalFilenameProxy.exe@ vs Proxy32.exe

Source: Proxy32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean5.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_005131E0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,GetLastError,

0_2_005131E0

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_00512D40 SleepEx,CreateToolhelp32Snapshot,_memset,Process32FirstW,__wcsicoll,OpenProcess,GetProcessImageFileNameW,__wcsicoll,__wcsicoll,_memset,CloseHandle,GetLastError,Process32NextW,GetLastError,CloseHandle,GetLastError,

0_2_00512D40

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_005121B0 CoInitializeEx,_memset,_memset,CoCreateInstance,VariantInit,VariantChangeType,VariantClear,__wcsicoll,SysAllocStringLen,OpenProcess,WaitForSingleObject,_fwprintf,_fwprintf,CloseHandle,SysFreeString,CoUninitialize,_fwprintf,CoUninitialize,CoUninitialize,CoUninitialize,

0_2_005121B0

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_00513520 OpenSCManagerW,OpenServiceW,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,GetLastError,ChangeServiceConfigW,GetLastError,CloseServiceHandle,

0_2_00513520

Source: Proxy32.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Proxy32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proxy32.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Proxy32.exe

Static PE information: certificate valid

Source: Proxy32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Proxy32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Proxy32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Proxy32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Proxy32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Proxy32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Proxy32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Proxy32.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: c:\Program Files\Tyler Technologies\IMS\Proxy32.pdb source: Proxy32.exe

Source: Proxy32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Proxy32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Proxy32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Proxy32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Proxy32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_0051B906 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_0051B906

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_00516BC9 push ecx; ret

0_2_00516BDC

Source: C:\Users\user\Desktop\Proxy32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-6792

Source: C:\Users\user\Desktop\Proxy32.exe

API coverage: 4.9 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_00515D07 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00515D07

Source: C:\Users\user\Desktop\Proxy32.exe

0_2_0051B906

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Proxy32.exe	Code function: 0_2_00515D07 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00515D07
Source: C:\Users\user\Desktop\Proxy32.exe	Code function: 0_2_0051376A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0051376A
Source: C:\Users\user\Desktop\Proxy32.exe	Code function: 0_2_0051C7FA __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0051C7FA
Source: C:\Users\user\Desktop\Proxy32.exe	Code function: 0_2_005187E0 SetUnhandledExceptionFilter,	0_2_005187E0

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: GetLocaleInfoA,

0_2_0051BE58

Source: C:\Users\user\Desktop\Proxy32.exe

Code function: 0_2_00518EE7 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00518EE7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Service Execution	1 Windows Service	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Proxy32.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.thawte.com/ThawteTimestampingCA.crl0	Proxy32.exe	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	Proxy32.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545401
Start date and time:	2024-10-30 14:15:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Proxy32.exe
Detection:	CLEAN
Classification:	clean5.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 4 Number of non-executed functions: 38
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: Proxy32.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.38494088131935
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Proxy32.exe
File size:	110'936 bytes
MD5:	bc50255ce73b64580fcc217e2a3b699a
SHA1:	00431c708367a2125ffe6599c5e9a8b47c8ad259
SHA256:	5704b15d5a1bc9c2f8b3351169362440bcb6901984050f3bb3824437fca13c68
SHA512:	1961d7be310d5ca3b211fd39cf5bf38b59034539a152b159187b4c6bce9cae3e418136aafe4bef6f715d3a3dfdbeba48182437d0579a20ec084139c27a117491
SSDEEP:	1536:u+EtJVSmgHZ21K2RpLEcynltmHQTQDP7XYxKTUtmPefrN+9PmmldKm7D:VEfVqHnA2YPP2rN+9PmaZ
TLSH:	4BB35A523AA3C036E4D155352639C369497EFD301B7B8187BBB536A88F317D06A3A387
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O,...B...B...B..V....B..V....B..V....B..V....B...C.%.B..V....B..V....B..V....B.Rich..B.........................PE..L....p6Q...

File Icon


Icon Hash:	a4a1b2ecccb1d949

Static PE Info

General

Entrypoint:	0x4045f8
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x513670D1 [Tue Mar 5 22:25:21 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	4aeae02a7f713e6abcac67d29009552a

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	05/08/2013 20:00:00 04/10/2016 19:59:59
Subject Chain	CN="Tyler Technologies, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Tyler Technologies, Inc.", L=Yarmouth, S=Maine, C=US
Version:	3
Thumbprint MD5:	70820E618A6D44FADD9BFA80C0B4AD30
Thumbprint SHA-1:	E34C0C279C3E3E3E9025F80C12AF9829A9E4FBA6
Thumbprint SHA-256:	4623C8978CDCD49E8AB009AB6148DDDCFCBFFC8FFFB11735E95EDDF769C42835
Serial:	24F9494087F23985AA286786D99E1BE7

Entrypoint Preview

Instruction
call 00007F132CAE02AFh
jmp 00007F132CADB83Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00414168h], eax
mov dword ptr [00414164h], ecx
mov dword ptr [00414160h], edx
mov dword ptr [0041415Ch], ebx
mov dword ptr [00414158h], esi
mov dword ptr [00414154h], edi
mov word ptr [00414180h], ss
mov word ptr [00414174h], cs
mov word ptr [00414150h], ds
mov word ptr [0041414Ch], es
mov word ptr [00414148h], fs
mov word ptr [00414144h], gs
pushfd
pop dword ptr [00414178h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0041416Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00414170h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0041417Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [004140B8h], 00010001h
mov eax, dword ptr [00414170h]
mov dword ptr [0041406Ch], eax
mov dword ptr [00414060h], C0000409h
mov dword ptr [00414064h], 00000001h
mov eax, dword ptr [004132DCh]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [004132E0h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000C4h]

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12534	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x51f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x19800	0x1958	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xcec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf200	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x11ad8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x1bc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd4e2	0xd600	9db56fbfaa11b260ab95f2641dfe4df0	False	0.5955023364485982	data	6.572822853592671	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x3ea0	0x4000	b6d323cf082843e7dc3851d4486eb805	False	0.340576171875	OpenPGP Public Key	5.106172179546469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x13000	0x2c64	0x1200	33422bcd39ad9490dd5e331bd47ec4be	False	0.21809895833333334	data	2.363823419442222	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16000	0x51f8	0x5200	90026650824a4ee905c26f1b1dfec320	False	0.20922256097560976	data	5.535892602599179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0x18f6	0x1a00	4be560d790d986635b8733f34680fa0e	False	0.42142427884615385	data	4.176408916442644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x16898	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.4698581560283688
RT_ICON	0x16d00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.16701244813278007
RT_ICON	0x192a8	0x1588	Device independent bitmap graphic, 36 x 72 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.21734397677793904
RT_ICON	0x1a830	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.3233606557377049
RT_GROUP_ICON	0x1b1b8	0x3e	data	English	United States	0.8225806451612904
RT_VERSION	0x16180	0x714	data	English	United States	0.36037527593818985

Imports

DLL	Import
PSAPI.DLL	GetProcessImageFileNameW
KERNEL32.dll	GetTickCount, CloseHandle, CreateToolhelp32Snapshot, Process32NextW, QueryDosDeviceW, Process32FirstW, TerminateProcess, TerminateThread, GetSystemDirectoryW, OpenProcess, SleepEx, WaitForSingleObject, GetCurrentProcess, GetProcAddress, GetLastError, LoadLibraryW, FreeLibrary, GetCommandLineW, SetUnhandledExceptionFilter, CreateFileA, SetStdHandle, SetFilePointer, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, FlushFileBuffers, GetConsoleMode, GetConsoleCP, LoadLibraryA, HeapFree, EnterCriticalSection, LeaveCriticalSection, ExitThread, GetCurrentThreadId, CreateThread, GetCommandLineA, GetStartupInfoA, UnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, RaiseException, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapCreate, VirtualFree, DeleteCriticalSection, VirtualAlloc, HeapReAlloc, SetHandleCount, GetStdHandle, GetFileType, Sleep, ExitProcess, WriteFile, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, HeapSize, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, InitializeCriticalSectionAndSpinCount
ADVAPI32.dll	QueryServiceConfigW, ControlService, QueryServiceStatusEx, ChangeServiceConfigW, OpenServiceW, OpenSCManagerW, CloseServiceHandle, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken
ole32.dll	CoUninitialize, CoInitializeEx, CoCreateInstance
OLEAUT32.dll	SysFreeString, VariantChangeType, SysAllocStringLen, VariantInit, VariantClear, SysStringLen, SysAllocString, RegisterTypeLib, UnRegisterTypeLib, LoadTypeLibEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	09:16:50
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\Proxy32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Proxy32.exe"
Imagebase:	0x510000
File size:	110'936 bytes
MD5 hash:	BC50255CE73B64580FCC217E2A3B699A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	1328
Total number of Limit Nodes:	14

Executed Functions

Function 00511000 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00511005
CoUninitialize.COMBASE ref: 00511044

Part of subcall function 005119C0: __wcsicoll.LIBCMT ref: 00511A29

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: InitializeUninitialize__wcsicoll
String ID:
API String ID: 1787031911-0
Opcode ID: bb80aa54e44f9a8bcf7376492dea728472255d4cda8daa97d9d55d8c9de3d6d3
Instruction ID: 7e681820796eaa2eef8b80067f74c9cd782e6da4f2c3a6a12265814c1f630608
Opcode Fuzzy Hash: bb80aa54e44f9a8bcf7376492dea728472255d4cda8daa97d9d55d8c9de3d6d3
Instruction Fuzzy Hash: F5F02036600A0197E2219728CC4DFCB7BA0AFE5B60F158A64FA55CB290DB39CC82C7D4

Function 00517FA5 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00517FAD

Part of subcall function 00517F7A: GetModuleHandleW.KERNEL32(mscoree.dll,?,00517FB2,0051385E,?,00515FFB,000000FF,0000001E,00522040,0000000C,005160A7,0051385E,?,?,0051A546,00000004), ref: 00517F84
Part of subcall function 00517F7A: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00517F94

ExitProcess.KERNEL32 ref: 00517FB6

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 8d8b66113266a8b76caa3c95bed312d2bac995e4320b226a36c273bd8dfe081e
Instruction ID: e6ae355b77a901cfc496742292e607a99c1cc2610c121b0723017218088aaf14
Opcode Fuzzy Hash: 8d8b66113266a8b76caa3c95bed312d2bac995e4320b226a36c273bd8dfe081e
Instruction Fuzzy Hash: CDB09B3104410DFBDB113F55DC0D88D3F75FB843507114020F40805031DF71AD96D680

Function 00515EE0 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00515EF5

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7e84c3561400d35c274891c0a71a174238325e35631e424051fd3337794a2917
Instruction ID: f29427436eef876c9773d1fef1ae50f0c6a220af3479e4f0d8249a3d83d8ad49
Opcode Fuzzy Hash: 7e84c3561400d35c274891c0a71a174238325e35631e424051fd3337794a2917
Instruction Fuzzy Hash: 69D0A776694308AEEB209F74BC487A23FDCEBA83A5F148436F80CC6150F570C981EA00

Function 005181C1 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 005181CD

Part of subcall function 00518095: __lock.LIBCMT ref: 005180A3
Part of subcall function 00518095: __decode_pointer.LIBCMT ref: 005180DA
Part of subcall function 00518095: __decode_pointer.LIBCMT ref: 005180EF
Part of subcall function 00518095: __decode_pointer.LIBCMT ref: 00518119
Part of subcall function 00518095: __decode_pointer.LIBCMT ref: 0051812F
Part of subcall function 00518095: __decode_pointer.LIBCMT ref: 0051813C
Part of subcall function 00518095: __initterm.LIBCMT ref: 0051816B
Part of subcall function 00518095: __initterm.LIBCMT ref: 0051817B

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 78bf6ab0b0ffa5dd677a88b02ae5e8590df2a6e50a54cbce0ef93208f6758aeb
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: B8B0923298020C33EA2025A2AC0BF563E0997C0BA0F240020BA1C1D1E1A9A3A9A58089

Non-executed Functions

Function 005121B0 Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 317
comsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 005121C4
_memset.LIBCMT ref: 005121E7
_memset.LIBCMT ref: 005121FE
CoCreateInstance.OLE32(0051F24C,00000000,00000001,0051F21C,?), ref: 00512236
CoUninitialize.OLE32 ref: 00512541

Part of subcall function 00512680: SysAllocString.OLEAUT32(ApplicationInstances), ref: 005126A2
Part of subcall function 00512680: SysFreeString.OLEAUT32(00000000), ref: 005126FA

VariantInit.OLEAUT32(?), ref: 00512323
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 0051234A
VariantClear.OLEAUT32(00000008), ref: 00512359
__wcsicoll.LIBCMT ref: 00512377
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00512409
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 0051242C
_fwprintf.LIBCMT ref: 00512445
_fwprintf.LIBCMT ref: 00512460
CloseHandle.KERNEL32(00000000), ref: 00512469
SysFreeString.OLEAUT32(00000000), ref: 0051247B
CoUninitialize.OLE32 ref: 005124B8
_fwprintf.LIBCMT ref: 005124DC
CoUninitialize.OLE32 ref: 0051250B
CoUninitialize.OLE32 ref: 0051252C

Strings

No COM+ application with the name '%s' was found. The shut down request was ignored., xrefs: 005124CE
ApplicationInstances, xrefs: 0051226A
`<u, xrefs: 0051247B
The '%s' application was successfully shut down., xrefs: 00512437
Pou, xrefs: 00512236
The '%s' COM+ application was sent a shut down request, but the application process did not exit within %lu seconds., xrefs: 00512452
Applications, xrefs: 0051224C
System Application, xrefs: 00512371

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Uninitialize$StringVariant_fwprintf$Free_memset$AllocChangeClearCloseCreateHandleInitInitializeInstanceObjectOpenProcessSingleTypeWait__wcsicoll
String ID: ApplicationInstances$Applications$No COM+ application with the name '%s' was found. The shut down request was ignored.$Pou$System Application$The '%s' COM+ application was sent a shut down request, but the application process did not exit within %lu seconds.$The '%s' application was successfully shut down.$`<u
API String ID: 1832995712-4221045137
Opcode ID: dcf5ac9a1e8db5fadbeb9a906b58223bccd5b4469c24fd2e3aa4749e9272e882
Instruction ID: cb75bb197671e6fadce579ec925262d1deb08833c43e8d6ba6688a39d406811a
Opcode Fuzzy Hash: dcf5ac9a1e8db5fadbeb9a906b58223bccd5b4469c24fd2e3aa4749e9272e882
Instruction Fuzzy Hash: EFB19D756043019FE700EF64D888E9BBBE8FFD8340F148928F949C7251D674E999CBA2

Function 00512D40 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 196
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005131E0: GetCurrentProcess.KERNEL32(00000028,DC2A8B03,?,?,?,00512D7E,74DF30A0,00000000,?), ref: 005131E9
Part of subcall function 005131E0: OpenProcessToken.ADVAPI32(00000000,?,?,?,00512D7E,74DF30A0,00000000,?), ref: 005131F0
Part of subcall function 005131E0: LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0051320B
Part of subcall function 005131E0: AdjustTokenPrivileges.ADVAPI32 ref: 00513247
Part of subcall function 005131E0: CloseHandle.KERNEL32(00000000), ref: 00513258

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,74DF30A0,00000000,?), ref: 00512D81
GetLastError.KERNEL32(00000002,00000000,74DF30A0,00000000,?), ref: 00512F73

Part of subcall function 00512FC0: _memset.LIBCMT ref: 00512FF1
Part of subcall function 00512FC0: LoadLibraryW.KERNEL32(KERNEL32.DLL,00000000,00000000,?), ref: 00513009
Part of subcall function 00512FC0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0051301F
Part of subcall function 00512FC0: FreeLibrary.KERNEL32(00000000), ref: 0051303B
Part of subcall function 00512FC0: __wsplitpath_s.LIBCMT ref: 005130A4
Part of subcall function 00512FC0: _memset.LIBCMT ref: 005130BB
Part of subcall function 00512FC0: QueryDosDeviceW.KERNEL32(?,?,00000105), ref: 005130D5

Part of subcall function 00512FC0: GetSystemDirectoryW.KERNEL32(?,00000208), ref: 00513050

_memset.LIBCMT ref: 00512DB5
Process32FirstW.KERNEL32 ref: 00512DCB
__wcsicoll.LIBCMT ref: 00512DEA
OpenProcess.KERNEL32(00000400,00000000,?,00000000,?,00000002,00000000,74DF30A0,00000000,?), ref: 00512E06
GetProcessImageFileNameW.PSAPI(00000000,?,00000104), ref: 00512E28
__wcsicoll.LIBCMT ref: 00512E46
__wcsicoll.LIBCMT ref: 00512E67
_memset.LIBCMT ref: 00512EC7
CloseHandle.KERNEL32(00000000,00000000,?,00000104), ref: 00512EE5
GetLastError.KERNEL32 ref: 00512EED
Process32NextW.KERNEL32(?,?), ref: 00512F0F
GetLastError.KERNEL32(00000000,?,00000002,00000000,74DF30A0,00000000,?), ref: 00512F1C
CloseHandle.KERNEL32(00000000,00000000,?,00000002,00000000,74DF30A0,00000000,?), ref: 00512F51

Strings

dllhost.exe, xrefs: 00512DE4

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Process_memset$CloseErrorHandleLast__wcsicoll$LibraryOpenProcess32Token$AddressAdjustCreateCurrentDeviceDirectoryFileFirstFreeImageLoadLookupNameNextPrivilegePrivilegesProcQuerySnapshotSystemToolhelp32Value__wsplitpath_s
String ID: dllhost.exe
API String ID: 3212909537-3520973717
Opcode ID: a9c1fbaccddfb1dc9766954f9117fd88bf2c8fc698b7bb5b9418a7024cf8caeb
Instruction ID: 0e1fcb1e3c7f492230bb01df94597a02bc80a4ab86342df0f72f1cb3e145aa41
Opcode Fuzzy Hash: a9c1fbaccddfb1dc9766954f9117fd88bf2c8fc698b7bb5b9418a7024cf8caeb
Instruction Fuzzy Hash: CF518FB16042019BE724EB24CC5ABFF7BE8BFC4740F04492DF549C6281EB34DA958B96

Function 00513520 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,80000001,?,?,00000000,?,?,00511FCD,00000004), ref: 00513531
OpenServiceW.ADVAPI32(00000000,COMSysApp,00000002,?,00000000,?,?,00511FCD,00000004), ref: 00513545
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FCD,00000004), ref: 0051355A
GetLastError.KERNEL32(?,00000000,?,?,00511FCD,00000004), ref: 00513562
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FCD,00000004), ref: 00513567
GetLastError.KERNEL32(?,00000000,?,?,00511FCD,00000004), ref: 00513575
ChangeServiceConfigW.ADVAPI32(00511FCD,000000FF,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00511FCD), ref: 00513597
GetLastError.KERNEL32(?,00000000,?,?,00511FCD,00000004), ref: 005135A1
CloseServiceHandle.ADVAPI32(00511FCD), ref: 005135B0

Strings

ServicesActive, xrefs: 0051352A
COMSysApp, xrefs: 0051353F

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Service$CloseErrorHandleLast$Open$ChangeConfigManager
String ID: COMSysApp$ServicesActive
API String ID: 71225020-884190028
Opcode ID: d64ad0f50d6cacec79397270fd0368de69eb866fd183f0cd20236ce4c480f3e6
Instruction ID: c0c7b5824a53cba13d600522cd73fc4dbd6a042608fa9e545c5a9047a0f3f8d9
Opcode Fuzzy Hash: d64ad0f50d6cacec79397270fd0368de69eb866fd183f0cd20236ce4c480f3e6
Instruction Fuzzy Hash: 8501DB7160431167E3205729AC4DEA77F99FB56B71F124634F927D22D1DB50CE446260

Function 005131E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,DC2A8B03,?,?,?,00512D7E,74DF30A0,00000000,?), ref: 005131E9
OpenProcessToken.ADVAPI32(00000000,?,?,?,00512D7E,74DF30A0,00000000,?), ref: 005131F0
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0051320B
AdjustTokenPrivileges.ADVAPI32 ref: 00513247
CloseHandle.KERNEL32(00000000), ref: 00513258
GetLastError.KERNEL32(?,?,?,00512D7E,74DF30A0,00000000,?), ref: 00513265
CloseHandle.KERNEL32(?,?,?,?,00512D7E,74DF30A0,00000000,?), ref: 00513280
GetLastError.KERNEL32(?,?,?,00512D7E,74DF30A0,00000000,?), ref: 0051328D

Strings

SeDebugPrivilege, xrefs: 00513204

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: CloseErrorHandleLastProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3403152165-2896544425
Opcode ID: 54e0903bbd1cd0120bed7ea8c0be033c4cc5783e1ccd8fe70f7d299ac0fee734
Instruction ID: 75bfdd9e5aa9a0c7f56c267d2248704d9b2d399d2db5c171eb0c5ab3637f81b1
Opcode Fuzzy Hash: 54e0903bbd1cd0120bed7ea8c0be033c4cc5783e1ccd8fe70f7d299ac0fee734
Instruction Fuzzy Hash: 55118675704301AFE310EF58DC4DBAB7BE8BF58B40F508528F549C2191E778D9089762

Function 0051376A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 005146BD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005146D2
UnhandledExceptionFilter.KERNEL32(`@R), ref: 005146DD
GetCurrentProcess.KERNEL32(C0000409), ref: 005146F9
TerminateProcess.KERNEL32(00000000), ref: 00514700

Strings

`@R, xrefs: 005146D8

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: `@R
API String ID: 2579439406-3263852015
Opcode ID: e26b13abeb6950f8dd9219b98b21ed3b9edc2d2487004cc27ada735c777a035a
Instruction ID: c9178e141ca4b4b681ddef37f05286451c025e2d56d4964205946d66e8eaec18
Opcode Fuzzy Hash: e26b13abeb6950f8dd9219b98b21ed3b9edc2d2487004cc27ada735c777a035a
Instruction Fuzzy Hash: E321DFB8900244DFE720DF65F8496843BA0BF7A304F41412AE60987371E7B499DAEF15

Function 005187E0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000879E), ref: 005187E5

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 316409ba89c301580aa65e38df57272520944770324d33b2d8daee929e7ad405
Instruction ID: ec9739b0553709f55a60c70044f553401c6bf3257378f4ca5e7f283d90d10699
Opcode Fuzzy Hash: 316409ba89c301580aa65e38df57272520944770324d33b2d8daee929e7ad405
Instruction Fuzzy Hash: FE9002696511009696202B706D0D5993A90BB6C6127524AA06252C4095DE914044A611

Function 00511FA0 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 168
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00513350: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,80000001,?,?,00000000,?,?,00511FB5,?), ref: 00513361
Part of subcall function 00513350: OpenServiceW.ADVAPI32(00000000,COMSysApp,00000001,?,?,00000000,?,?,00511FB5,?), ref: 00513375
Part of subcall function 00513350: CloseServiceHandle.ADVAPI32(00000000,?,?,00000000,?,?,00511FB5,?), ref: 0051338A
Part of subcall function 00513350: QueryServiceConfigW.ADVAPI32(00511FB5,00000000,00000000,00511FB5,?,?,00000000,?,?,00511FB5,?), ref: 005133C1
Part of subcall function 00513350: GetLastError.KERNEL32(?,?,00000000,?,?,00511FB5,?), ref: 005133C7
Part of subcall function 00513350: QueryServiceConfigW.ADVAPI32(00511FB5,00000000,?,?), ref: 005133F3
Part of subcall function 00513350: CloseServiceHandle.ADVAPI32(00511FB5), ref: 00513400

_fwprintf.LIBCMT ref: 00512191

Part of subcall function 00513520: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,80000001,?,?,00000000,?,?,00511FCD,00000004), ref: 00513531
Part of subcall function 00513520: OpenServiceW.ADVAPI32(00000000,COMSysApp,00000002,?,00000000,?,?,00511FCD,00000004), ref: 00513545
Part of subcall function 00513520: CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FCD,00000004), ref: 0051355A
Part of subcall function 00513520: ChangeServiceConfigW.ADVAPI32(00511FCD,000000FF,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00511FCD), ref: 00513597
Part of subcall function 00513520: GetLastError.KERNEL32(?,00000000,?,?,00511FCD,00000004), ref: 005135A1
Part of subcall function 00513520: CloseServiceHandle.ADVAPI32(00511FCD), ref: 005135B0

Part of subcall function 00513450: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,80000001,?,?,00000000,?,?,00511FD9), ref: 00513463
Part of subcall function 00513450: OpenServiceW.ADVAPI32(00000000,COMSysApp,00000004,?,00000000,?,?,00511FD9), ref: 00513477
Part of subcall function 00513450: CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FD9), ref: 00513486
Part of subcall function 00513450: QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,00000000,?,00000000,?,?,00511FD9), ref: 005134D9
Part of subcall function 00513450: CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FD9), ref: 005134E6

OpenProcess.KERNEL32(00100001,00000000,?), ref: 00512004
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 00512025
_fwprintf.LIBCMT ref: 00512039
TerminateProcess.KERNEL32(00000000,000000FF), ref: 00512046
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00512052
_fwprintf.LIBCMT ref: 00512064
_fwprintf.LIBCMT ref: 0051207C
CloseHandle.KERNEL32(00000000), ref: 00512085
OpenProcess.KERNEL32(00100001,00000000,?), ref: 005120CC
TerminateProcess.KERNEL32(00000000,000000FF), ref: 005120DB
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 005120E7
_fwprintf.LIBCMT ref: 00512100
CloseHandle.KERNEL32(00000000), ref: 00512109
_fwprintf.LIBCMT ref: 00512122
CloseHandle.KERNEL32(00000000), ref: 0051212B
_fwprintf.LIBCMT ref: 00512142

Strings

The service process was terminated but did not exit within %lu seconds., xrefs: 0051206E
The COM+ system service was sent a shut down request, but the service process did not exit within %lu seconds., xrefs: 00512056
A handle to DLLHOST process ID %lu could not be obtained to request process termination., xrefs: 00512134
DLLHOST process ID %lu was terminated but did not exit within %lu seconds., xrefs: 00512114
The COM+ system application (%s) service configuration could not be retrieved., xrefs: 00512183
The COM+ system service was stopped., xrefs: 0051202B
DLLHOST process ID %lu was terminated., xrefs: 005120F2
COMSysApp, xrefs: 0051217E

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Service$CloseHandle$Open$_fwprintf$Process$ConfigManagerObjectQuerySingleWait$ErrorLastTerminate$ChangeStatus
String ID: A handle to DLLHOST process ID %lu could not be obtained to request process termination.$COMSysApp$DLLHOST process ID %lu was terminated but did not exit within %lu seconds.$DLLHOST process ID %lu was terminated.$The COM+ system application (%s) service configuration could not be retrieved.$The COM+ system service was sent a shut down request, but the service process did not exit within %lu seconds.$The COM+ system service was stopped.$The service process was terminated but did not exit within %lu seconds.
API String ID: 3797398603-3397523116
Opcode ID: 69f4505ad2c243c63daf1db6f3bd0d0f740273c0fc25153594ad490fc1394007
Instruction ID: 2679d623823f58e9c1b9dc08a664e2a2653bcaf01e18d69d55d401984e85a61a
Opcode Fuzzy Hash: 69f4505ad2c243c63daf1db6f3bd0d0f740273c0fc25153594ad490fc1394007
Instruction Fuzzy Hash: 714109B29403026BF710BB649C4EEDF3E64BFA5750F040924F906A2192F765DAD982A7

Function 00511D30 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 163
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(00000000,00003A98,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511D6F
_fwprintf.LIBCMT ref: 00511D85
TerminateThread.KERNEL32(00000000,000000FF,?,?,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511D90
WaitForSingleObject.KERNEL32(00000000,00003A98,?,?,?,?,?,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511DD5
WaitForSingleObject.KERNEL32(00000000,00003A98,?,?,?,?,?,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511DF0
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511DF7
WaitForSingleObject.KERNEL32(00000000,0001D4C0,?,?,?,?,?,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511E76
_fwprintf.LIBCMT ref: 00511E8C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511E95
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000004,00000000,?,00511B43,?), ref: 00511E9C
_fwprintf.LIBCMT ref: 00511EE5

Strings

Failed to create COM+ shutdown thread, xrefs: 00511E2D
The COM+ administration system failed to shut down one or more applications in the time allotted (%lu seconds), xrefs: 00511E01
Failed to create health check thread, xrefs: 00511ED7
The COM+ reset did not complete within the time allotted (%lu seconds). A system restart is recommended., xrefs: 00511E7E
Failed to create COM+ reset thread, xrefs: 00511EAE
The COM+ health check did not complete within the time allotted (%lu seconds), xrefs: 00511D77

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: ObjectSingleWait$CloseHandle_fwprintf$TerminateThread
String ID: Failed to create COM+ reset thread$Failed to create COM+ shutdown thread$Failed to create health check thread$The COM+ administration system failed to shut down one or more applications in the time allotted (%lu seconds)$The COM+ health check did not complete within the time allotted (%lu seconds)$The COM+ reset did not complete within the time allotted (%lu seconds). A system restart is recommended.
API String ID: 831982598-1474398732
Opcode ID: 255944f734eac7089b1c4e011f612df53fcc18464cc67e9c8a8a1c3e87063022
Instruction ID: 336a6aebd10f0ff49f276466af8a4afeceab2c75540b6f69875f2282a5760c3f
Opcode Fuzzy Hash: 255944f734eac7089b1c4e011f612df53fcc18464cc67e9c8a8a1c3e87063022
Instruction Fuzzy Hash: 9F41BD729403066BF310BBA59C0EFFB3FECBFD1790F044428F919A1181E635E989426A

Function 005135C0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 131
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 005135C6
OpenSCManagerW.ADVAPI32(00000000,ServicesActive,80000001), ref: 005135DC
OpenServiceW.ADVAPI32(00000000,COMSysApp,00000024), ref: 005135F0
CloseServiceHandle.ADVAPI32(00000000), ref: 005135FF
GetLastError.KERNEL32 ref: 00513607
CloseServiceHandle.ADVAPI32(00000000), ref: 00513610
GetLastError.KERNEL32 ref: 00513618
QueryServiceStatusEx.ADVAPI32(?,00000000,?,00000024,?), ref: 0051366D
ControlService.ADVAPI32(?,00000001,?), ref: 005136BA
GetTickCount.KERNEL32 ref: 005136E6
SleepEx.KERNEL32(00007530,00000000), ref: 00513707
CloseServiceHandle.ADVAPI32 ref: 00513722
GetLastError.KERNEL32 ref: 00513734
CloseServiceHandle.ADVAPI32(?), ref: 0051373F

Strings

ServicesActive, xrefs: 005135D1
COMSysApp, xrefs: 005135EA

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$CountOpenTick$ControlManagerQuerySleepStatus
String ID: COMSysApp$ServicesActive
API String ID: 593920158-884190028
Opcode ID: 07aaa0984aaa65300501bbe91155b83e7a3457d733925e0eef78e7da024b3db6
Instruction ID: 99185697f8b0767527efbe700b72372bf1d58d2b7790960d987e14a1f12bca1e
Opcode Fuzzy Hash: 07aaa0984aaa65300501bbe91155b83e7a3457d733925e0eef78e7da024b3db6
Instruction Fuzzy Hash: 9F4170B59083409FE720DF68D85C6AABFE5FB98310F054829F54AD3350E774DA88DB52

Function 00512790 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 147
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 005127A3
SysAllocString.OLEAUT32(ProcessID), ref: 005127D2
SysAllocString.OLEAUT32(Application), ref: 005127DD
VariantInit.OLEAUT32(?), ref: 00512851
__wcsicoll.LIBCMT ref: 00512886
VariantInit.OLEAUT32(?), ref: 00512897
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 005128BF
VariantClear.OLEAUT32(?), ref: 005128D6
VariantClear.OLEAUT32(?), ref: 005128E3
SysFreeString.OLEAUT32(?), ref: 0051290B
SysFreeString.OLEAUT32(?), ref: 00512912
VariantClear.OLEAUT32(?), ref: 00512919

Strings

`<u, xrefs: 00512904
Application, xrefs: 005127D4
ProcessID, xrefs: 005127CD

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Variant$String$ClearInit$AllocFree$ChangeType__wcsicoll
String ID: Application$ProcessID$`<u
API String ID: 3008952963-8180839
Opcode ID: eab7c2431f478ecdf785824c4a138485905cd3ed9f4485b8ca2f4035a67f53eb
Instruction ID: 027f5e48327a68d5364ce3676f9c35ffa8e245ae8d78d53bfeb1624539c547be
Opcode Fuzzy Hash: eab7c2431f478ecdf785824c4a138485905cd3ed9f4485b8ca2f4035a67f53eb
Instruction Fuzzy Hash: 045104B5608345AFD700DF68D8809ABBBE8BFC8744F004A1DF58597250D735E989CBA2

Function 00513350 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 106
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,80000001,?,?,00000000,?,?,00511FB5,?), ref: 00513361
OpenServiceW.ADVAPI32(00000000,COMSysApp,00000001,?,?,00000000,?,?,00511FB5,?), ref: 00513375
CloseServiceHandle.ADVAPI32(00000000,?,?,00000000,?,?,00511FB5,?), ref: 0051338A
GetLastError.KERNEL32(?,?,00000000,?,?,00511FB5,?), ref: 00513392
CloseServiceHandle.ADVAPI32(00000000,?,?,00000000,?,?,00511FB5,?), ref: 00513397
GetLastError.KERNEL32(?,?,00000000,?,?,00511FB5,?), ref: 005133A5
QueryServiceConfigW.ADVAPI32(00511FB5,00000000,00000000,00511FB5,?,?,00000000,?,?,00511FB5,?), ref: 005133C1
GetLastError.KERNEL32(?,?,00000000,?,?,00511FB5,?), ref: 005133C7
QueryServiceConfigW.ADVAPI32(00511FB5,00000000,?,?), ref: 005133F3
CloseServiceHandle.ADVAPI32(00511FB5), ref: 00513400
GetLastError.KERNEL32 ref: 0051340E
CloseServiceHandle.ADVAPI32(00511FB5), ref: 00513424
CloseServiceHandle.ADVAPI32(00511FB5,?,?,00000000,?,?,00511FB5,?), ref: 00513438

Strings

ServicesActive, xrefs: 0051335A
COMSysApp, xrefs: 0051336F

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$ConfigOpenQuery$Manager
String ID: COMSysApp$ServicesActive
API String ID: 3555699149-884190028
Opcode ID: 15ba060a2d4faed710a8bc2859695295c6d1a9d2234158c03523c00105d27bb8
Instruction ID: 66ff91ac5eae7baf95b3541cc305b6e82f08d229570f057d1b03612bb5e93dca
Opcode Fuzzy Hash: 15ba060a2d4faed710a8bc2859695295c6d1a9d2234158c03523c00105d27bb8
Instruction Fuzzy Hash: 6121F5722053159BE7109B69FC8CAEBBBA8FF95762B100539F506C3211DF60CE4897A1

Function 00512FC0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 155
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00512FF1
LoadLibraryW.KERNEL32(KERNEL32.DLL,00000000,00000000,?), ref: 00513009
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0051301F
FreeLibrary.KERNEL32(00000000), ref: 0051303B
GetSystemDirectoryW.KERNEL32(?,00000208), ref: 00513050
__wsplitpath_s.LIBCMT ref: 005130A4
_memset.LIBCMT ref: 005130BB
QueryDosDeviceW.KERNEL32(?,?,00000105), ref: 005130D5

Strings

dllhost.exe, xrefs: 005130DB
\, xrefs: 00513060
GetSystemWow64DirectoryW, xrefs: 00513019
KERNEL32.DLL, xrefs: 00513004

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Library_memset$AddressDeviceDirectoryFreeLoadProcQuerySystem__wsplitpath_s
String ID: GetSystemWow64DirectoryW$KERNEL32.DLL$\$dllhost.exe
API String ID: 347389601-3091817508
Opcode ID: 520e2e69f3e41173f7b3ef65095980148f13d77f91ffb3fa7a5da7a531f5fe12
Instruction ID: 73ae34f55fbaed3ebef23d3081b1fa008a73b80da9c61cbb674457ac58e1cd39
Opcode Fuzzy Hash: 520e2e69f3e41173f7b3ef65095980148f13d77f91ffb3fa7a5da7a531f5fe12
Instruction Fuzzy Hash: 8051A175604701ABE324DB54DC55BEBB7E4FFD8700F00892DF94997280EB749A48CB96

Function 00513450 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 82
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,80000001,?,?,00000000,?,?,00511FD9), ref: 00513463
OpenServiceW.ADVAPI32(00000000,COMSysApp,00000004,?,00000000,?,?,00511FD9), ref: 00513477
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FD9), ref: 00513486
GetLastError.KERNEL32(?,00000000,?,?,00511FD9), ref: 0051348E
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FD9), ref: 00513497
GetLastError.KERNEL32(?,00000000,?,?,00511FD9), ref: 0051349F
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,00000000,?,00000000,?,?,00511FD9), ref: 005134D9
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FD9), ref: 005134E6
GetLastError.KERNEL32(?,00000000,?,?,00511FD9), ref: 005134F4
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00511FD9), ref: 005134FD

Strings

ServicesActive, xrefs: 0051345A
COMSysApp, xrefs: 00513471

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$Open$ManagerQueryStatus
String ID: COMSysApp$ServicesActive
API String ID: 3512290387-884190028
Opcode ID: 4d6485a702bf8092fa07cd77c8fb5b93b8293b15304266f6b74159dbb0d8cbee
Instruction ID: 7b38b76d6269735a8383a7aa2125a09e8100aab93c652fe4b9564363116f785c
Opcode Fuzzy Hash: 4d6485a702bf8092fa07cd77c8fb5b93b8293b15304266f6b74159dbb0d8cbee
Instruction Fuzzy Hash: C021A4726043059FD3209F79AC4C697FBE8FB58722B10493EF64BC2611EB70D948AB90

Function 0051579F Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00521FF0,0000000C,005158DA,00000000,00000000,?,0051385E,?,00000000,?,00000000,?,?,00512598,?), ref: 005157B1
__crt_waiting_on_module_handle.LIBCMT ref: 005157BC

Part of subcall function 00517F21: Sleep.KERNEL32(000003E8,?,?,005156C5,KERNEL32.DLL,?,00514B8F,?,00514B5F,0051385E,00000000,?,0051385E,?,00000000), ref: 00517F2D
Part of subcall function 00517F21: GetModuleHandleW.KERNEL32(0051385E,?,005156C5,KERNEL32.DLL,?,00514B8F,?,00514B5F,0051385E,00000000,?,0051385E,?,00000000,?,00000000), ref: 00517F36

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 005157E5
GetProcAddress.KERNEL32(?,DecodePointer), ref: 005157F5
__lock.LIBCMT ref: 00515817
InterlockedIncrement.KERNEL32(044E8968), ref: 00515824
__lock.LIBCMT ref: 00515838
___addlocaleref.LIBCMT ref: 00515856

Strings

(8R, xrefs: 0051584B
KERNEL32.DLL, xrefs: 005157AB, 005157B0, 005157BB
DecodePointer, xrefs: 005157ED
EncodePointer, xrefs: 005157D9

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: (8R$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-432893533
Opcode ID: cf1f18e8046ac5dea175b9df7716dd596a120cf4f6aaf9b36d633b5af65b4cef
Instruction ID: 28aae54886305324ad44ab425d14ada9a0670aa833fc67e5ea8a33ed6ef01a66
Opcode Fuzzy Hash: cf1f18e8046ac5dea175b9df7716dd596a120cf4f6aaf9b36d633b5af65b4cef
Instruction Fuzzy Hash: 4A11A571801B02EAE720EF759849BCABFE0BF54314F10852DE4AA93291DBB49A81CB54

Function 00512BD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(Application), ref: 00512C05
VariantInit.OLEAUT32(?), ref: 00512C12
SysFreeString.OLEAUT32(00000000), ref: 00512C27
VariantInit.OLEAUT32(?), ref: 00512C7C
__wcsicoll.LIBCMT ref: 00512CB8
VariantClear.OLEAUT32(?), ref: 00512CE1
VariantClear.OLEAUT32(?), ref: 00512CF7
VariantClear.OLEAUT32(?), ref: 00512D11

Strings

`<u, xrefs: 00512C27
Application, xrefs: 00512C00

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Variant$Clear$InitString$AllocFree__wcsicoll
String ID: Application$`<u
API String ID: 3535822021-3416457488
Opcode ID: 7bfaa1c4c16ad06c3e5a8987363db5b52b9a2bac6019a0cd049cbf0efc737512
Instruction ID: 469e015c9efecbb6ab55b8f0a99d5cb210f8b373172059103cd8b2e9c01340d8
Opcode Fuzzy Hash: 7bfaa1c4c16ad06c3e5a8987363db5b52b9a2bac6019a0cd049cbf0efc737512
Instruction Fuzzy Hash: 53414C7A204305AFD710DF64E8849EBBBA4FBD8354F54492DF94983210D730EA99CBD2

Function 00512930 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00512680: SysAllocString.OLEAUT32(ApplicationInstances), ref: 005126A2
Part of subcall function 00512680: SysFreeString.OLEAUT32(00000000), ref: 005126FA

Part of subcall function 0051383F: _malloc.LIBCMT ref: 00513859

SysAllocString.OLEAUT32(ProcessID), ref: 005129BA
VariantInit.OLEAUT32(?), ref: 005129F0
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00512A19
VariantClear.OLEAUT32(?), ref: 00512A44
SysFreeString.OLEAUT32(00000000), ref: 00512A62

Strings

ApplicationInstances, xrefs: 00512957
`<u, xrefs: 00512A62
ProcessID, xrefs: 005129B5

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: String$Variant$AllocFree$ChangeClearInitType_malloc
String ID: ApplicationInstances$ProcessID$`<u
API String ID: 432088159-693366622
Opcode ID: af2901e3f271c017732fc9629b2576662d7fd29011f5e4fd377800d98104ae68
Instruction ID: 9b9136e3ed82949e0aaf065502cae9aab88c02eaa03c2bbed456d04ac714a83a
Opcode Fuzzy Hash: af2901e3f271c017732fc9629b2576662d7fd29011f5e4fd377800d98104ae68
Instruction Fuzzy Hash: 4D413CB66042069FC314DF68E88489BBBE5FFC8350F14496DF94AD7310D635ED858B92

Function 00511B70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00511B76
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 00511B89
FreeLibrary.KERNEL32(00000000), ref: 00511B98
GetLastError.KERNEL32 ref: 00511BA3
FreeLibrary.KERNEL32(00000000), ref: 00511BBA
GetLastError.KERNEL32 ref: 00511BC5

Strings

DllRegisterServer, xrefs: 00511B83

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Library$ErrorFreeLast$AddressLoadProc
String ID: DllRegisterServer
API String ID: 1397630947-1663957109
Opcode ID: 04d75ab6c2e56be4658b764959adfcebbbe34273da3319003811f3b31f769527
Instruction ID: 68d62f6042efea00e8934ea9b2eb870f5733da636c979b10c1e4f81ab590bafa
Opcode Fuzzy Hash: 04d75ab6c2e56be4658b764959adfcebbbe34273da3319003811f3b31f769527
Instruction Fuzzy Hash: 19F0E936B086125BD72017BEBC0C7BAAEA8EFE6BB27148575F906C2165E62CC844D354

Function 00511BE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00511BE6
GetProcAddress.KERNEL32(00000000,DllUnregisterServer), ref: 00511BF9
FreeLibrary.KERNEL32(00000000), ref: 00511C08
GetLastError.KERNEL32 ref: 00511C13
FreeLibrary.KERNEL32(00000000), ref: 00511C2A
GetLastError.KERNEL32 ref: 00511C35

Strings

DllUnregisterServer, xrefs: 00511BF3

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Library$ErrorFreeLast$AddressLoadProc
String ID: DllUnregisterServer
API String ID: 1397630947-2930405159
Opcode ID: c859d91a165231d6d41285c46b75fbafaddb63348894d05fd166548fb87fa327
Instruction ID: e18fa3ad5d474c67a01892954532a0b7763939d669ca9dff08b3faaa4a9d7d8d
Opcode Fuzzy Hash: c859d91a165231d6d41285c46b75fbafaddb63348894d05fd166548fb87fa327
Instruction Fuzzy Hash: 56F0BB367446125BD720176EFC0C7A66EA8AFA57B17108575F906C2151D62CCC44D394

Function 005141D4 Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 005141DA

Part of subcall function 00515711: TlsGetValue.KERNEL32(0051385E,0051589D,?,0051385E,?,00000000,?,00000000,?,?,00512598,?,?,74DF30A0,00000000), ref: 0051571A
Part of subcall function 00515711: __decode_pointer.LIBCMT ref: 0051572C
Part of subcall function 00515711: TlsSetValue.KERNEL32(00000000,0051385E,?,00000000,?,00000000,?,?,00512598,?,?,74DF30A0,00000000,?,?,?), ref: 0051573B

___fls_getvalue@4.LIBCMT ref: 005141E5

Part of subcall function 005156F1: TlsGetValue.KERNEL32(?,?,005141EA,00000000), ref: 005156FF

___fls_setvalue@8.LIBCMT ref: 005141F8

Part of subcall function 00515745: __decode_pointer.LIBCMT ref: 00515756

GetLastError.KERNEL32(00000000,?,00000000), ref: 00514201
ExitThread.KERNEL32 ref: 00514208
GetCurrentThreadId.KERNEL32 ref: 0051420E
__freefls@4.LIBCMT ref: 0051422E
__IsNonwritableInCurrentImage.LIBCMT ref: 00514241

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: 2c657ff1762a582e598bf31dc180294107a902d7819943f297f0ae00e4148b3e
Instruction ID: 57975f0ae7966f9fff2fc04f0652c9e7e03a356c837c4a8e25788ebf81221370
Opcode Fuzzy Hash: 2c657ff1762a582e598bf31dc180294107a902d7819943f297f0ae00e4148b3e
Instruction Fuzzy Hash: FA018438401602EBE714AF74D94E9DD3FA9BFC9354B208424F41597252EB34C8C6DFA1

Function 00514257 Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00514288
__calloc_crt.LIBCMT ref: 00514294
__getptd.LIBCMT ref: 005142A1
CreateThread.KERNEL32(?,?,005141D4,00000000,?,?), ref: 005142D8
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 005142E2
__dosmaperr.LIBCMT ref: 005142FA

Part of subcall function 00515E97: __getptd_noexit.LIBCMT ref: 00515E97

Part of subcall function 00515E2F: __decode_pointer.LIBCMT ref: 00515E3A

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1803633139-0
Opcode ID: 98cc717ffaa7a405442c3a3e3972e966990c1bf5925e46d48e18fc031ebe1c92
Instruction ID: 405ee56fa138de3bc51373a4ac5c1700803e535cda1c3ac00d2aaace37da4f51
Opcode Fuzzy Hash: 98cc717ffaa7a405442c3a3e3972e966990c1bf5925e46d48e18fc031ebe1c92
Instruction Fuzzy Hash: D311C872500606FFEB10BFA4DC868DE7FA9FF84320B214539F52197151EB319AC09B60

Function 0051C911 Relevance: 9.1, APIs: 6, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

___initconout.LIBCMT ref: 0051C937

Part of subcall function 0051D132: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0051C93C,00000000,?,00000002,00000000), ref: 0051D145

WriteConsoleW.KERNEL32(FFFFFFFE,00000000,00000001,?,00000000,00000000,?,00000002,00000000), ref: 0051C959
GetLastError.KERNEL32 ref: 0051C96C
GetConsoleOutputCP.KERNEL32(00000000,00000000,00000001,00000002,00000005,00000000,00000000,00000000,?,00000002,00000000), ref: 0051C98C
WideCharToMultiByte.KERNEL32(00000000), ref: 0051C993
WriteConsoleA.KERNEL32(FFFFFFFE,?,00000000,?,00000000), ref: 0051C9AF

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide___initconout
String ID:
API String ID: 3734994816-0
Opcode ID: cb32ecbcd91c1c4f2ceb83520165cf36637a18870ae1333dbcecf18ac4c98ed8
Instruction ID: 12c1d610b3392431e6a84415fb05b7cd8e9a7a83223304e82c691f0a424a071a
Opcode Fuzzy Hash: cb32ecbcd91c1c4f2ceb83520165cf36637a18870ae1333dbcecf18ac4c98ed8
Instruction Fuzzy Hash: 08219F71A41104EBE7209B64EE48EFA7F6CFF1A720F104659F512C21D0DB74AE89DB91

Function 0051D99A Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0051D9C2

Part of subcall function 0051D535: __getptd.LIBCMT ref: 0051D543
Part of subcall function 0051D535: __getptd.LIBCMT ref: 0051D551

__getptd.LIBCMT ref: 0051D9CC

Part of subcall function 005158FF: __getptd_noexit.LIBCMT ref: 00515902
Part of subcall function 005158FF: __amsg_exit.LIBCMT ref: 0051590F

__getptd.LIBCMT ref: 0051D9DA
__getptd.LIBCMT ref: 0051D9E8
__getptd.LIBCMT ref: 0051D9F3
_CallCatchBlock2.LIBCMT ref: 0051DA19

Part of subcall function 0051D5DA: __CallSettingFrame@12.LIBCMT ref: 0051D626

Part of subcall function 0051DAC0: __getptd.LIBCMT ref: 0051DACF
Part of subcall function 0051DAC0: __getptd.LIBCMT ref: 0051DADD

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 48cbe14e6e056739cdcd7830ea57447cd4c8fe834665187e1c26562f712c6fc9
Instruction ID: fb45185a5aa106a0be5b601e1487dd4338df3fb4c325a8339c241157fb886ab6
Opcode Fuzzy Hash: 48cbe14e6e056739cdcd7830ea57447cd4c8fe834665187e1c26562f712c6fc9
Instruction Fuzzy Hash: 1B11C971D0034AEFEB00EFA4D449ADD7BB1FF48314F10846AF815A7252DB389A559B60

Function 00511F00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55comCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 00511F0F
CoCreateInstance.OLE32 ref: 00511F34
CoUninitialize.OLE32 ref: 00511F87

Part of subcall function 00512570: _fwprintf.LIBCMT ref: 0051260B

SleepEx.KERNEL32(00001388,00000000,?), ref: 00511F6A

Strings

Pou, xrefs: 00511F34

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: CreateInitializeInstanceSleepUninitialize_fwprintf
String ID: Pou
API String ID: 371748533-1565865998
Opcode ID: cd0f111f9f80aa8db4b06b3f179aac043694e9381a9102e7df3707240756a28e
Instruction ID: 2dd7c5c20f71a5f9e31931d080329f47a9b11671d750cdca9fd1aad5a98efa31
Opcode Fuzzy Hash: cd0f111f9f80aa8db4b06b3f179aac043694e9381a9102e7df3707240756a28e
Instruction Fuzzy Hash: DF012635684700ABE310AB68DC89FCABBA8BB95720F008165FA58D71D1C7B0D886C7A5

Function 0051383F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00513859

Part of subcall function 00514AA6: __FF_MSGBANNER.LIBCMT ref: 00514AC9
Part of subcall function 00514AA6: __NMSG_WRITE.LIBCMT ref: 00514AD0
Part of subcall function 00514AA6: HeapAlloc.KERNEL32(00000000,0051384F,?,?,00000000,?,0051385E,?,00000000,?,00000000,?,?,00512598,?,?), ref: 00514B1D

std::bad_alloc::bad_alloc.LIBCMT ref: 0051387C

Part of subcall function 005137D5: std::exception::exception.LIBCMT ref: 005137E1

std::bad_exception::bad_exception.LIBCMT ref: 00513890
__CxxThrowException@8.LIBCMT ref: 0051389E

Strings

@@R, xrefs: 0051386C

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: AllocException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID: @@R
API String ID: 3622535130-4207356687
Opcode ID: 1c8cb910fbc96e7a3a208395e8aa739d2bd812694ceb41f97e6f3b1b197b1c48
Instruction ID: 76c49b5b0ac1de14f411ce47cfa8eeff100bc16124a2ff6e1a0252d92c0b968e
Opcode Fuzzy Hash: 1c8cb910fbc96e7a3a208395e8aa739d2bd812694ceb41f97e6f3b1b197b1c48
Instruction Fuzzy Hash: EBF0E230505206B6FF24B761EC2EADD3F59BF81324F104024FC05564D1DB64CBC58E64

Function 00515585 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00515591

Part of subcall function 005158FF: __getptd_noexit.LIBCMT ref: 00515902
Part of subcall function 005158FF: __amsg_exit.LIBCMT ref: 0051590F

__getptd.LIBCMT ref: 005155A8
__amsg_exit.LIBCMT ref: 005155B6
__lock.LIBCMT ref: 005155C6

Strings

(8R, xrefs: 005155D3

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: (8R
API String ID: 3521780317-1541751401
Opcode ID: 5af83fe6f1e5c6fa7d8e50f0cf906d9d70dba822430af02b29368b43e841b64a
Instruction ID: 1d2efb5c585316f514cbbe4a5809108cda427bbb6124c35bce346587732c2954
Opcode Fuzzy Hash: 5af83fe6f1e5c6fa7d8e50f0cf906d9d70dba822430af02b29368b43e841b64a
Instruction Fuzzy Hash: 61F06D31901B06DAF720BB68840EBC97EA27FC5720F124519B4519B2D2EB3899C1DB51

Function 0051D6E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0051D703

Part of subcall function 005158FF: __getptd_noexit.LIBCMT ref: 00515902
Part of subcall function 005158FF: __amsg_exit.LIBCMT ref: 0051590F

__getptd.LIBCMT ref: 0051D714
__getptd.LIBCMT ref: 0051D722

Strings

MOC, xrefs: 0051D6F5
csm, xrefs: 0051D6FC

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: a04410697f92662307cff3d2e5d81a79e6eb3f8e45002c25e8713751769f6b93
Instruction ID: d01083aa4b9e34ffd6eac59bfba81f9340221a33eecbba1c2ec874f80da94a26
Opcode Fuzzy Hash: a04410697f92662307cff3d2e5d81a79e6eb3f8e45002c25e8713751769f6b93
Instruction Fuzzy Hash: E8E01A355006049FE720AA68C08ABE83BA4FB88314F2504A2A409CB263DB38D8C096A2

Function 00514E19 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00514E25

Part of subcall function 005158FF: __getptd_noexit.LIBCMT ref: 00515902
Part of subcall function 005158FF: __amsg_exit.LIBCMT ref: 0051590F

__amsg_exit.LIBCMT ref: 00514E45
__lock.LIBCMT ref: 00514E55
InterlockedDecrement.KERNEL32(?), ref: 00514E72
InterlockedIncrement.KERNEL32(010D1678), ref: 00514E9D

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 92afbb574e17cb4a54b8c8b9638dd2331871dee817aa975a7c1f43e15db98bf4
Instruction ID: 974e41880a819314e21f140847ec2560c94a88b1db9a5f00dfd616563ad4fd28
Opcode Fuzzy Hash: 92afbb574e17cb4a54b8c8b9638dd2331871dee817aa975a7c1f43e15db98bf4
Instruction Fuzzy Hash: 8C01C435900612ABEF21AB6494497DE7FA8BF48710F184215F414A7291C7385EC6DFD2

Function 00513ACF Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00513AED

Part of subcall function 0051608C: __mtinitlocknum.LIBCMT ref: 005160A2
Part of subcall function 0051608C: __amsg_exit.LIBCMT ref: 005160AE
Part of subcall function 0051608C: EnterCriticalSection.KERNEL32(?,?,?,0051A546,00000004,00522148,0000000C,00517DFE,0051385E,?,00000000,00000000,00000000,?,005158B1,00000001), ref: 005160B6

___sbh_find_block.LIBCMT ref: 00513AF8
___sbh_free_block.LIBCMT ref: 00513B07
HeapFree.KERNEL32(00000000,0051385E,00521EA8,0000000C,0051606D,00000000,00522040,0000000C,005160A7,0051385E,?,?,0051A546,00000004,00522148,0000000C), ref: 00513B37
GetLastError.KERNEL32(?,0051A546,00000004,00522148,0000000C,00517DFE,0051385E,?,00000000,00000000,00000000,?,005158B1,00000001,00000214), ref: 00513B48

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 928b942b1bb1f36465095d1a1cc3cebefdb60085a15937fe07f4696a64c18b29
Instruction ID: 1289c12e989059f97cce15ca23f4bee2ea5cb80a67a63764e2c979c24475fba4
Opcode Fuzzy Hash: 928b942b1bb1f36465095d1a1cc3cebefdb60085a15937fe07f4696a64c18b29
Instruction Fuzzy Hash: 6A01AD31909306AAFF34AB759C1EBDE3FA8BF54320F204619F404A7091EB348AC4DA50

Function 005141C8 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 005181D7: _doexit.LIBCMT ref: 005181E3

___set_flsgetvalue.LIBCMT ref: 005141DA

Part of subcall function 00515711: TlsGetValue.KERNEL32(0051385E,0051589D,?,0051385E,?,00000000,?,00000000,?,?,00512598,?,?,74DF30A0,00000000), ref: 0051571A
Part of subcall function 00515711: __decode_pointer.LIBCMT ref: 0051572C
Part of subcall function 00515711: TlsSetValue.KERNEL32(00000000,0051385E,?,00000000,?,00000000,?,?,00512598,?,?,74DF30A0,00000000,?,?,?), ref: 0051573B

___fls_getvalue@4.LIBCMT ref: 005141E5

Part of subcall function 005156F1: TlsGetValue.KERNEL32(?,?,005141EA,00000000), ref: 005156FF

___fls_setvalue@8.LIBCMT ref: 005141F8

Part of subcall function 00515745: __decode_pointer.LIBCMT ref: 00515756

GetLastError.KERNEL32(00000000,?,00000000), ref: 00514201
ExitThread.KERNEL32 ref: 00514208
GetCurrentThreadId.KERNEL32 ref: 0051420E
__freefls@4.LIBCMT ref: 0051422E
__IsNonwritableInCurrentImage.LIBCMT ref: 00514241

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 132634196-0
Opcode ID: c9eb21824ade7d5522b06ef55fff2710576c197e11b654715585ced4d803b679
Instruction ID: f59f945c78e81be4905084205bd3c548194f3b346a747fbdf7b8e92f94d8361f
Opcode Fuzzy Hash: c9eb21824ade7d5522b06ef55fff2710576c197e11b654715585ced4d803b679
Instruction Fuzzy Hash: 5BE09A25800A16E7AE113BB19C5F9EE3E5DBED6390B114410BA25A3152EA3899D186A1

Function 00512680 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(ApplicationInstances), ref: 005126A2
SysFreeString.OLEAUT32(00000000), ref: 005126FA

Strings

ApplicationInstances, xrefs: 005126A1
`<u, xrefs: 005126FA

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: String$AllocFree
String ID: ApplicationInstances$`<u
API String ID: 344208780-1176231285
Opcode ID: 8accf3ebb85067623a81b919a9f4e5b6fd88ec9a65b8742f2836a0cfba05e63f
Instruction ID: 9d16bc0ec78bb0526750dda043ea214ab3af4bdaf3edaf75895fadb54ca9d7ac
Opcode Fuzzy Hash: 8accf3ebb85067623a81b919a9f4e5b6fd88ec9a65b8742f2836a0cfba05e63f
Instruction Fuzzy Hash: 1B11BF766016129FE314DB68D884A97B7E8FF88361F254159E90ACB3A0DB34DC90D791

Function 00513FA7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00513FC9
__calloc_crt.LIBCMT ref: 00513FE2

Strings

`LR, xrefs: 00513FF9
h0R, xrefs: 0051401B

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: __calloc_crt
String ID: `LR$h0R
API String ID: 3494438863-522478077
Opcode ID: e368c38a69da5cce63417eb5ea51ad6f3d96c627a3fafa252580f5ddac4713fe
Instruction ID: 3d806f332c881d8e99da34da1555053a1eafad47481155eb5f90faae1c66195e
Opcode Fuzzy Hash: e368c38a69da5cce63417eb5ea51ad6f3d96c627a3fafa252580f5ddac4713fe
Instruction Fuzzy Hash: 6A110A3274861557F7388A1D7C996F12AA5BF9A330B28052AF700DB2D0FA38CDC79A44

Function 0051DD47 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0051DD5A

Part of subcall function 0051DCB5: ___BuildCatchObjectHelper.LIBCMT ref: 0051DCEB

_UnwindNestedFrames.LIBCMT ref: 0051DD71
___FrameUnwindToState.LIBCMT ref: 0051DD7F

Strings

csm, xrefs: 0051DD56, 0051DD6B, 0051DD7E, 0051DD9C, 0051DDAC

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 6d3746d3ca6c973960a6f094acf11f376ddc08dfa563c4b4360553dce42de5f6
Instruction ID: 77209edd00ed6dc7e00ff29d6f26b4d4b0d4d945ca5fded63ab2c52a379ad965
Opcode Fuzzy Hash: 6d3746d3ca6c973960a6f094acf11f376ddc08dfa563c4b4360553dce42de5f6
Instruction Fuzzy Hash: 9501D27600010ABBEF126F51DC89EEA7E7AFF48394F148110BD1815161D736D9A1EAA1

Function 00515547 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 00515559

Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(0051385E), ref: 00515431
Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(48831475), ref: 0051543E
Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(0AEB010C), ref: 0051544B
Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(46C60270), ref: 00515458
Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(8904408B), ref: 00515465
Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(8904408B), ref: 00515481
Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(75C08500), ref: 00515491
Part of subcall function 0051541F: InterlockedIncrement.KERNEL32(FF56525C), ref: 005154A7

___removelocaleref.LIBCMT ref: 00515564

Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(00521E50), ref: 005154C8
Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(005141C8), ref: 005154D5
Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(FFFFFFFE), ref: 005154E2
Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(00000000), ref: 005154EF
Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(FFFFFF88), ref: 005154FC
Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(FFFFFF88), ref: 00515518
Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(00000000), ref: 00515528
Part of subcall function 005154AE: InterlockedDecrement.KERNEL32(FFFFFF4A), ref: 0051553E

___freetlocinfo.LIBCMT ref: 00515578

Part of subcall function 005152D6: ___free_lconv_mon.LIBCMT ref: 0051531C
Part of subcall function 005152D6: ___free_lconv_num.LIBCMT ref: 0051533D
Part of subcall function 005152D6: ___free_lc_time.LIBCMT ref: 005153C2

Strings

(8R, xrefs: 0051556F

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: (8R
API String ID: 467427115-1541751401
Opcode ID: d2a30a756b2bef97ab572db6b6a8c9d2d2743bf8ce95915402ad1c7b2da83a58
Instruction ID: d96a07ea6755197e4d1eb2d2fd195610697374caba8d89eac068990a4424e455
Opcode Fuzzy Hash: d2a30a756b2bef97ab572db6b6a8c9d2d2743bf8ce95915402ad1c7b2da83a58
Instruction Fuzzy Hash: 0EE0DF36901E22DFEA313A3C24802EA9E873FC2321B6B011AF810A7554FB744EC090A0

Function 0051A837 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0051A86B
__isleadbyte_l.LIBCMT ref: 0051A89F
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,?,00000000,00000000,?,?,?,?,00000002,00000000), ref: 0051A8D0
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,?,?,?,00000002,00000000), ref: 0051A93E

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c2c1f2c6fe252fbf3fc6ca79371b47af8708d7fddda003ff7049d74f9828f468
Instruction ID: 04b2d513d68fcb4dbf55ed7b70449277e1392ef6bdc77dff63444718d003c030
Opcode Fuzzy Hash: c2c1f2c6fe252fbf3fc6ca79371b47af8708d7fddda003ff7049d74f9828f468
Instruction Fuzzy Hash: BF31A031A02286FFEF12DF64C8849EA3FA5BF41310F1589A9E4659B192E730DDC1DB52

Function 00512AB0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00512B2A
SysStringLen.OLEAUT32(?), ref: 00512B4E
__wcsnicmp.LIBCMT ref: 00512B67
VariantClear.OLEAUT32(00000008), ref: 00512B90

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: Variant$ClearInitString__wcsnicmp
String ID:
API String ID: 855804650-0
Opcode ID: d4ed179d001384f1c4e07f02e4a08692a5d916738f3f5401308a05a9c1105295
Instruction ID: 442466a1a6835db6d80651ab1b7426dbd2779fb5a32d9c0af9ac8435487e634a
Opcode Fuzzy Hash: d4ed179d001384f1c4e07f02e4a08692a5d916738f3f5401308a05a9c1105295
Instruction Fuzzy Hash: 08315EB1508306AFD714EF54D8849ABBBE4FFD8300F00492DF89987210D730D999CB92

Function 00514156 Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00514169

Part of subcall function 00518480: __FindPESection.LIBCMT ref: 005184DB

__getptd_noexit.LIBCMT ref: 00514179
__freeptd.LIBCMT ref: 00514183
ExitThread.KERNEL32 ref: 0051418C

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: e0a1f68e69d4467b7699c15569d87e0e071d1b2869450b051ae98a41dc0bc9f0
Instruction ID: 44a762d32c41fb237b809cc8b17f59fca03f76251c0eba492310997a08082d51
Opcode Fuzzy Hash: e0a1f68e69d4467b7699c15569d87e0e071d1b2869450b051ae98a41dc0bc9f0
Instruction Fuzzy Hash: 27D012300D1607BBF6293766FD0E6963E59BFA1366F184120F400920A1DF70CCC5DD61

Function 00518728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

(8R, xrefs: 0051877F

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID:
String ID: (8R
API String ID: 0-1541751401
Opcode ID: 40886ec60d52b12cef470d1a70592f4132401a0b8f8c58f48579077b4d8dd135
Instruction ID: 883ba28356677b33ca713a0512767d7df2e4c679f538498cf2326a9efec8a448
Opcode Fuzzy Hash: 40886ec60d52b12cef470d1a70592f4132401a0b8f8c58f48579077b4d8dd135
Instruction Fuzzy Hash: B0F08C72600108BAEF219F50DC42BB93FA4FB65744F108021F9199A1D1EBB6CAD5E790

Function 0051DAC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0051D588: __getptd.LIBCMT ref: 0051D58E
Part of subcall function 0051D588: __getptd.LIBCMT ref: 0051D59E

__getptd.LIBCMT ref: 0051DACF

Part of subcall function 005158FF: __getptd_noexit.LIBCMT ref: 00515902
Part of subcall function 005158FF: __amsg_exit.LIBCMT ref: 0051590F

__getptd.LIBCMT ref: 0051DADD

Strings

csm, xrefs: 0051DAEB

Memory Dump Source

Source File: 00000000.00000002.1723210529.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1723195583.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723235845.000000000051F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723261572.0000000000523000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1723426757.0000000000526000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_Proxy32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2f3b0001851d3dfe9b4dfb890fb2b704a8445f5e3a79629807afdac473aa86d6
Instruction ID: 29856cba6323c787112b6d4504de79e8e677aaff4dd1131025ec0f3dbc456708
Opcode Fuzzy Hash: 2f3b0001851d3dfe9b4dfb890fb2b704a8445f5e3a79629807afdac473aa86d6
Instruction Fuzzy Hash: 17018B3080520AEAEF349F24D448AECBBF5BF54311F65052EE8825A251DF34A9C1DF60

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Proxy32.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Proxy32.exePID: 6708, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: Proxy32.exePID: 6708, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 00511000 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Control-flow Graph

Function 00517FA5 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Windows Analysis Report
Proxy32.exe

Function 00511000 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Function 00517FA5 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 00515EE0 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 005181C1 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Function 005121B0 Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 317
comsynchronizationCOMMON

Function 00512D40 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 196
processCOMMON

Function 00511FA0 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 168
synchronizationCOMMON

Function 00511D30 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 163
synchronizationthreadCOMMON

Function 005135C0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 131
serviceCOMMON

Function 00512790 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 147
memoryCOMMON

Function 00513350 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 106
serviceCOMMON

Function 00512FC0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 155
libraryloaderCOMMON

Function 00513450 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 82
serviceCOMMON