Edit tour

Windows Analysis Report
KzHndnydSG.dll

Overview

General Information

Sample name:	KzHndnydSG.dll renamed because original name is a hash value
Original sample name:	5144ec5b8e4375671dd921a235f83dbe1620c50091bd6c9f91eb0cf362ea7c7f.exe
Analysis ID:	1568429
MD5:	6af2398f4f0239a8fc1d7e64bf0b3be3
SHA1:	b9af7cc99389dcee4157d095b6479cbe4c3670fe
SHA256:	5144ec5b8e4375671dd921a235f83dbe1620c50091bd6c9f91eb0cf362ea7c7f
Tags:	185-216-71-202exeuser-JAMESWT_MHT
Infos:

Detection

CobaltStrike

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file does not import any functions

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 7748 cmdline: loaddll64.exe "C:\Users\user\Desktop\KzHndnydSG.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7800 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7824 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7808 cmdline: rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DAssemble MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7932 cmdline: rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7964 cmdline: rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile2 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7560 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DAssemble MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3820 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1852 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile2 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1968 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",IEX MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4344 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",DebugSetMute MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4348 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DWriteBlobToFile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4240 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DStripShader MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4244 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DSetBlobPart MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3420 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReturnFailure1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6916 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflectLibrary MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5936 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflect MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7140 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReadFileToBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7536 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DPreprocess MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6524 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DLoadModule MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 744 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetTraceInstructionOffsets MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4780 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetOutputSignatureBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6256 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputSignatureBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7000 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputAndOutputSignatureBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7644 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetDebugInfo MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5580 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetBlobPart MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2156 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassembleRegion MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6532 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble11Trace MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6616 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble10Effect MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7672 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7876 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDecompressShaders MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 764 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateLinker MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7864 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateFunctionLinkingGraph MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7860 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateBlob MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7868 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompressShaders MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3276 cmdline: rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompileFromFile MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 18500, "MaxGetSize": 2140839, "Jitter": 35, "C2Server": "185.216.71.202,/broadcast", "HttpPostUri": "/1/events/com.amazon.csm.csa.prod", "Malleable_C2_Instructions": ["Remove 1308 bytes from the end", "Remove 1 bytes from the end", "Remove 194 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\wermgr.exe", "Spawnto_x64": "%windir%\\sysnative\\wermgr.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 12345, "bStageCleanup": "True", "bCFGCaution": "True", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 24576, "ProcInject_PrependAppend_x86": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_PrependAppend_x64": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "SetThreadContext", "NtQueueApcThread-s", "kernel32.dll:LoadLibraryA", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000006.00000002.1932419653.0000021A31BCC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000006.00000003.1905939888.0000021A3036D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000004.00000002.1861923373.000001D38B8DC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1937652629.0000023D5F31D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000003.00000002.1853432312.0000021A8513C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000007.00000002.1935047568.000002220BBBC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000007.00000003.1932094220.000002220A34D000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 7748	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 7748	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7808	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7808	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7824	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7824	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7932	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7932	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7964	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 7964	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
3.3.rundll32.exe.21a85040000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
3.3.rundll32.exe.21a85040000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
3.3.rundll32.exe.21a85040000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.23d5f300000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.23d5f300000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.23d5f300000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.21a30350000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.21a30350000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.21a30350000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
7.3.rundll32.exe.2220a330000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
7.3.rundll32.exe.2220a330000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
7.3.rundll32.exe.2220a330000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
4.3.rundll32.exe.1d38b800000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
4.3.rundll32.exe.1d38b800000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
4.3.rundll32.exe.1d38b800000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 10 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T16:18:11.371997+0100	2028765	3	Unknown Traffic	192.168.2.9	49824	185.216.71.202	443	TCP
2024-12-04T16:18:40.107699+0100	2028765	3	Unknown Traffic	192.168.2.9	49843	185.216.71.202	443	TCP
2024-12-04T16:19:11.124435+0100	2028765	3	Unknown Traffic	192.168.2.9	49873	185.216.71.202	443	TCP
2024-12-04T16:19:41.497897+0100	2028765	3	Unknown Traffic	192.168.2.9	49901	185.216.71.202	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 18500, "MaxGetSize": 2140839, "Jitter": 35, "C2Server": "185.216.71.202,/broadcast", "HttpPostUri": "/1/events/com.amazon.csm.csa.prod", "Malleable_C2_Instructions": ["Remove 1308 bytes from the end", "Remove 1 bytes from the end", "Remove 194 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\wermgr.exe", "Spawnto_x64": "%windir%\\sysnative\\wermgr.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 12345, "bStageCleanup": "True", "bCFGCaution": "True", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 24576, "ProcInject_PrependAppend_x86": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_PrependAppend_x64": ["REBLQ0xIkGaQDx8AZg8fBAAPHwQADx8ADx8A", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "SetThreadContext", "NtQueueApcThread-s", "kernel32.dll:LoadLibraryA", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: KzHndnydSG.dll

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: KzHndnydSG.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.216.71.202

Source: Joe Sandbox View

ASN Name: CLOUDCOMPUTINGDE CLOUDCOMPUTINGDE

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49824 -> 185.216.71.202:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49843 -> 185.216.71.202:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49873 -> 185.216.71.202:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49901 -> 185.216.71.202:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.216.71.202

Source: KzHndnydSG.dll	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: KzHndnydSG.dll	String found in binary or memory: http://ocsp.thawte.com0
Source: KzHndnydSG.dll	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: KzHndnydSG.dll	String found in binary or memory: http://s2.symcb.com0
Source: KzHndnydSG.dll	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: KzHndnydSG.dll	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: KzHndnydSG.dll	String found in binary or memory: http://sv.symcd.com0&
Source: KzHndnydSG.dll	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: KzHndnydSG.dll	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: KzHndnydSG.dll	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: KzHndnydSG.dll	String found in binary or memory: http://www.symauth.com/cps0(
Source: KzHndnydSG.dll	String found in binary or memory: http://www.symauth.com/rpa00
Source: loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589434374.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2246602342.0000023D5F1AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/
Source: loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202//
Source: loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcast
Source: loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcast32
Source: loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589492234.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844496263.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcastA~
Source: loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844496263.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcastLx
Source: loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcastU~
Source: loaddll64.exe, 00000000.00000003.2589492234.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcastXx
Source: loaddll64.exe, 00000000.00000003.2589492234.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcastk~
Source: loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844496263.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcastm~
Source: loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://185.216.71.202/broadcastox
Source: KzHndnydSG.dll	String found in binary or memory: https://d.symcb.com/cps0%
Source: KzHndnydSG.dll	String found in binary or memory: https://d.symcb.com/rpa0
Source: rundll32.exe, 00000007.00000002.1934840953.000002220A11F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443

Source: C:\Windows\System32\rundll32.exe

Code function: 11_2_00007FF8E7D9F9C5 NtOpenSection,NtMapViewOfSection,

11_2_00007FF8E7D9F9C5

Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A8507AC60	3_3_0000021A8507AC60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A85049680	3_3_0000021A85049680
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A8507B544	3_3_0000021A8507B544
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A85079F34	3_3_0000021A85079F34
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A85088750	3_3_0000021A85088750
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A8507F9E4	3_3_0000021A8507F9E4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A8505B1F4	3_3_0000021A8505B1F4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A85084AA8	3_3_0000021A85084AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A85085900	3_3_0000021A85085900
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021A8504916C	3_3_0000021A8504916C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A8512CB5C	3_2_0000021A8512CB5C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A851373D0	3_2_0000021A851373D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A851305E4	3_2_0000021A851305E4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A85137D40	3_2_0000021A85137D40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A85129D70	3_2_0000021A85129D70
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A8512B860	3_2_0000021A8512B860
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A8512BFCC	3_2_0000021A8512BFCC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B844AA8	4_3_000001D38B844AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B81B1F4	4_3_000001D38B81B1F4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B83F9E4	4_3_000001D38B83F9E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B845900	4_3_000001D38B845900
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B80916C	4_3_000001D38B80916C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B839F34	4_3_000001D38B839F34
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B848750	4_3_000001D38B848750
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B809680	4_3_000001D38B809680
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B83B544	4_3_000001D38B83B544
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_000001D38B83AC60	4_3_000001D38B83AC60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8CCB5C	4_2_000001D38B8CCB5C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8CB860	4_2_000001D38B8CB860
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8CBFCC	4_2_000001D38B8CBFCC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8D05E4	4_2_000001D38B8D05E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8D7D40	4_2_000001D38B8D7D40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8C9D70	4_2_000001D38B8C9D70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8D73D0	4_2_000001D38B8D73D0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000021A31BBB860	6_2_0000021A31BBB860
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000021A31BBBFCC	6_2_0000021A31BBBFCC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000021A31BBCB5C	6_2_0000021A31BBCB5C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000021A31BB9D70	6_2_0000021A31BB9D70
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002220BBAB860	7_2_000002220BBAB860
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002220BBABFCC	7_2_000002220BBABFCC
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002220BBA9D70	7_2_000002220BBA9D70
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002220BBACB5C	7_2_000002220BBACB5C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D9F9C5	11_2_00007FF8E7D9F9C5
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAAF2D	11_2_00007FF8E7DAAF2D
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D7EBDF	11_2_00007FF8E7D7EBDF
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAD4F4	11_2_00007FF8E7DAD4F4
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DA52E8	11_2_00007FF8E7DA52E8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAE1E8	11_2_00007FF8E7DAE1E8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DC31C0	11_2_00007FF8E7DC31C0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAD9D2	11_2_00007FF8E7DAD9D2
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D853CE	11_2_00007FF8E7D853CE
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D764CC	11_2_00007FF8E7D764CC
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D788D2	11_2_00007FF8E7D788D2
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAB8A7	11_2_00007FF8E7DAB8A7
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D96FB5	11_2_00007FF8E7D96FB5
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D752B3	11_2_00007FF8E7D752B3
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D7A87D	11_2_00007FF8E7D7A87D
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAC280	11_2_00007FF8E7DAC280
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DB477C	11_2_00007FF8E7DB477C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D7B38D	11_2_00007FF8E7D7B38D
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D73C5D	11_2_00007FF8E7D73C5D
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D94A5B	11_2_00007FF8E7D94A5B
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D7146E	11_2_00007FF8E7D7146E
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D7876C	11_2_00007FF8E7D7876C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DB1D75	11_2_00007FF8E7DB1D75
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D84973	11_2_00007FF8E7D84973
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAC63D	11_2_00007FF8E7DAC63D
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAD149	11_2_00007FF8E7DAD149
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D75452	11_2_00007FF8E7D75452
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D8EA27	11_2_00007FF8E7D8EA27
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7D99902	11_2_00007FF8E7D99902
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAC4F8	11_2_00007FF8E7DAC4F8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DADB17	11_2_00007FF8E7DADB17
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_00007FF8E7DAC008	11_2_00007FF8E7DAC008

Source: KzHndnydSG.dll

Static PE information: invalid certificate

Source: KzHndnydSG.dll

Static PE information: No import functions for PE file found

Source: KzHndnydSG.dll

Binary or memory string: OriginalFilenameiisexpress.exe\ vs KzHndnydSG.dll

Source: classification engine

Classification label: mal92.troj.evad.winDLL@72/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03

Source: KzHndnydSG.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DAssemble

Source: KzHndnydSG.dll

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\KzHndnydSG.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DAssemble
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DAssemble
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",IEX
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",DebugSetMute
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DWriteBlobToFile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DStripShader
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DSetBlobPart
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReturnFailure1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflectLibrary
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflect
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReadFileToBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DPreprocess
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DLoadModule
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetTraceInstructionOffsets
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetOutputSignatureBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputSignatureBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputAndOutputSignatureBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetDebugInfo
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetBlobPart
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassembleRegion
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble11Trace
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble10Effect
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDecompressShaders
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateLinker
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateFunctionLinkingGraph
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateBlob
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompressShaders
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompileFromFile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DAssemble	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DAssemble	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",IEX	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",DebugSetMute	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DWriteBlobToFile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DStripShader	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DSetBlobPart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReturnFailure1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflectLibrary	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflect	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReadFileToBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DPreprocess	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DLoadModule	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetTraceInstructionOffsets	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetOutputSignatureBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputSignatureBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputAndOutputSignatureBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetDebugInfo	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetBlobPart	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassembleRegion	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble11Trace	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble10Effect	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDecompressShaders	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateLinker	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateFunctionLinkingGraph	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateBlob	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompressShaders	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompileFromFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: KzHndnydSG.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: KzHndnydSG.dll

Static file information: File size 1050144 > 1048576

Source: KzHndnydSG.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A850FA35D push edi; iretd	3_2_0000021A850FA35E
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A8513252E push es; iretd	3_2_0000021A8513252F
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A850FBD58 push ebp; iretd	3_2_0000021A850FBD59
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A8513A5D8 push ebp; iretd	3_2_0000021A8513A5DD
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021A850FA71E push cs; retf	3_2_0000021A850FA71F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B89A35D push edi; iretd	4_2_000001D38B89A35E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B89A71E push cs; retf	4_2_000001D38B89A71F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8DA5D8 push ebp; iretd	4_2_000001D38B8DA5DD
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B8D252E push es; iretd	4_2_000001D38B8D252F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000001D38B89BD58 push ebp; iretd	4_2_000001D38B89BD59
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000021A31B8A71E push cs; retf	6_2_0000021A31B8A71F
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000021A31B8A35D push edi; iretd	6_2_0000021A31B8A35E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000021A31B8BD58 push ebp; iretd	6_2_0000021A31B8BD59
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002220BB7A71E push cs; retf	7_2_000002220BB7A71F
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002220BB7BD58 push ebp; iretd	7_2_000002220BB7BD59
Source: C:\Windows\System32\rundll32.exe	Code function: 7_2_000002220BB7A35D push edi; iretd	7_2_000002220BB7A35E

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe TID: 7752

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2246602342.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589434374.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000003.00000002.1853213808.0000021A84E4E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1861843993.000001D38B638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll64.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtClose: Direct from: 0x7FF8E7DA23B0
Source: C:\Windows\System32\loaddll64.exe	NtDeviceIoControlFile: Direct from: 0x7FF908164B5E	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x23D5F31D169	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtDeviceIoControlFile: Direct from: 0x23D5F380141	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF694B8154B	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FF8E7DAFBDD	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtCreateThreadEx: Direct from: 0x7FF8E7DB45D2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtSetSecurityObject: Direct from: 0x7FF9081426A1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8E7DB3D00	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF694B81957	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQuerySystemInformation: Direct from: 0x23D5F31CD31	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x23D5F37FB61	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryVolumeInformationFile: Direct from: 0x23D5F3B21A7	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationToken: Direct from: 0x23D5F387DB0	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationToken: Direct from: 0x23D5F37FA82	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtClose: Direct from: 0x23D5F3801D0
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FF8E7DB4543	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtUnmapViewOfSection: Direct from: 0x7FF8E7DA33F2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtDelayExecution: Direct from: 0x7FF8E7DB1B34	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x23D5F3711BE	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x23D5F31D1B2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FF694B815F3	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8E7DB0E67	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x23D5F3A94C3	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x7FF8E7DAEE28	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQuerySystemInformation: Direct from: 0x23D5F38020B	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x23D5F31CBBB	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x23D5F3800E6	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x23D5F37F716	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtSetInformationThread: Direct from: 0x7FF694B8D459	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x23D5F31D0DC	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Direct from: 0x7FF694B81CF4	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_0000021A85107CFC GetUserNameA,strrchr,_snprintf,

3_2_0000021A85107CFC

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 3.3.rundll32.exe.21a85040000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll64.exe.23d5f300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.21a30350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.2220a330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.1d38b800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1932419653.0000021A31BCC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1905939888.0000021A3036D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1861923373.000001D38B8DC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1937652629.0000023D5F31D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1853432312.0000021A8513C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1935047568.000002220BBBC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1932094220.000002220A34D000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 7748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7964, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KzHndnydSG.dll	47%	ReversingLabs	Win64.Backdoor.Cobeacon

Source	Detection	Scanner	Label
https://185.216.71.202/broadcastA~	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcast32	0%	Avira URL Cloud	safe
https://185.216.71.202/	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcastLx	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcastXx	0%	Avira URL Cloud	safe
https://185.216.71.202//	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcastU~	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcastox	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcast	0%	Avira URL Cloud	safe
185.216.71.202	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcastm~	0%	Avira URL Cloud	safe
https://185.216.71.202/broadcastk~	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.216.71.202	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://185.216.71.202/broadcast32	loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202/broadcastA~	loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589492234.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844496263.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202/	loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589434374.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2246602342.0000023D5F1AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	KzHndnydSG.dll	false		high
http://www.symauth.com/rpa00	KzHndnydSG.dll	false		high
https://www.amazon.com	rundll32.exe, 00000007.00000002.1934840953.000002220A11F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	KzHndnydSG.dll	false		high
https://185.216.71.202/broadcastXx	loaddll64.exe, 00000000.00000003.2589492234.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202/broadcastLx	loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844496263.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202//	loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202/broadcastU~	loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202/broadcastox	loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	KzHndnydSG.dll	false		high
https://185.216.71.202/broadcast	loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202/broadcastk~	loaddll64.exe, 00000000.00000003.2589492234.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2589317398.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2534310845.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://185.216.71.202/broadcastm~	loaddll64.exe, 00000000.00000003.2899583217.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844376273.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.3147805688.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2844496263.0000023D5F1D2000.00000004.00000020.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000003.2899456465.0000023D5F1D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.216.71.202	unknown	Germany		43659	CLOUDCOMPUTINGDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568429
Start date and time:	2024-12-04 16:15:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KzHndnydSG.dll renamed because original name is a hash value
Original Sample Name:	5144ec5b8e4375671dd921a235f83dbe1620c50091bd6c9f91eb0cf362ea7c7f.exe
Detection:	MAL
Classification:	mal92.troj.evad.winDLL@72/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 231
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): crl.edge.digicert.com, ts-crl.ws.symantec.com, crl-symcprod.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: KzHndnydSG.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	105vjMVwfJ.dll	Get hash	malicious	CobaltStrike	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	Uii3leknna.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	3FHcnOdHz2.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://trinasolarus-my.sharepoint.com/:f:/g/personal/matt_hutchison_trinasolar_com/EuTm6V8CKxFPmV0-8tDYkU8B7bgg8BNpE1Urptg3NNJsZw?e=bQub2M	Get hash	malicious	Unknown	Browse	13.107.246.63
	H1WNju5cCI.dll	Get hash	malicious	Remcos	Browse	13.107.246.63
	1nbqpDK2ZJ.dll	Get hash	malicious	Remcos	Browse	13.107.246.63
	eF13KEkEKy.dll	Get hash	malicious	Remcos	Browse	13.107.246.63
	rukT6hBo6P.exe	Get hash	malicious	Phemedrone Stealer	Browse	13.107.246.63
	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	13.107.246.63
fp2e7a.wpc.phicdn.net	5LZZEXBpNE.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.229.221.95
	3861227PDF.exe	Get hash	malicious	AZORult	Browse	192.229.221.95
	Order_DEC2024.wsf	Get hash	malicious	Remcos	Browse	192.229.221.95
	lnvoice-1620804301.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	lnvoice-1620804301.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	P102462 INVOICE.exe	Get hash	malicious	FormBook	Browse	192.229.221.95
	30550107002876429834.js	Get hash	malicious	Strela Downloader	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.229.221.95
	ft.exe	Get hash	malicious	LummaC Stealer	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDCOMPUTINGDE	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	80.76.51.45
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	80.76.51.45
	cac2L07hOS.exe	Get hash	malicious	RedLine, Xmrig	Browse	85.31.47.143
	8UR62ANiqm.exe	Get hash	malicious	XWorm	Browse	194.169.175.112

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.411261737500153
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	KzHndnydSG.dll
File size:	1'050'144 bytes
MD5:	6af2398f4f0239a8fc1d7e64bf0b3be3
SHA1:	b9af7cc99389dcee4157d095b6479cbe4c3670fe
SHA256:	5144ec5b8e4375671dd921a235f83dbe1620c50091bd6c9f91eb0cf362ea7c7f
SHA512:	3414921782c6de919255cd50e8468b92e39439dd164bf0251ea175c5c669cd97bbb391cf6bfd0001e8ae02f414a8376d4a55dd450217236c0e9aeed3f5c38884
SSDEEP:	12288:HIDvCzFdigSVXfIG1gb73dhbWK9WTHtFfpMunHvpKLiT0s+u7oGCF0JFihLt3A+Y:kCF1G1gyauhCiSu7YKkhhZY
TLSH:	F1255A76A9F65A2AF0D8A07E1C7B8F6109B43DF44464D1FB03F0203A6AE21505F9DB5B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....V(e.........." .........8......-........................................`......+/....`........................................

File Icon


Icon Hash:	1a1de1e5e1239e38

Static PE Info

General

Entrypoint:	0x18003af2d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6528569E [Thu Oct 12 20:27:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/04/2015 20:00:00 13/04/2018 19:59:59
Subject Chain	CN="Oracle America, Inc.", OU=Code Signing Bureau, O="Oracle America, Inc.", L=Redwood Shores, S=California, C=US
Version:	3
Thumbprint MD5:	7F2E08A290C8767AFAFAFFFE09BE1149
Thumbprint SHA-1:	3B75816D15A6D8F4598E9CF5603F1839EE84D73D
Thumbprint SHA-256:	9D9365087330DF525292796A656A389C13E4F37ADA62693F4A951C0CB1B8B0BC
Serial:	12F0277E0F233B39F9419B06E8CDE352

Entrypoint Preview

Instruction
push ebp
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebx
dec eax
sub esp, 000000F8h
dec eax
lea ebp, dword ptr [esp+00000080h]
mov dword ptr [ebp+5Ch], edx
xorps xmm0, xmm0
movups dqword ptr [ebp+3Ch], xmm0
movaps ebp+30h, dqword ptr [xmm0]
movaps ebp+20h, dqword ptr [xmm0]
movaps ebp+10h, dqword ptr [xmm0]
movaps ebp+00h, dqword ptr [xmm0]
movaps ebp-10h, dqword ptr [xmm0]
movaps ebp-20h, dqword ptr [xmm0]
cmp dword ptr [000AB10Bh], 0Ah
mov eax, dword ptr [000AB101h]
setl cl
lea edx, dword ptr [eax+01h]
imul edx, eax
test dl, 00000001h
sete al
mov edx, ecx
and dl, al
mov byte ptr [ebp+77h], dl
xor cl, al
mov byte ptr [ebp+76h], cl
xor eax, eax
dec eax
lea ecx, dword ptr [0001EBA5h]
dec eax
arpl word ptr [eax+ecx], dx
xor dword ptr [ebp+edx*4-20h], 00001E27h
dec eax
add eax, 04h
dec eax
cmp eax, 68h
jne 00007F595909E58Ch
mov eax, 000008C0h
xor ecx, ecx
dec eax
mov dword ptr [ebp-58h], ecx
dec eax
lea esi, dword ptr [0001ECFDh]
dec eax
lea edi, dword ptr [0001ED5Ah]
dec esp
lea esi, dword ptr [0001ED5Bh]
dec esp
lea ecx, dword ptr [0001EAF8h]
dec esp
lea edx, dword ptr [0001EC31h]
dec esp
lea edi, dword ptr [0001ED36h]
dec esp
lea ebp, dword ptr [0001ED27h]
dec esp
lea esp, dword ptr [0001ED18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x509c6	0x386	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe9000	0x1b758	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x50d4c	0x4f8	.text
IMAGE_DIRECTORY_ENTRY_SECURITY	0xfee00	0x1820	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x105000	0x2c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5b5b0	0x140	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5b104	0x5b200	d943478eebdc6fcb7301e02c5972a6ae	False	0.34970582561728397	data	5.890325051671784	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x5d000	0x8afd8	0x87c00	fd87fa614ce73418aaaef9b097d68526	False	0.34015848008747696	data	6.1041379360185495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sdata	0xe8000	0x30	0x200	f927ec16777b24dc4dfb58c1c73b2751	False	0.056640625	data	0.41911781941489346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xe9000	0x1b758	0x1b800	28bd58503c3e58848ffcef5b44b72905	False	0.8856001420454546	data	7.577434366625928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x105000	0x2c	0x200	dd37af5637020c49f853952bd28448ab	False	0.10546875	data	0.5163459669794561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xe96e8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3445121951219512
RT_ICON	0xe9d50	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5067204301075269
RT_ICON	0xea038	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.5676229508196722
RT_ICON	0xea220	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.625
RT_ICON	0xea348	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6284648187633263
RT_ICON	0xeb1f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7766245487364621
RT_ICON	0xeba98	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.8358294930875576
RT_ICON	0xec160	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5939306358381503
RT_ICON	0xec6c8	0x13b8e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9997895570795474
RT_ICON	0x100258	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5776970954356846
RT_ICON	0x102800	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6177298311444653
RT_ICON	0x1038a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6778688524590164
RT_ICON	0x104230	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6879432624113475
RT_GROUP_ICON	0x104698	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xe9340	0x3a4	data	English	United States	0.45493562231759654

Exports

Name	Ordinal	Address
D3DAssemble	1	0x18003d768
D3DCompile	2	0x18003d9d2
D3DCompile2	3	0x18003d89b
D3DCompileFromFile	4	0x18003c63d
D3DCompressShaders	5	0x18003c3c5
D3DCreateBlob	6	0x18003d28e
D3DCreateFunctionLinkingGraph	7	0x18003b9ec
D3DCreateLinker	8	0x18003cc62
D3DDecompressShaders	9	0x18003c280
D3DDisassemble	10	0x18003d012
D3DDisassemble10Effect	11	0x18003bed1
D3DDisassemble11Trace	12	0x18003c008
D3DDisassembleRegion	13	0x18003c14d
D3DGetBlobPart	14	0x18003cedb
D3DGetDebugInfo	15	0x18003cb2f
D3DGetInputAndOutputSignatureBlob	16	0x18003b8a7
D3DGetInputSignatureBlob	17	0x18003bd9e
D3DGetOutputSignatureBlob	18	0x18003bc65
D3DGetTraceInstructionOffsets	19	0x18003bb1f
D3DLoadModule	20	0x18003d4f4
D3DPreprocess	21	0x18003d3c1
D3DReadFileToBlob	22	0x18003c9ec
D3DReflect	23	0x18003db17
D3DReflectLibrary	24	0x18003c782
D3DReturnFailure1	25	0x18003c8b5
D3DSetBlobPart	26	0x18003cd95
D3DStripShader	27	0x18003d149
D3DWriteBlobToFile	28	0x18003c4f8
DebugSetMute	29	0x18003d635
IEX	30	0x18003dc5a

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-04T16:18:11.371997+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49824	185.216.71.202	443	TCP
2024-12-04T16:18:40.107699+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49843	185.216.71.202	443	TCP
2024-12-04T16:19:11.124435+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49873	185.216.71.202	443	TCP
2024-12-04T16:19:41.497897+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49901	185.216.71.202	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 16:18:06.529167891 CET	49824	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:06.529207945 CET	443	49824	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:06.529278040 CET	49824	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:06.537703037 CET	49824	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:06.537718058 CET	443	49824	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:11.371926069 CET	443	49824	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:11.371997118 CET	49824	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:12.024350882 CET	49824	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:12.024391890 CET	443	49824	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:12.033190012 CET	49828	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:12.033252954 CET	443	49828	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:12.033318996 CET	49828	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:12.033622026 CET	49828	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:12.033638000 CET	443	49828	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:16.979782104 CET	443	49828	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:16.980535030 CET	49828	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:17.617750883 CET	49828	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:17.617773056 CET	443	49828	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:17.620914936 CET	49831	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:17.620954037 CET	443	49831	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:17.621021986 CET	49831	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:17.621114016 CET	49831	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:17.621159077 CET	443	49831	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:17.621211052 CET	49831	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:34.587663889 CET	49843	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:34.587712049 CET	443	49843	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:34.587785959 CET	49843	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:35.262460947 CET	49843	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:35.262494087 CET	443	49843	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:40.107507944 CET	443	49843	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:40.107698917 CET	49843	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:40.799866915 CET	49843	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:40.799889088 CET	443	49843	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:40.810472012 CET	49849	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:40.810519934 CET	443	49849	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:40.810584068 CET	49849	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:40.810920954 CET	49849	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:40.810928106 CET	443	49849	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:45.656960964 CET	443	49849	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:45.657032013 CET	49849	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:46.300682068 CET	49849	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:46.300724030 CET	443	49849	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:46.312330961 CET	49854	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:46.312391996 CET	443	49854	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:46.312464952 CET	49854	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:46.312591076 CET	49854	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:18:46.312635899 CET	443	49854	185.216.71.202	192.168.2.9
Dec 4, 2024 16:18:46.312685966 CET	49854	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:05.602777958 CET	49873	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:05.602838039 CET	443	49873	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:05.602933884 CET	49873	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:06.274463892 CET	49873	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:06.274506092 CET	443	49873	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:11.124361992 CET	443	49873	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:11.124434948 CET	49873	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:11.806694984 CET	49873	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:11.806734085 CET	443	49873	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:11.821742058 CET	49878	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:11.821794987 CET	443	49878	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:11.821866989 CET	49878	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:11.822441101 CET	49878	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:11.822453022 CET	443	49878	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:16.668773890 CET	443	49878	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:16.668909073 CET	49878	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:17.314708948 CET	49878	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:17.314754009 CET	443	49878	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:17.326632977 CET	49884	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:17.326680899 CET	443	49884	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:17.326805115 CET	49884	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:17.326886892 CET	49884	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:17.326932907 CET	443	49884	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:17.327020884 CET	49884	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:36.016300917 CET	49901	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:36.016345978 CET	443	49901	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:36.016416073 CET	49901	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:36.680788040 CET	49901	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:36.680818081 CET	443	49901	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:41.497802973 CET	443	49901	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:41.497896910 CET	49901	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:42.149719000 CET	49901	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:42.149749994 CET	443	49901	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:42.158153057 CET	49906	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:42.158195019 CET	443	49906	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:42.158277988 CET	49906	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:42.158525944 CET	49906	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:19:42.158540010 CET	443	49906	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:47.012856007 CET	443	49906	185.216.71.202	192.168.2.9
Dec 4, 2024 16:19:47.013056040 CET	49906	443	192.168.2.9	185.216.71.202
Dec 4, 2024 16:20:20.322170973 CET	49906	443	192.168.2.9	185.216.71.202

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 16:16:34.297009945 CET	1.1.1.1	192.168.2.9	0x560c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:16:34.297009945 CET	1.1.1.1	192.168.2.9	0x560c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 4, 2024 16:16:38.069500923 CET	1.1.1.1	192.168.2.9	0x11d1	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 4, 2024 16:16:38.069500923 CET	1.1.1.1	192.168.2.9	0x11d1	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:16:39
Start date:	04/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\KzHndnydSG.dll"
Imagebase:	0x7ff694b80000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1937652629.0000023D5F31D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:16:39
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:16:39
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1
Imagebase:	0x7ff70fc30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:16:39
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DAssemble
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000003.00000002.1853432312.0000021A8513C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:16:39
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",#1
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000004.00000002.1861923373.000001D38B8DC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:16:42
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000006.00000002.1932419653.0000021A31BCC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000006.00000003.1905939888.0000021A3036D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:16:45
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\KzHndnydSG.dll,D3DCompile2
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000007.00000002.1935047568.000002220BBBC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000007.00000003.1932094220.000002220A34D000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DAssemble
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompile2
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",IEX
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",DebugSetMute
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DWriteBlobToFile
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DStripShader
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DSetBlobPart
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReturnFailure1
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflectLibrary
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReflect
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DReadFileToBlob
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DPreprocess
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DLoadModule
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetTraceInstructionOffsets
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetOutputSignatureBlob
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputSignatureBlob
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetInputAndOutputSignatureBlob
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetDebugInfo
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	10:17:40
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DGetBlobPart
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	10:17:41
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassembleRegion
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	10:17:41
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble11Trace
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	10:17:41
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble10Effect
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	10:17:41
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDisassemble
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	10:17:42
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DDecompressShaders
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	10:17:42
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateLinker
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	10:17:42
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateFunctionLinkingGraph
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	10:17:42
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCreateBlob
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	10:17:42
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompressShaders
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	10:17:42
Start date:	04/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\KzHndnydSG.dll",D3DCompileFromFile
Imagebase:	0x7ff7d40d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 0000021A85107CFC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000021A85107F80: malloc.LIBCMT ref: 0000021A85107F97

GetUserNameA.ADVAPI32 ref: 0000021A85107DAA

Part of subcall function 0000021A851000A4: WSASocketA.WS2_32 ref: 0000021A851000E0

strrchr.LIBCMT ref: 0000021A85107DF2
_snprintf.LIBCMT ref: 0000021A85107F0C

Strings

:, xrefs: 0000021A85107F4F

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID: :
API String ID: 1789932928-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 210916ae00a8f62c935d8525a323aa4480340f95bbd46dededf9abf66342125d
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: E571CA70619B488FE794EF18C498B9AB7E2FBD9350F51496DB489C32A1CB74D885CB02

Function 0000021A8505D107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000021A8505D166
VirtualProtect.KERNELBASE ref: 0000021A8505D1AF

Strings

DCBA, xrefs: 0000021A8505D141

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: DCBA
API String ID: 544645111-2222620526
Opcode ID: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction ID: f5cbde60ef1f31431444e5a65bb490ecf9752c003431801e8ab898489f40a8bf
Opcode Fuzzy Hash: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction Fuzzy Hash: FD411773202B499EDB10CF65D8847D837B2F758BACF158212EE0D87B98DA34CA458740

Function 0000021A8510D0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 0000021A8510D1AB
(, xrefs: 0000021A8510D1A3

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: a9da84887bcbf257f7927f2eb847575689eb011cb2c08396f5c53132c68dc61b
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: F74184305597458FE7A4EB28D0587AAB7E2FBE8305F91497DE48AC32A1DB74C845CB03

Function 0000021A851000A4 Relevance: 4.6, APIs: 3, Instructions: 93
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 0000021A851000E0
WSAIoctl.WS2_32 ref: 0000021A8510013B
closesocket.WS2_32 ref: 0000021A851001CA

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: IoctlSocketclosesocket
String ID:
API String ID: 3445158922-0
Opcode ID: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction ID: 51e8469b186f960884087e5cbf230e0293e6c3778f5fdaf04a800d462358a683
Opcode Fuzzy Hash: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction Fuzzy Hash: 94311E7065D7888FE350EF68C448B5BFBE5FB98344F50492DE49AC2290E7B8D445CB02

Function 0000021A850FF9C0 Relevance: 1.6, APIs: 1, Instructions: 150
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 0000021A850FFA7C

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction ID: 374284e13050fc060a68a9bb8dbdf1f0b244e837cc574fa5efe7d73bb6a0c934
Opcode Fuzzy Hash: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction Fuzzy Hash: 45517B706197848FF354EB68C8597AAB7F2FB99306F41442EE586D26E1CB788841CB03

Non-executed Functions

Function 0000021A8512CB5C Relevance: 32.5, APIs: 16, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A8512CBBD

Part of subcall function 0000021A8512BF24: _getptd.LIBCMT ref: 0000021A8512BF3A
Part of subcall function 0000021A8512BF24: __updatetlocinfo.LIBCMT ref: 0000021A8512BF6F
Part of subcall function 0000021A8512BF24: __updatetmbcinfo.LIBCMT ref: 0000021A8512BF96

_errno.LIBCMT ref: 0000021A8512CBC2

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_fileno.LIBCMT ref: 0000021A8512CBEF

Part of subcall function 0000021A8512F624: _errno.LIBCMT ref: 0000021A8512F62D
Part of subcall function 0000021A8512F624: _invalid_parameter_noinfo.LIBCMT ref: 0000021A8512F638

write_multi_char.LIBCMT ref: 0000021A8512D22B
write_string.LIBCMT ref: 0000021A8512D248
write_multi_char.LIBCMT ref: 0000021A8512D265
write_string.LIBCMT ref: 0000021A8512D2C4
write_multi_char.LIBCMT ref: 0000021A8512D31D
free.LIBCMT ref: 0000021A8512D331
_isleadbyte_l.LIBCMT ref: 0000021A8512D402
write_char.LIBCMT ref: 0000021A8512D418
write_char.LIBCMT ref: 0000021A8512D439
_errno.LIBCMT ref: 0000021A8512D53C
_invalid_parameter_noinfo.LIBCMT ref: 0000021A8512D547

Strings

, xrefs: 0000021A8512D1FF
@, xrefs: 0000021A8512CBDB

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 2950348734-1077428164
Opcode ID: d0c11ce3fe9816791c8f3df9114e5837cab1464e9dac4973b158c2e25600f33a
Instruction ID: 4a9526d36164951d66a856d6a67abe48c5a51ae9c5d3e936854444bea59ab6b3
Opcode Fuzzy Hash: d0c11ce3fe9816791c8f3df9114e5837cab1464e9dac4973b158c2e25600f33a
Instruction Fuzzy Hash: BA62273091AB498AF768EA18C4497F9B7E2FBB5304F66015DDD86C31D2DB64DC438643

Function 0000021A8512BFCC Relevance: 32.5, APIs: 16, Strings: 2, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A8512C02D

Part of subcall function 0000021A8512BF24: _getptd.LIBCMT ref: 0000021A8512BF3A
Part of subcall function 0000021A8512BF24: __updatetlocinfo.LIBCMT ref: 0000021A8512BF6F
Part of subcall function 0000021A8512BF24: __updatetmbcinfo.LIBCMT ref: 0000021A8512BF96

_errno.LIBCMT ref: 0000021A8512C032

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_fileno.LIBCMT ref: 0000021A8512C05F

Part of subcall function 0000021A8512F624: _errno.LIBCMT ref: 0000021A8512F62D
Part of subcall function 0000021A8512F624: _invalid_parameter_noinfo.LIBCMT ref: 0000021A8512F638

write_multi_char.LIBCMT ref: 0000021A8512C68F
write_string.LIBCMT ref: 0000021A8512C6AC
write_multi_char.LIBCMT ref: 0000021A8512C6C9
write_string.LIBCMT ref: 0000021A8512C728
write_multi_char.LIBCMT ref: 0000021A8512C781
free.LIBCMT ref: 0000021A8512C795
_isleadbyte_l.LIBCMT ref: 0000021A8512C866
write_char.LIBCMT ref: 0000021A8512C87C
write_char.LIBCMT ref: 0000021A8512C89D
_errno.LIBCMT ref: 0000021A8512C997
_invalid_parameter_noinfo.LIBCMT ref: 0000021A8512C9A2

Strings

, xrefs: 0000021A8512C663
@, xrefs: 0000021A8512C04B

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 2950348734-1077428164
Opcode ID: c5deec5cbe16e2340369a60e72f21974cfb8fc15909817b37a753fe08bdbb5a8
Instruction ID: 4cb0333a66b0c033ec88644be34e8aff37e19f3ddf0815a8e850988ddbf5755a
Opcode Fuzzy Hash: c5deec5cbe16e2340369a60e72f21974cfb8fc15909817b37a753fe08bdbb5a8
Instruction Fuzzy Hash: 3962F73091AB459AFB68FA58C4497FABBD3FB75718F26411DDE87C31C2DB2498028643

Function 0000021A851305E4 Relevance: 28.7, APIs: 14, Strings: 2, Instructions: 678
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 0000021A8513063A
_errno.LIBCMT ref: 0000021A85130641
_invalid_parameter_noinfo.LIBCMT ref: 0000021A8513064C

Strings

U, xrefs: 0000021A85130BAE
@, xrefs: 0000021A85130CC7

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: @$U
API String ID: 3902385426-1013562545
Opcode ID: da7689ce54228aaf4bddcdee74e72ebc99834143e299237826ea97d9c58be4b6
Instruction ID: 12ef77020c1905bf635d0bcca45be79d5a4e1d6d0d7a9804a7aaa653e9e0d33a
Opcode Fuzzy Hash: da7689ce54228aaf4bddcdee74e72ebc99834143e299237826ea97d9c58be4b6
Instruction Fuzzy Hash: 4E220A31119B488BE718FF98D8587EA77E2FBA5710F11052DE886C31A1DB39D942CB43

Function 0000021A8507F9E4 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000021A8507FA3A
_errno.LIBCMT ref: 0000021A8507FA41
_invalid_parameter_noinfo.LIBCMT ref: 0000021A8507FA4C

Strings

U, xrefs: 0000021A8507FFAE

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction ID: e75b50227c9597f5122232bb1da3084e972fcf91ac75080e798f678b5fea0121
Opcode Fuzzy Hash: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction Fuzzy Hash: A4123732206A458EEB208F24D84C3DA73B3F7A5765F520112DE8947BA4DB3EC947CB12

Function 0000021A8507B544 Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 594COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000021A8507B966
write_multi_char.LIBCMT ref: 0000021A8507BA8F
write_string.LIBCMT ref: 0000021A8507BAAC
write_multi_char.LIBCMT ref: 0000021A8507BAC9
write_string.LIBCMT ref: 0000021A8507BB28
write_string.LIBCMT ref: 0000021A8507BB5F
write_multi_char.LIBCMT ref: 0000021A8507BB81
free.LIBCMT ref: 0000021A8507BB95
_isleadbyte_l.LIBCMT ref: 0000021A8507BC66
write_char.LIBCMT ref: 0000021A8507BC7C
write_char.LIBCMT ref: 0000021A8507BC9D
_errno.LIBCMT ref: 0000021A8507BD97
_invalid_parameter_noinfo.LIBCMT ref: 0000021A8507BDA2

Strings

, xrefs: 0000021A8507BA63

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: write_multi_charwrite_string$write_char$_errno_invalid_parameter_noinfo_isleadbyte_l_malloc_crtfree
String ID:
API String ID: 2600834739-3916222277
Opcode ID: 95db6e67095b1cff7f5ed97d2d1907cd3ce88e16966fe85260d16a5165bf001e
Instruction ID: cc87204c9a7e68dbd9ecb699c0a60a3caa5d4fb118591c395f0ca3c9d5ed649b
Opcode Fuzzy Hash: 95db6e67095b1cff7f5ed97d2d1907cd3ce88e16966fe85260d16a5165bf001e
Instruction Fuzzy Hash: 0532147260A6848EFB658A15D14C3FE6BB3B761766F164005DE46836D8FB7AC843CB03

Function 0000021A85085900 Relevance: 5.9, Strings: 4, Instructions: 884COMMON

Download Yara Rule

Strings

uctDir, xrefs: 0000021A85086583, 0000021A850865FC, 0000021A85086675, 0000021A850866EE
, xrefs: 0000021A85085FB3
<, xrefs: 0000021A85085FBE
Changing the code in this way will not affect the quality of the resulting optimized code., xrefs: 0000021A8508656F, 0000021A850865E8, 0000021A85086661, 0000021A850866DA

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: $<$Changing the code in this way will not affect the quality of the resulting optimized code.$uctDir
API String ID: 0-3812399124
Opcode ID: 8608a6510d78ded6d7b72b0d922fa4575634e3d77ec576b96213c711cfdf47ce
Instruction ID: 51a9977261efd1fc861cc5bfe18367aa083459210aaac927ff1157e6854c7835
Opcode Fuzzy Hash: 8608a6510d78ded6d7b72b0d922fa4575634e3d77ec576b96213c711cfdf47ce
Instruction Fuzzy Hash: F192E4B2325A4087DB58CB1DE4A573AB7A1F3C8B84F44512AEB9B87798CE3CD551CB04

Function 0000021A8505B1F4 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 564COMMON

Download Yara Rule

Strings

h, xrefs: 0000021A8505B5E3

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 17c874fdfca0e46784307bd0b6e64768fd4c1a3d89b12e191bda19c005753cbd
Instruction ID: 22626b7d01ff40cf3ff71cebfb41e808a324404d3690a12a59d3d7d751bc1113
Opcode Fuzzy Hash: 17c874fdfca0e46784307bd0b6e64768fd4c1a3d89b12e191bda19c005753cbd
Instruction Fuzzy Hash: 7A520D3110A640CEE630DF54E4596EEB732F7E5364F120612EE8A52AA98B7DE447CF13

Function 0000021A85129D70 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 0000021A85129DA4

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: a07fc22a08f5e67a1c7ac2f0e580d16a86d42523d264ac07f3f61779ccf3c060
Instruction ID: 1e00156c5564a90e23ade4b91a9a365cf727961b55fd8c72e0c7d3409b4035cf
Opcode Fuzzy Hash: a07fc22a08f5e67a1c7ac2f0e580d16a86d42523d264ac07f3f61779ccf3c060
Instruction Fuzzy Hash: 53A1C931619E488FEF54FFB5E89CAA937E2F7B8301721892A900AD3170EA7CD555CB40

Function 0000021A85137D40 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eab68fb9e7b9d9b3771e682694464f1b14661e19fa50621f11c28dc9949e1d3
Instruction ID: 25fd609aa4b718287f859947c4d176b1c29280f9bc2c41f7ffe662761d6ff6e5
Opcode Fuzzy Hash: 9eab68fb9e7b9d9b3771e682694464f1b14661e19fa50621f11c28dc9949e1d3
Instruction Fuzzy Hash: 81621A312286558FD31CCB1CC4B1B7AB7E1FB89340F44896DE28BCB692C639D945CB91

Function 0000021A851373D0 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ac40124cc23334790defe89c47a364b21545b827a4d258faee6f67e278948b
Instruction ID: 41d3625e4383a40479733c4d728de319f4f09d823d0a5ec406c0432429c13510
Opcode Fuzzy Hash: 08ac40124cc23334790defe89c47a364b21545b827a4d258faee6f67e278948b
Instruction Fuzzy Hash: D052ED312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE28ACB692C639E545CB91

Function 0000021A85049680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 428beff660b2dd63aba7e3c02aee92ffa63a6193adce4ad15022cc3a3e5488b1
Instruction ID: 1a290f31edd9f679abac924eb81627c8e5509faa6d0653f6e5d59f8ab952bd49
Opcode Fuzzy Hash: 428beff660b2dd63aba7e3c02aee92ffa63a6193adce4ad15022cc3a3e5488b1
Instruction Fuzzy Hash: FAF1D932705A428AEB20CB55D5943EE63B3F7A47ACF920425DE4997789EF34C907CB41

Function 0000021A8504916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1f6ea64bb700f135ef9746f642ebdda6f198d38bec0304a88397afe1d72f797d
Instruction ID: 9adccc049a9a7dfbc84f01c46dfd5d33ab690ac2304696e28a00338c77fda9c5
Opcode Fuzzy Hash: 1f6ea64bb700f135ef9746f642ebdda6f198d38bec0304a88397afe1d72f797d
Instruction Fuzzy Hash: 0DE1E632706A4299EF209B94D4843EE63B3F7A47ACF920521DE4DA7699EB34C907C741

Function 0000021A8507B3CC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A8507B42D

Part of subcall function 0000021A8507B324: _getptd.LIBCMT ref: 0000021A8507B33A
Part of subcall function 0000021A8507B324: __updatetlocinfo.LIBCMT ref: 0000021A8507B36F
Part of subcall function 0000021A8507B324: __updatetmbcinfo.LIBCMT ref: 0000021A8507B396

_fileno.LIBCMT ref: 0000021A8507B45F

Part of subcall function 0000021A8507EA24: _errno.LIBCMT ref: 0000021A8507EA2D
Part of subcall function 0000021A8507EA24: _invalid_parameter_noinfo.LIBCMT ref: 0000021A8507EA38

write_multi_char.LIBCMT ref: 0000021A8507BA8F
write_string.LIBCMT ref: 0000021A8507BAAC
_errno.LIBCMT ref: 0000021A8507B432

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_errno.LIBCMT ref: 0000021A8507BD97
_invalid_parameter_noinfo.LIBCMT ref: 0000021A8507BDA2

Strings

@, xrefs: 0000021A8507B44B
-, xrefs: 0000021A8507BA40

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$@
API String ID: 3246410048-1222683799
Opcode ID: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction ID: 2dd82cdc119dc4d88e52bcc9e5409d9af5467806e3ddfa4aba10f3fc6c7275db
Opcode Fuzzy Hash: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction Fuzzy Hash: 99B13972206A808DFB65CB6494483FE7BB2F7607B1F164006DE49876D8EB3AC943C742

Function 0000021A85130EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A85130F1E

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

__doserrno.LIBCMT ref: 0000021A85130F15

Part of subcall function 0000021A8512B6A4: _getptd_noexit.LIBCMT ref: 0000021A8512B6A8

__doserrno.LIBCMT ref: 0000021A85130F7B
_errno.LIBCMT ref: 0000021A85130F82
_invalid_parameter_noinfo.LIBCMT ref: 0000021A85130FE6

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: 37927a83b646308858e88c90abce0c54259266c542e4681438a79092a105f31e
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: AC31F37021AB444FE718BFA8C89A3F936D6EB65720F170259EC16872D3D678AD018753

Function 0000021A85078F1C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

__crtCorExitProcess.LIBCMT ref: 0000021A85078F24
free.LIBCMT ref: 0000021A85078F62

Part of subcall function 0000021A85078828: _errno.LIBCMT ref: 0000021A85078848

free.LIBCMT ref: 0000021A85078F77
free.LIBCMT ref: 0000021A85078F98
free.LIBCMT ref: 0000021A85078FAD
free.LIBCMT ref: 0000021A85078FC1
free.LIBCMT ref: 0000021A85078FCD
free.LIBCMT ref: 0000021A85078FF8
free.LIBCMT ref: 0000021A85079019
free.LIBCMT ref: 0000021A85079032
free.LIBCMT ref: 0000021A85079063

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free$ExitProcess__crt_errno
String ID:
API String ID: 1362684943-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: b911a7630b26d9c8fb49de1dd76843791b0f20c6c0d0ca5fb99b04fa506015be
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: F9413B396036048DFE95AB11E85E3E82373BF747B6F0B15259D194A2E6CF39C4538243

Function 0000021A850802EC Relevance: 16.6, APIs: 11, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8508031E

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

__doserrno.LIBCMT ref: 0000021A85080315

Part of subcall function 0000021A8507AAA4: _getptd_noexit.LIBCMT ref: 0000021A8507AAA8

__doserrno.LIBCMT ref: 0000021A8508037B
_errno.LIBCMT ref: 0000021A85080382
_invalid_parameter_noinfo.LIBCMT ref: 0000021A850803E6

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction ID: 4460b13c88539fc46f9132eab139f60c13ca5e7b8cb37a60ccdea24d003023c2
Opcode Fuzzy Hash: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction Fuzzy Hash: AE31F1323066808FE72AAF659DA97ED2677ABA07B0F574114AE1107BC3C638C443C712

Function 0000021A85131CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A85131D03

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

__doserrno.LIBCMT ref: 0000021A85131CFB

Part of subcall function 0000021A8512B6A4: _getptd_noexit.LIBCMT ref: 0000021A8512B6A8

__lock_fhandle.LIBCMT ref: 0000021A85131D47
_lseeki64_nolock.LIBCMT ref: 0000021A85131D60
_unlock_fhandle.LIBCMT ref: 0000021A85131D83

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: 8a7ac419cebc6a1dd247f1b46d3bbedf7e61330aaa3a753ba8f46373d664becd
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: EF21383561AB000EF718BB58DC5E3F9B6D2EB62320F1B065DEC5A871D3C76858018663

Function 0000021A85131B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A85131B8B

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

__doserrno.LIBCMT ref: 0000021A85131B83

Part of subcall function 0000021A8512B6A4: _getptd_noexit.LIBCMT ref: 0000021A8512B6A8

__lock_fhandle.LIBCMT ref: 0000021A85131BCF
_lseek_nolock.LIBCMT ref: 0000021A85131BE8
_unlock_fhandle.LIBCMT ref: 0000021A85131C09

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: 7a8f05e3cdea77c1137cc7479b38a37592adee0ce26fa0cbf42fb02bc9ee1c91
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: 0A214B3074A3000EF718BB58C8AE3FCB6D2DBA6320F1B061CEC56871E3D76858428263

Function 0000021A850810D8 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85081103

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

__doserrno.LIBCMT ref: 0000021A850810FB

Part of subcall function 0000021A8507AAA4: _getptd_noexit.LIBCMT ref: 0000021A8507AAA8

__lock_fhandle.LIBCMT ref: 0000021A85081147
_lseeki64_nolock.LIBCMT ref: 0000021A85081160
_unlock_fhandle.LIBCMT ref: 0000021A85081183

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction ID: c55fa70f029634aaa143224c76ca2c604a717fedb8727b8bdc19f9c07f629fdc
Opcode Fuzzy Hash: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction Fuzzy Hash: 8921CF3262664059FA096F159C097ED6673ABA0BF2F0F8214AE350BBD2C73884538712

Function 0000021A85080F60 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85080F8B

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

__doserrno.LIBCMT ref: 0000021A85080F83

Part of subcall function 0000021A8507AAA4: _getptd_noexit.LIBCMT ref: 0000021A8507AAA8

__lock_fhandle.LIBCMT ref: 0000021A85080FCF
_lseek_nolock.LIBCMT ref: 0000021A85080FE8
_unlock_fhandle.LIBCMT ref: 0000021A85081009

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction ID: e36bedf90b5492b79e3757300423a30ebc3d761d258bbce13e892e3d21f749ac
Opcode Fuzzy Hash: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction Fuzzy Hash: 9721F2322165804DF61A6B159C597EC6673ABA07F2F1B4114AE150BBD3DBBC8853C712

Function 0000021A85139EA0 Relevance: 13.7, APIs: 9, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85139EC6
_errno.LIBCMT ref: 0000021A85139EBB

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction ID: 947b1b8ec73725f3ef57ec08568a6616a6f1a2c56b4fe76989c0a6567493e904
Opcode Fuzzy Hash: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction Fuzzy Hash: 8A51033011AB1A4AEB64FF18C4593F576D3EB74321F56026AE895C71D6EB2CC8818693

Function 0000021A850892A0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000021A850892C6
_errno.LIBCMT ref: 0000021A850892BB

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction ID: 939272e99beaa1e786bd1f64302e8297cb9e2d4515812d00d04e02c5587df70e
Opcode Fuzzy Hash: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction Fuzzy Hash: 1B41F3716073908DFB68BB918848BE932F3E774FB1F964521AE5443FC5E72988639602

Function 0000021A85130504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A8513052F

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

__doserrno.LIBCMT ref: 0000021A85130527

Part of subcall function 0000021A8512B6A4: _getptd_noexit.LIBCMT ref: 0000021A8512B6A8

__lock_fhandle.LIBCMT ref: 0000021A85130573
_unlock_fhandle.LIBCMT ref: 0000021A851305AD

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: 83ad6aa67f6ff139c97a55226320f694e3a50cc86d2415035b6a9bf6b1a522a5
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: 8C21383060A7004EF714BB98D89E3F876C3EBA5321F17025DE856872D3D7A85C4186A7

Function 0000021A8512F828 Relevance: 13.6, APIs: 9, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A8512F849

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

__doserrno.LIBCMT ref: 0000021A8512F841

Part of subcall function 0000021A8512B6A4: _getptd_noexit.LIBCMT ref: 0000021A8512B6A8

__lock_fhandle.LIBCMT ref: 0000021A8512F88D
_close_nolock.LIBCMT ref: 0000021A8512F8A0
_unlock_fhandle.LIBCMT ref: 0000021A8512F8B9

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 77a1ecbdbdea952cc00a416730c08361b3279c994f44e564540f98441c30999a
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: 3721D23262AB044EF715FB64C89E3E8B692EB61320F1B052DE816872D7D77488808763

Function 0000021A8507F904 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8507F92F

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

__doserrno.LIBCMT ref: 0000021A8507F927

Part of subcall function 0000021A8507AAA4: _getptd_noexit.LIBCMT ref: 0000021A8507AAA8

__lock_fhandle.LIBCMT ref: 0000021A8507F973
_unlock_fhandle.LIBCMT ref: 0000021A8507F9AD

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction ID: db99278876f9ab65a723fa6ab307c0001c8b39ad4ce34a1b0a0625b578ce0932
Opcode Fuzzy Hash: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction Fuzzy Hash: 642101723066445EF606AF2598493ED2673ABA0BB2F0B4114AE150B3D3EB79C843C323

Function 0000021A8507EC28 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8507EC49

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

__doserrno.LIBCMT ref: 0000021A8507EC41

Part of subcall function 0000021A8507AAA4: _getptd_noexit.LIBCMT ref: 0000021A8507AAA8

__lock_fhandle.LIBCMT ref: 0000021A8507EC8D
_close_nolock.LIBCMT ref: 0000021A8507ECA0
_unlock_fhandle.LIBCMT ref: 0000021A8507ECB9

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction ID: f165a83b9a334733dd70789a699a2610beb1f0b65b9c852d252e04ad121473d6
Opcode Fuzzy Hash: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction Fuzzy Hash: 9911D3323076844DF615AF359D4D3DC6673A7A07B2F1B4624AE19073D3D67AC8438726

Function 0000021A85129B34 Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000021A85129B62

Part of subcall function 0000021A85129428: RtlFreeHeap.NTDLL ref: 0000021A8512943E
Part of subcall function 0000021A85129428: _errno.LIBCMT ref: 0000021A85129448

free.LIBCMT ref: 0000021A85129B77
free.LIBCMT ref: 0000021A85129B98
free.LIBCMT ref: 0000021A85129BAD
free.LIBCMT ref: 0000021A85129BC1
free.LIBCMT ref: 0000021A85129BCD
free.LIBCMT ref: 0000021A85129BF8
free.LIBCMT ref: 0000021A85129C19
free.LIBCMT ref: 0000021A85129C32
free.LIBCMT ref: 0000021A85129C63

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction ID: d7c51686a5e1dd146e0ea3f2528a0804d64856e45da4ba9f6fb9cadb4be6897d
Opcode Fuzzy Hash: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction Fuzzy Hash: 0041103065AB4A8FFBA4FB5CD8D9BED32D3F768311F5540689809C2291DB2C9895CB12

Function 0000021A850F460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A850F46A9

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

malloc.LIBCMT ref: 0000021A850F46B3

Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294FC
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A85129501

malloc.LIBCMT ref: 0000021A850F46BE
free.LIBCMT ref: 0000021A850F487E
free.LIBCMT ref: 0000021A850F4886
free.LIBCMT ref: 0000021A850F488E

Part of subcall function 0000021A850F54F0: malloc.LIBCMT ref: 0000021A850F553A
Part of subcall function 0000021A850F54F0: malloc.LIBCMT ref: 0000021A850F5545
Part of subcall function 0000021A850F54F0: free.LIBCMT ref: 0000021A850F562C
Part of subcall function 0000021A850F54F0: free.LIBCMT ref: 0000021A850F5634

free.LIBCMT ref: 0000021A850F489A
free.LIBCMT ref: 0000021A850F48A7
free.LIBCMT ref: 0000021A850F48B4

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: c13e910bcb7a38cf59edeca8c5193725c2df47c0ed797f3846658d36c5fa183e
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: FC91A134719B484FE759EAAC94597FD73E2EBA5710F51025EDC8AD72C2EE2098038683

Function 0000021A85043A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85043AA9

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

malloc.LIBCMT ref: 0000021A85043AB3

Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788FC
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A85078901

malloc.LIBCMT ref: 0000021A85043ABE
free.LIBCMT ref: 0000021A85043C7E
free.LIBCMT ref: 0000021A85043C86
free.LIBCMT ref: 0000021A85043C8E

Part of subcall function 0000021A850448F0: malloc.LIBCMT ref: 0000021A8504493A
Part of subcall function 0000021A850448F0: malloc.LIBCMT ref: 0000021A85044945
Part of subcall function 0000021A850448F0: free.LIBCMT ref: 0000021A85044A2C
Part of subcall function 0000021A850448F0: free.LIBCMT ref: 0000021A85044A34

free.LIBCMT ref: 0000021A85043C9A
free.LIBCMT ref: 0000021A85043CA7
free.LIBCMT ref: 0000021A85043CB4

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction ID: e020d260bbf804c3fde3b629c6c64e4a9cf47c4256bdb980e48d08ae86ee08b9
Opcode Fuzzy Hash: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction Fuzzy Hash: C47117323063854EEB209B2694487EE77B2FBA5BDCF125015DE4A47B86DB38C447CB42

Function 0000021A85076C8C Relevance: 10.6, APIs: 7, Instructions: 145stringCOMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 0000021A85076CA8
malloc.LIBCMT ref: 0000021A85076CF3
strtok.LIBCMT ref: 0000021A85076D5B
strtok.LIBCMT ref: 0000021A85076D9B
_time64.LIBCMT ref: 0000021A85076DB3
_time64.LIBCMT ref: 0000021A85076E6B
_time64.LIBCMT ref: 0000021A85076F2A

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _time64$strtok$malloc
String ID:
API String ID: 2141844861-0
Opcode ID: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction ID: e1c1326b434d97c28a4562f21e520ed58cdbdf4e4d26112e8d6c1b1b7b652219
Opcode Fuzzy Hash: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction Fuzzy Hash: 75912779506A44CEE761CF04E88839977B2F3A4375F524219DD9A8ABB4DB3DC493CB02

Function 0000021A8507B198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0000021A8507B1B5

Part of subcall function 0000021A8507EA24: _errno.LIBCMT ref: 0000021A8507EA2D
Part of subcall function 0000021A8507EA24: _invalid_parameter_noinfo.LIBCMT ref: 0000021A8507EA38

_errno.LIBCMT ref: 0000021A8507B1C5

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_errno.LIBCMT ref: 0000021A8507B1E1
_isatty.LIBCMT ref: 0000021A8507B242
_getbuf.LIBCMT ref: 0000021A8507B24E

Strings

, xrefs: 0000021A8507B1D0

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-3916222277
Opcode ID: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction ID: f93b1f6706466b55c662536de75739f9ae96f51e99140e027755c08fee60d417
Opcode Fuzzy Hash: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction Fuzzy Hash: B1411472602B444EEB689F24C4593BC37B2E764B71F164215DE55873C5FA36C853C742

Function 0000021A85139D20 Relevance: 10.6, APIs: 7, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A85139D54

Part of subcall function 0000021A8512BF24: _getptd.LIBCMT ref: 0000021A8512BF3A
Part of subcall function 0000021A8512BF24: __updatetlocinfo.LIBCMT ref: 0000021A8512BF6F
Part of subcall function 0000021A8512BF24: __updatetmbcinfo.LIBCMT ref: 0000021A8512BF96

_errno.LIBCMT ref: 0000021A85139D6F
_invalid_parameter_noinfo.LIBCMT ref: 0000021A85139D7A

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction ID: a79e4131d2a574514a53c25bb908308374d53e092e27a41003798f4db3336400
Opcode Fuzzy Hash: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction Fuzzy Hash: E7315C34619B084FD754EF1CD09A7E976D2EB68320F5602A9A849C72D2DB74DC448786

Function 0000021A851299D8 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A851299FE

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85129A0A
__crtIsPackagedApp.LIBCMT ref: 0000021A85129A1B
_dosmaperr.LIBCMT ref: 0000021A85129A65

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: 7ac65a719d0b5cbe544640581cb4dbb4dac49cb2904c98b852c0fc714c919b43
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: 7B31B130615B094FEB54FB6D98097A972D3FFA8320F15466DA84AC32E2DB78C8818743

Function 0000021A85134818 Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85134831

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

__lock_fhandle.LIBCMT ref: 0000021A85134879
__doserrno.LIBCMT ref: 0000021A851348AE
_errno.LIBCMT ref: 0000021A851348B5
_unlock_fhandle.LIBCMT ref: 0000021A851348C5

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction ID: e967d1a9a9d037d7c706fc30a0a13d7837c66aca4d52a11d8eeed75663e20fc4
Opcode Fuzzy Hash: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction Fuzzy Hash: 0821B8347067804EF614BFA8D8ED3E87692EB65310F170668E805872D3D6A85C408757

Function 0000021A85078DD8 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85078DFE

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85078E0A
__crtIsPackagedApp.LIBCMT ref: 0000021A85078E1B
_dosmaperr.LIBCMT ref: 0000021A85078E65

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction ID: 1074b3d84e5e9b67af92676856aa6948624395a31fa34af9b50950f2106ddea5
Opcode Fuzzy Hash: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction Fuzzy Hash: 2F31A571702B448AFB14AF22D81C3A866F3BFA4BB5F0645249E45477E1EF39C4028302

Function 0000021A85089120 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A85089154

Part of subcall function 0000021A8507B324: _getptd.LIBCMT ref: 0000021A8507B33A
Part of subcall function 0000021A8507B324: __updatetlocinfo.LIBCMT ref: 0000021A8507B36F
Part of subcall function 0000021A8507B324: __updatetmbcinfo.LIBCMT ref: 0000021A8507B396

_errno.LIBCMT ref: 0000021A8508916F
_invalid_parameter_noinfo.LIBCMT ref: 0000021A8508917A

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction ID: 80f1fb1ee2a21670b765d5e833619868576a9ede4d5c0650522553f87cc86ebf
Opcode Fuzzy Hash: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction Fuzzy Hash: 8A31A07220A7848DEA24AB91988CBDDB6B7F364BF0F5A4521EE5843F85DB34D852C701

Function 0000021A8512A6D0 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8512A70C

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A8512A717
memcpy_s.LIBCMT ref: 0000021A8512A7DC
_fileno.LIBCMT ref: 0000021A8512A847
_filbuf.LIBCMT ref: 0000021A8512A875
_errno.LIBCMT ref: 0000021A8512A8C5

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: db94bfa3e05745ddfd022cbf4e73b533bb3f2b7d50a0c23da0129ecab3f77512
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: 9261B330219F094AE66CF62C584E2B576D3E7A4721F16032EE856C36D1EFA19C5286C7

Function 0000021A85102854 Relevance: 9.2, APIs: 6, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021A85107F80: malloc.LIBCMT ref: 0000021A85107F97

Part of subcall function 0000021A8512A1E8: _errno.LIBCMT ref: 0000021A8512A13F
Part of subcall function 0000021A8512A1E8: _invalid_parameter_noinfo.LIBCMT ref: 0000021A8512A14A

fseek.LIBCMT ref: 0000021A85102929
_ftelli64.LIBCMT ref: 0000021A85102933
fseek.LIBCMT ref: 0000021A85102947
fclose.LIBCMT ref: 0000021A8510297E
fclose.LIBCMT ref: 0000021A851029D3
malloc.LIBCMT ref: 0000021A851029E2

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: 417821470380a0be72167e50fe9e7529daa0527b23b6f6866b635ca6e5c7be6a
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: 8A711D305197488FE784FB18C459B9AB7E2FBE8354F514A2DB48AC32A2CB74D945CB43

Function 0000021A85079AD0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85079B0C

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85079B17
memcpy_s.LIBCMT ref: 0000021A85079BDC
_fileno.LIBCMT ref: 0000021A85079C47
_filbuf.LIBCMT ref: 0000021A85079C75
_errno.LIBCMT ref: 0000021A85079CC5

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction ID: 55f995aa1f6d13ca50dcc61928d4aa3b60008ed7db3fc7a8aba826f7746e204b
Opcode Fuzzy Hash: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction Fuzzy Hash: B15129317062408AFE248AA659087E966F3B7B4BF5F164B10AE3943BD5DB36C4938642

Function 0000021A85051C54 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 0000021A85057380: malloc.LIBCMT ref: 0000021A85057397

Part of subcall function 0000021A850795E8: _errno.LIBCMT ref: 0000021A8507953F
Part of subcall function 0000021A850795E8: _invalid_parameter_noinfo.LIBCMT ref: 0000021A8507954A

fseek.LIBCMT ref: 0000021A85051D29
_ftelli64.LIBCMT ref: 0000021A85051D33
fseek.LIBCMT ref: 0000021A85051D47
fclose.LIBCMT ref: 0000021A85051D7E
fclose.LIBCMT ref: 0000021A85051DD3
malloc.LIBCMT ref: 0000021A85051DE2

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction ID: b7aaa6fbde5d61ca9f73ac30510948f41f38b338748b03c31e1e4dde060da2de
Opcode Fuzzy Hash: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction Fuzzy Hash: 43615C32219A848AEB20DB15E48439EB772F7D57A4F114116EECD43BAACF38C446CF02

Function 0000021A8512A1E8 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8512A13F

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A8512A14A
_getstream.LIBCMT ref: 0000021A8512A16A
_errno.LIBCMT ref: 0000021A8512A17C
_errno.LIBCMT ref: 0000021A8512A18E
_openfile.LIBCMT ref: 0000021A8512A1BC

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: 6b91255470f0298df72f799a71b018c2e440a89e07320b82602f7ee47ebca1be
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: EB21953061AB4A4FF790FB2954093AA76D3EBA9320F46096AAC49C3296EF64CC414753

Function 0000021A85101080 Relevance: 9.1, APIs: 6, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85101097

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

free.LIBCMT ref: 0000021A851010E0

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: 0c73c7b72b6a33668c7a569c1f30df189110b894a14be3977d659f2487461d17
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: 8F312F30959B489FE284FB28C4597DAB7E2FBA8354F51061DB88AD32A1DB349941C743

Function 0000021A850795E8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8507953F

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000021A8507954A
_getstream.LIBCMT ref: 0000021A8507956A
_errno.LIBCMT ref: 0000021A8507957C
_errno.LIBCMT ref: 0000021A8507958E
_openfile.LIBCMT ref: 0000021A850795BC

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction ID: 0bdc26476dd16ca909d59ce14be002701a1376b2cc534034fe24da8f8a553e81
Opcode Fuzzy Hash: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction Fuzzy Hash: 4F210D713073964DFB619B7198053DEA6B3B7647E1F064820AD8987786EF3EC4438712

Function 0000021A85050480 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85050497

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

free.LIBCMT ref: 0000021A850504E0

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction ID: 0849ab802602322d96480bdfc0e63ab860ec7bf234e1e82201d06cd033bb5cdb
Opcode Fuzzy Hash: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction Fuzzy Hash: 8C214132619A40C9EA60EB11E4583DE6772F7E47F4F110211BE8E53AEADE3CC5428B42

Function 0000021A8507CE24 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000021A8507CE41

Part of subcall function 0000021A8507ABEC: _set_error_mode.LIBCMT ref: 0000021A8507ABF5
Part of subcall function 0000021A8507ABEC: _set_error_mode.LIBCMT ref: 0000021A8507AC04
Part of subcall function 0000021A8507ABEC: _NMSG_WRITE.LIBCMT ref: 0000021A8507AC1B
Part of subcall function 0000021A8507ABEC: _NMSG_WRITE.LIBCMT ref: 0000021A8507AC25

_NMSG_WRITE.LIBCMT ref: 0000021A8507CE4B

Part of subcall function 0000021A8507AC60: _set_error_mode.LIBCMT ref: 0000021A8507ACA5
Part of subcall function 0000021A8507AC60: _set_error_mode.LIBCMT ref: 0000021A8507ACB6
Part of subcall function 0000021A8507AC60: __crtMessageBoxW.LIBCMT ref: 0000021A8507ADC9

Part of subcall function 0000021A85078F1C: __crtCorExitProcess.LIBCMT ref: 0000021A85078F24
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85078F62
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85078F77
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85078F98
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85078FAD
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85078FC1
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85078FCD
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85078FF8
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85079019
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85079032
Part of subcall function 0000021A85078F1C: free.LIBCMT ref: 0000021A85079063

_malloc_crt.LIBCMT ref: 0000021A8507CE77

Part of subcall function 0000021A8507D778: malloc.LIBCMT ref: 0000021A8507D7A3

_errno.LIBCMT ref: 0000021A8507CE84
_lock.LIBCMT ref: 0000021A8507CE98
free.LIBCMT ref: 0000021A8507CEB9

Part of subcall function 0000021A85078828: _errno.LIBCMT ref: 0000021A85078848

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_set_error_mode$__crt_errno$ExitMessageProcess_lock_malloc_crtmalloc
String ID:
API String ID: 2751257304-0
Opcode ID: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction ID: 47da4f615198748e493aa52e7950f254405220eaf1948bc4f3f10f5145e5281b
Opcode Fuzzy Hash: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction Fuzzy Hash: 6F11AC31257A8889F760AF20E44D7E827B3FBA07B2F070020ED46466E2CF7988539353

Function 0000021A850F4170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A850F41BD

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

malloc.LIBCMT ref: 0000021A850F41C8

Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294FC
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A85129501

free.LIBCMT ref: 0000021A850F42AF
free.LIBCMT ref: 0000021A850F42B7
free.LIBCMT ref: 0000021A850F42BF
free.LIBCMT ref: 0000021A850F42CB
free.LIBCMT ref: 0000021A850F42D8

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: d0a67bb7cddefdbee880c4e9fe0aa1a89f81508cdaa840e4267b3b81c0f89637
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: 9751D334619F0A4FE799EB6C94596FD73E2FB69310F91016DDC4AC7286EB20DC438682

Function 0000021A85043570 Relevance: 8.9, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A850435BD

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

malloc.LIBCMT ref: 0000021A850435C8

Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788FC
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A85078901

free.LIBCMT ref: 0000021A850436AF
free.LIBCMT ref: 0000021A850436B7
free.LIBCMT ref: 0000021A850436BF
free.LIBCMT ref: 0000021A850436CB
free.LIBCMT ref: 0000021A850436D8

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction ID: e3c3673b7ba136470f1114cb9c98027748cbee5b23841858e47782df9203eca5
Opcode Fuzzy Hash: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction Fuzzy Hash: 524126313027429FEB55AB2695583DD27B2FB25BE4F429424CE0A47742DF34D467C342

Function 0000021A850FCB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021A85107F80: malloc.LIBCMT ref: 0000021A85107F97

malloc.LIBCMT ref: 0000021A850FCC4E

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

Part of subcall function 0000021A85128AEC: malloc.LIBCMT ref: 0000021A85128B27

Part of subcall function 0000021A85128AEC: realloc.LIBCMT ref: 0000021A85128B4E

malloc.LIBCMT ref: 0000021A850FCD82
_snprintf.LIBCMT ref: 0000021A850FCE10
_snprintf.LIBCMT ref: 0000021A850FCE4A
_snprintf.LIBCMT ref: 0000021A850FCE74
free.LIBCMT ref: 0000021A850FD07B

Part of subcall function 0000021A85129428: RtlFreeHeap.NTDLL ref: 0000021A8512943E
Part of subcall function 0000021A85129428: _errno.LIBCMT ref: 0000021A85129448

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$FreeHeap_callnewhfreerealloc
String ID:
API String ID: 1397185943-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: 5cef32caa4c7f45782f95c5037423179af91b7ace997969df14b14a3a5fb31f6
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: A8E11A7061A7448FF754FB64C45A7EAB6E3FBA4300F51452DA98AC32E2DF3898458B43

Function 0000021A8504BF50 Relevance: 7.8, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 0000021A85057380: malloc.LIBCMT ref: 0000021A85057397

malloc.LIBCMT ref: 0000021A8504C04E

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

Part of subcall function 0000021A85077EEC: malloc.LIBCMT ref: 0000021A85077F27

Part of subcall function 0000021A85077EEC: realloc.LIBCMT ref: 0000021A85077F4E

malloc.LIBCMT ref: 0000021A8504C182
_snprintf.LIBCMT ref: 0000021A8504C210
_snprintf.LIBCMT ref: 0000021A8504C24A
_snprintf.LIBCMT ref: 0000021A8504C274
free.LIBCMT ref: 0000021A8504C47B

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction ID: 6820fd02c58e9d1c7fdcaf3cb0d9d8a53ef59fd6a9609bc4ec71a47b0ba9dd09
Opcode Fuzzy Hash: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction Fuzzy Hash: 4BD150716066408EF750AB60E4593DA76B3F7E4365F520029AE89877D6DF39C807CB43

Function 0000021A85134424 Relevance: 7.7, APIs: 5, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 0000021A85134451

Part of subcall function 0000021A8512DA24: _FF_MSGBANNER.LIBCMT ref: 0000021A8512DA41
Part of subcall function 0000021A8512DA24: _NMSG_WRITE.LIBCMT ref: 0000021A8512DA4B

_lock.LIBCMT ref: 0000021A85134464
_lock.LIBCMT ref: 0000021A851344BF
_calloc_crt.LIBCMT ref: 0000021A85134576

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: 2ca824a1cc7ae347da2b2830ffe64480a866a250b517b62102413335f849d73b
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: 0651F674519B098BE754AF58C89D3E5B7D1FB68310F16025DEC4AC72A2D7B8DC428A83

Function 0000021A850F54F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A850F553A

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

malloc.LIBCMT ref: 0000021A850F5545

Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294FC
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A85129501

free.LIBCMT ref: 0000021A850F562C
free.LIBCMT ref: 0000021A850F5634
free.LIBCMT ref: 0000021A850F5640
free.LIBCMT ref: 0000021A850F564D

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: d55108eebe4c25b0389e2b0c4a17f86ba64be9d7256fa7f3f8e46c8c26802aaf
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: CD41E830219B4D4FE759EA6C48492BA36E6E7A6311F15012DDCC7C3283EE20D8078792

Function 0000021A8512BD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0000021A8512BDB5

Part of subcall function 0000021A8512F624: _errno.LIBCMT ref: 0000021A8512F62D
Part of subcall function 0000021A8512F624: _invalid_parameter_noinfo.LIBCMT ref: 0000021A8512F638

_errno.LIBCMT ref: 0000021A8512BDC5

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_errno.LIBCMT ref: 0000021A8512BDE1
_isatty.LIBCMT ref: 0000021A8512BE42
_getbuf.LIBCMT ref: 0000021A8512BE4E

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: 391e19609d4c2d8422d39d187b7bbdb638f3caa3007ab05e5596c13506b2d686
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: 9D51C170215B484FEB98FF28C49A7E576E2EB68310F150699DC56CB2D6D738C881CB82

Function 0000021A8510CF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A8510CF18

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

_snprintf.LIBCMT ref: 0000021A8510CF38

Part of subcall function 0000021A85129700: _errno.LIBCMT ref: 0000021A85129737
Part of subcall function 0000021A85129700: _invalid_parameter_noinfo.LIBCMT ref: 0000021A85129742

free.LIBCMT ref: 0000021A8510CF57

Part of subcall function 0000021A85129428: RtlFreeHeap.NTDLL ref: 0000021A8512943E
Part of subcall function 0000021A85129428: _errno.LIBCMT ref: 0000021A85129448

malloc.LIBCMT ref: 0000021A8510CFE0
_snprintf.LIBCMT ref: 0000021A8510D007
free.LIBCMT ref: 0000021A8510D045

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: 5aa929b1340153150a37cb970e5e6943eb51cb3d1ca2f56a7cac645ba2028cad
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: 54417A30658B448FE740FB2CC499BAAB7F2FBA9344F51056DE489C32A1DB25D981CB43

Function 0000021A850448F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A8504493A

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

malloc.LIBCMT ref: 0000021A85044945

Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788FC
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A85078901

free.LIBCMT ref: 0000021A85044A2C
free.LIBCMT ref: 0000021A85044A34
free.LIBCMT ref: 0000021A85044A40
free.LIBCMT ref: 0000021A85044A4D

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction ID: 8f217a57e4c4c76be57fe2cd8a29c9e58c18e0765a420fbdce59944d37b3079c
Opcode Fuzzy Hash: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction Fuzzy Hash: 384104363127854AFB15DB2664082DD67B6F775BA9F4B4024DD058B742EE38C81BC306

Function 0000021A85139262 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000021A8513910C
_malloc_crt.LIBCMT ref: 0000021A8513912E
free.LIBCMT ref: 0000021A851391C4
_recalloc_crt.LIBCMT ref: 0000021A85139275

Part of subcall function 0000021A8512E478: _recalloc.LIBCMT ref: 0000021A8512E4A8

_calloc_crt.LIBCMT ref: 0000021A851392B1

Part of subcall function 0000021A8512E2F8: _calloc_impl.LIBCMT ref: 0000021A8512E326

_errno.LIBCMT ref: 0000021A85139301

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

free.LIBCMT ref: 0000021A8513930F
free.LIBCMT ref: 0000021A8513931C
free.LIBCMT ref: 0000021A8513932E

Part of subcall function 0000021A85134FBC: _errno.LIBCMT ref: 0000021A85134FD4
Part of subcall function 0000021A85134FBC: _invalid_parameter_noinfo.LIBCMT ref: 0000021A85134FE0

_invoke_watson.LIBCMT ref: 0000021A8513934A

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$_errno_malloc_crt$_calloc_crt_calloc_impl_getptd_noexit_invalid_parameter_noinfo_invoke_watson_recalloc_recalloc_crt
String ID:
API String ID: 321378830-0
Opcode ID: 1af5591cc140629ef8a1eaab72b160ba28423dfa39d6b40620a42b0b9187e2b6
Instruction ID: 5daed19d02b6e1ec25b56387f5f5d670d51cf5fe481d267de8b15370a6cc05c7
Opcode Fuzzy Hash: 1af5591cc140629ef8a1eaab72b160ba28423dfa39d6b40620a42b0b9187e2b6
Instruction Fuzzy Hash: 6221E570326F4D4EF744BF68D85A7F973C3FB64310F52416D985AC22E2DB2888418643

Function 0000021A8513963A Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000021A851394B9
_malloc_crt.LIBCMT ref: 0000021A851394DE
free.LIBCMT ref: 0000021A8513957B
_recalloc_crt.LIBCMT ref: 0000021A8513964D

Part of subcall function 0000021A8512E478: _recalloc.LIBCMT ref: 0000021A8512E4A8

_calloc_crt.LIBCMT ref: 0000021A8513968C

Part of subcall function 0000021A8512E2F8: _calloc_impl.LIBCMT ref: 0000021A8512E326

_errno.LIBCMT ref: 0000021A851396D6

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

free.LIBCMT ref: 0000021A851396E4
free.LIBCMT ref: 0000021A851396F1
free.LIBCMT ref: 0000021A85139703

Part of subcall function 0000021A85132DD0: _errno.LIBCMT ref: 0000021A85132DEC
Part of subcall function 0000021A85132DD0: _invalid_parameter_noinfo.LIBCMT ref: 0000021A85132DF8

_invoke_watson.LIBCMT ref: 0000021A8513971F

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$_errno_malloc_crt$_calloc_crt_calloc_impl_getptd_noexit_invalid_parameter_noinfo_invoke_watson_recalloc_recalloc_crt
String ID:
API String ID: 321378830-0
Opcode ID: 8a2acd4545fb3e1ff377b7186d7311079e6a4c6a1743b8f02e9e066f6884292d
Instruction ID: 7a34468bdc51b93bbfb7f098723f189c7124f0bb554b4095335ed82dbe4f4775
Opcode Fuzzy Hash: 8a2acd4545fb3e1ff377b7186d7311079e6a4c6a1743b8f02e9e066f6884292d
Instruction Fuzzy Hash: 9721AE7071AF094AF794BF18D46A7E972C3EBA4720F520139DC5BC22D2EB288C458683

Function 0000021A851395B9 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_recalloc_crt.LIBCMT ref: 0000021A851395D1

Part of subcall function 0000021A8512E478: _recalloc.LIBCMT ref: 0000021A8512E4A8

_calloc_crt.LIBCMT ref: 0000021A8513968C
_errno.LIBCMT ref: 0000021A851396D6
free.LIBCMT ref: 0000021A851396E4
free.LIBCMT ref: 0000021A851396F1
free.LIBCMT ref: 0000021A85139703

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$_calloc_crt_errno_recalloc_recalloc_crt
String ID:
API String ID: 3700215360-0
Opcode ID: 5671fb06d6f05841401363cc8443e27ee7f0052eb4ca124240904de72179e6d7
Instruction ID: 573bc746bd693b0b29c0718e3b588cc014071ad7a7a323e52c18604934e76958
Opcode Fuzzy Hash: 5671fb06d6f05841401363cc8443e27ee7f0052eb4ca124240904de72179e6d7
Instruction Fuzzy Hash: 86217F7071AB194AF7A4BF58D46A7E972C3EBA4310F520139DC5BC22D2EF288C458683

Function 0000021A851391FD Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_recalloc_crt.LIBCMT ref: 0000021A85139215

Part of subcall function 0000021A8512E478: _recalloc.LIBCMT ref: 0000021A8512E4A8

_calloc_crt.LIBCMT ref: 0000021A851392B1
_errno.LIBCMT ref: 0000021A85139301
free.LIBCMT ref: 0000021A8513930F
free.LIBCMT ref: 0000021A8513931C
free.LIBCMT ref: 0000021A8513932E

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$_calloc_crt_errno_recalloc_recalloc_crt
String ID:
API String ID: 3700215360-0
Opcode ID: d21b9421d81b7aad527b41b40eb760196fdcb429390ac35a4901b8c372e18314
Instruction ID: d0695fd8d5c5f4cfa21b412fed4a5fa420fa61315f59af4e5fa2dc41003c3460
Opcode Fuzzy Hash: d21b9421d81b7aad527b41b40eb760196fdcb429390ac35a4901b8c372e18314
Instruction Fuzzy Hash: FD219570716F4D4FF694BF69D46D7F973C3EBA4350F524129984AC21D2EF2888058243

Function 0000021A851346C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A851346D9

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

__doserrno.LIBCMT ref: 0000021A851346D1

Part of subcall function 0000021A8512B6A4: _getptd_noexit.LIBCMT ref: 0000021A8512B6A8

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: 427c50fdd9294dde599c2cdcae775b646d49d0781f91d8a6b0cedb6e9e845abb
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: BA018134226B484EFA59FB64C9AD7D43693EF36325F5A4658EC09871E2C7BC4440C623

Function 0000021A851033EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85103404

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

_snprintf.LIBCMT ref: 0000021A8510342E

Part of subcall function 0000021A85129700: _errno.LIBCMT ref: 0000021A85129737
Part of subcall function 0000021A85129700: _invalid_parameter_noinfo.LIBCMT ref: 0000021A85129742

remove.LIBCMT ref: 0000021A8510343F
remove.LIBCMT ref: 0000021A8510344B
free.LIBCMT ref: 0000021A85103455

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: 8f694c683fe9f4cceae3ddc9dacb867a6c2485aefbef92d2b4a8eae3f7c054ce
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: 3301BB7052D7489FE384FB18C459B9DB7E2FBE4701F81192DB889C22A1DB749984CB43

Function 0000021A85083AC8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85083AD9

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

__doserrno.LIBCMT ref: 0000021A85083AD1

Part of subcall function 0000021A8507AAA4: _getptd_noexit.LIBCMT ref: 0000021A8507AAA8

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction ID: f38a2ed5e09bd8061e3424f0d360518d54586a10ab50eb89537c64e7d73784ff
Opcode Fuzzy Hash: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction Fuzzy Hash: C9016DB1717A4449EA095B54CC993EC36B35BB4B72F5B4305DE2A067D2C72D44138613

Function 0000021A850527EC Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85052804

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

_snprintf.LIBCMT ref: 0000021A8505282E

Part of subcall function 0000021A85078B00: _errno.LIBCMT ref: 0000021A85078B37
Part of subcall function 0000021A85078B00: _invalid_parameter_noinfo.LIBCMT ref: 0000021A85078B42

remove.LIBCMT ref: 0000021A8505283F
remove.LIBCMT ref: 0000021A8505284B
free.LIBCMT ref: 0000021A85052855

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction ID: c1a315a3580df8b7945e742988e20781264d700e51af3929cea8a2d081c653fd
Opcode Fuzzy Hash: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction Fuzzy Hash: F1F06272529B808ADA40EB51F44539EB371FBD47A1F411116BE8D53BA9CF38C412CB41

Function 0000021A851268D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85126917
free.LIBCMT ref: 0000021A8512693C

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: a7d7ebe73283c4cc5e99acb36d8a092403ce419cf98866472c886dffd21893d3
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: EB9107306197848FE7A4EB28C4597DEB7E2FBA4301F51492DE88AC3291DB759885CB43

Function 0000021A85075CD4 Relevance: 6.4, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85075D17
free.LIBCMT ref: 0000021A85075D3C

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction ID: 3683a71b77fbc3e639289c1c26cbf1ac3541b7171d3a3d13d3c6fc70355876c1
Opcode Fuzzy Hash: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction Fuzzy Hash: 368193322096808FE770DB24E4593DEB7B2F394761F510425EE8987A99DB7EC846CF42

Function 0000021A851292BC Relevance: 6.3, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A851292D6

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

malloc.LIBCMT ref: 0000021A851292F5

Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294FC
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A85129501

malloc.LIBCMT ref: 0000021A8512932C
_snprintf.LIBCMT ref: 0000021A85129358

Part of subcall function 0000021A85129700: _errno.LIBCMT ref: 0000021A85129737
Part of subcall function 0000021A85129700: _invalid_parameter_noinfo.LIBCMT ref: 0000021A85129742

malloc.LIBCMT ref: 0000021A8512939B

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: 3adab32381c3ac56894216c569fd16eee8bc24e67adba909cbbac76cb4dff170
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: 1F31C774518B489FDB84EF1CC044A9AB7E2FBAC315F100A6DA48DD73A1DB34E981CB42

Function 0000021A850786BC Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A850786D6

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

malloc.LIBCMT ref: 0000021A850786F5

Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788FC
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A85078901

malloc.LIBCMT ref: 0000021A8507872C
_snprintf.LIBCMT ref: 0000021A85078758

Part of subcall function 0000021A85078B00: _errno.LIBCMT ref: 0000021A85078B37
Part of subcall function 0000021A85078B00: _invalid_parameter_noinfo.LIBCMT ref: 0000021A85078B42

malloc.LIBCMT ref: 0000021A8507879B

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction ID: 82b0537393c8b00b1f7598ed230a001705629a77cf702467017d4f603e85f626
Opcode Fuzzy Hash: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction Fuzzy Hash: 4E21E236609B848ACA60DB06E49025AB7A1F7D8BA4F114216EECD43BA9CF38C542CF00

Function 0000021A8512A1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8512A22C

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A8512A237
_flush.LIBCMT ref: 0000021A8512A2E9
_fileno.LIBCMT ref: 0000021A8512A30A

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: 86ddd5e32b5a270ad2f97b47bbe9d1332527064bf00be37935fa645c99664b42
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: CD51C630219F094BE668FA6D544D7B572C2E779310F16022DEC9AC35D6EFA1DC8245C3

Function 0000021A850795F4 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A8507962C

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85079637
_flush.LIBCMT ref: 0000021A850796E9
_fileno.LIBCMT ref: 0000021A8507970A

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction ID: d559ed892b1c89fc2784a579f6bdc34833df2a405797fc92efa1cc2ff3ba41e0
Opcode Fuzzy Hash: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction Fuzzy Hash: A0415C313027844EFE244EA3564C3E9B6B3B764FF1F0A4A249E55477C5DA3AD443C206

Function 0000021A850F10D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 0000021A850F1117
clock.LIBCMT ref: 0000021A850F1124
clock.LIBCMT ref: 0000021A850F112D
clock.LIBCMT ref: 0000021A850F113A

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: ea37440d35f38375b25d0fd288cbed4acfe83d3ec9175d2f064361c28f8f3470
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: 4621F63140E7180EE768FAE8D44A2E6B6E1E7A53A1F1A022DED8683192E5519C4782C7

Function 0000021A85139728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A8513974C

Part of subcall function 0000021A8512BF24: _getptd.LIBCMT ref: 0000021A8512BF3A
Part of subcall function 0000021A8512BF24: __updatetlocinfo.LIBCMT ref: 0000021A8512BF6F
Part of subcall function 0000021A8512BF24: __updatetmbcinfo.LIBCMT ref: 0000021A8512BF96

_errno.LIBCMT ref: 0000021A85139758

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85139763
strchr.LIBCMT ref: 0000021A85139779

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: 6c2b7e8aa39b9920248bd476a7c176a6217e508134af7aab70b63aefbafe714f
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: 0B210D706197AD0AEB94FF28C0AC3FA7DD3E765315F060559A996C71C1CB688841CA53

Function 0000021A850404D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 0000021A85040517
clock.LIBCMT ref: 0000021A85040524
clock.LIBCMT ref: 0000021A8504052D
clock.LIBCMT ref: 0000021A8504053A

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 99e9f663e41960ba664c7a58890dd3bd6ee8b2c3161cd5448cfd89b4a75d62a9
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: 47113A3250178489F374AEA678547ABF6B1FB643B8F2B1425EE446B641EA34C883C602

Function 0000021A85088B28 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A85088B4C

Part of subcall function 0000021A8507B324: _getptd.LIBCMT ref: 0000021A8507B33A
Part of subcall function 0000021A8507B324: __updatetlocinfo.LIBCMT ref: 0000021A8507B36F
Part of subcall function 0000021A8507B324: __updatetmbcinfo.LIBCMT ref: 0000021A8507B396

_errno.LIBCMT ref: 0000021A85088B58

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85088B63
strchr.LIBCMT ref: 0000021A85088B79

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction ID: b34ba0f7b09224fd8d5bc3fcd787541bdb34520224eee1c2e5cecda2e9f9fb28
Opcode Fuzzy Hash: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction Fuzzy Hash: 28215EB21062E448FB68561594187FD66F3EBE4BF4F1E4820EE8607EC5D92CC453E702

Function 0000021A850570FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021A85057380: malloc.LIBCMT ref: 0000021A85057397

strrchr.LIBCMT ref: 0000021A850571F2
_snprintf.LIBCMT ref: 0000021A8505730C

Strings

:, xrefs: 0000021A8505734F

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: :
API String ID: 3587327836-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 5e9a73db7d629309cfc8d8fbfd5834fb1190ab8f927e38533a61ec5d878f7a7d
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: 6361D93221AA848AE750DB15E88439AB7B1F3D57A0F115115FECE47BAACF7CC446CB41

Function 0000021A8510B940 Relevance: 5.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A8510B9AA

Part of subcall function 0000021A85129468: _FF_MSGBANNER.LIBCMT ref: 0000021A85129498
Part of subcall function 0000021A85129468: _NMSG_WRITE.LIBCMT ref: 0000021A851294A2
Part of subcall function 0000021A85129468: _callnewh.LIBCMT ref: 0000021A851294D6
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294E1
Part of subcall function 0000021A85129468: _errno.LIBCMT ref: 0000021A851294EC

free.LIBCMT ref: 0000021A8510BDE3

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: 75cc209f1eefa77846201512951ff250c9779cc057e1f16f3b3bdad269c90471
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: 61D12A7468D7859FD7A4EB18C0487AFB7E1FB9A314F91092DA9C9C3250CB349881CB07

Function 0000021A85129924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85129975

Part of subcall function 0000021A8512B714: _getptd_noexit.LIBCMT ref: 0000021A8512B718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85129980

Strings

B, xrefs: 0000021A851299AC

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: 59f1c0ddea06bc3ffbc36d47b5d40ddbb0434144504c6aaf43ac85d6e3e575e0
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: 3611C430228B084FD744EF5CD4897A5B7D2FBA8324F11476EA419C32E1DB34C880CB82

Function 0000021A850812F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__crtCapturePreviousContext.LIBCMT ref: 0000021A850817B5
__raise_securityfailure.LIBCMT ref: 0000021A85081857

Strings

sv-FI, xrefs: 0000021A85081850

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: CaptureContextPrevious__crt__raise_securityfailure
String ID: sv-FI
API String ID: 37250909-2947700294
Opcode ID: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction ID: 98199742f8e41cb9bb74ac20f0bafebde9196a113d594d93f1c2e4959e0a231f
Opcode Fuzzy Hash: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction Fuzzy Hash: 04214734223B0499FE158B08F8593D477B6F7A5366F920126DD8E46BA6EF3CC526C302

Function 0000021A85078D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A85078D75

Part of subcall function 0000021A8507AB14: _getptd_noexit.LIBCMT ref: 0000021A8507AB18

_invalid_parameter_noinfo.LIBCMT ref: 0000021A85078D80

Strings

B, xrefs: 0000021A85078DAC

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction ID: cad48b640e727bff436c2f85714c007abe4c0a6fc4337d5d7b1955713a6045a0
Opcode Fuzzy Hash: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction Fuzzy Hash: 54118272615A4489EB109B52D444399B662FBA8FE4F594310AF5847B96DF38C641CB01

Function 0000021A850410C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 0000021A8504116A

Part of subcall function 0000021A85088358: _calloc_impl.LIBCMT ref: 0000021A85088368
Part of subcall function 0000021A85088358: _errno.LIBCMT ref: 0000021A8508837B
Part of subcall function 0000021A85088358: _errno.LIBCMT ref: 0000021A85088385

free.LIBCMT ref: 0000021A850412F3
free.LIBCMT ref: 0000021A850412FD
free.LIBCMT ref: 0000021A8504130F

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction ID: 62dc6da468a8ef92b86fbabdba17f014ff355d46b322f6ac0a7d9567244ce355
Opcode Fuzzy Hash: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction Fuzzy Hash: BAC12836609B848AE764CF65E88439E77B5F398B98F11412AEF8D87B58DF38C455CB00

Function 0000021A8505AD40 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A8505ADAA

Part of subcall function 0000021A85078868: _FF_MSGBANNER.LIBCMT ref: 0000021A85078898
Part of subcall function 0000021A85078868: _NMSG_WRITE.LIBCMT ref: 0000021A850788A2
Part of subcall function 0000021A85078868: _callnewh.LIBCMT ref: 0000021A850788D6
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788E1
Part of subcall function 0000021A85078868: _errno.LIBCMT ref: 0000021A850788EC

free.LIBCMT ref: 0000021A8505B1E3

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction ID: abf64f710a4038702b8237b4019cd410a968dff54d9371146e1feb27234e4788
Opcode Fuzzy Hash: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction Fuzzy Hash: 54C1E6762196C08ED7B0CA14E08439BB7B1F7997A5F51102AEF8A93B58CB39D841CF06

Function 0000021A850FFBEC Relevance: 5.2, APIs: 4, Instructions: 221COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000021A850FFCA9
_snprintf.LIBCMT ref: 0000021A850FFCC9
_snprintf.LIBCMT ref: 0000021A850FFD9A

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: 485b68a12a8fd6921d54a51525aeeaee5686e44d9d3d53666266259f587c0ec9
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: B8913F70118B888FE764EF18C455BABB7E2FBA9311F50092DE48AC32E1DB749945CB43

Function 0000021A850F4300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A850F4363

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: 920dfa38193c0ef37fd8a18e4a28fd8797d064d6c737c2ee7610cbe5d2a25885
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: 3351C43420CA054FEB58DF6CD4892A973E2FBA5310F05056DEC8BD72C6EA20EC438682

Function 0000021A8504EFEC Relevance: 5.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000021A8504F0A9
_snprintf.LIBCMT ref: 0000021A8504F0C9
_snprintf.LIBCMT ref: 0000021A8504F19A

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: be20ee676b97cb5dbb7dca3ed6b26603533b26fe45eb60d391c3d29ed8f25e42
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: 8281E93620AAC48AE7209B51F8583DAB772F7957A4F510216DE9D43BA9DF38C446CB01

Function 0000021A85043700 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85043763

Memory Dump Source

Source File: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction ID: dba32cd27e4496a93aba5735143200ccae6a91c366e6e3c1f2944e60c2b24df1
Opcode Fuzzy Hash: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction Fuzzy Hash: AA41D3327027808BEB58DB26A4087EE73B2F764BA8F425428DE5A47785EF34D847C741

Function 0000021A85127594 Relevance: 5.1, APIs: 4, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000021A8512761F
_snprintf.LIBCMT ref: 0000021A85127644
_snprintf.LIBCMT ref: 0000021A851276A4
_snprintf.LIBCMT ref: 0000021A851276C9

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: e090d9d4d7dce01c983703bdff16f518dfd9a11226673f7631c4cc9ab1b1906f
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 90413130119B488FF755FB18D859BDA77E2F7A8310F514529A849C32E0DB38D985CB43

Function 0000021A85127D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A85127D4E
strtok.LIBCMT ref: 0000021A85127DAC
strtok.LIBCMT ref: 0000021A85127DBE
free.LIBCMT ref: 0000021A85127DD7

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: 6c90df2b6c1d675b4f23941d7f16357e3d901edce62de56c5fbf34a3a8858460
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: BE310334519B8C9FE790FB18D448B6A77E3FBA9315F51061DE48AC32A1D734D841CB02

Function 0000021A85076994 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000021A85076A1F
_snprintf.LIBCMT ref: 0000021A85076A44
_snprintf.LIBCMT ref: 0000021A85076AA4
_snprintf.LIBCMT ref: 0000021A85076AC9

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 9aaf4856bce2074589812b2b30e8f26b41a500626a3037a4743972080886639c
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 9F319235516E849AE7218B41E4483DA6772F3A8774F914212EE9E03BE9DF3DC943CB02

Function 0000021A85077104 Relevance: 5.0, APIs: 4, Instructions: 50stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A8507714E
strtok.LIBCMT ref: 0000021A850771AC
strtok.LIBCMT ref: 0000021A850771BE
free.LIBCMT ref: 0000021A850771D7

Memory Dump Source

Source File: 00000003.00000003.1851485785.0000021A8505D000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000021A85040000, based on PE: true

Associated: 00000003.00000003.1851450391.0000021A85040000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000003.00000003.1851485785.0000021A8509C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21a85040000_rundll32.jbxd

Yara matches

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction ID: 0bc6f0cb33b4da3dee3aae1a60708128ac3a8cdda7d23d25b66f6a619e516677
Opcode Fuzzy Hash: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction Fuzzy Hash: 37213D35106B448CEA609B15F84839A6372F3A57B1F411315EE9E477E9DF3DC446C701

Function 0000021A851293B8 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021A851293D8

Part of subcall function 0000021A85129428: RtlFreeHeap.NTDLL ref: 0000021A8512943E
Part of subcall function 0000021A85129428: _errno.LIBCMT ref: 0000021A85129448

free.LIBCMT ref: 0000021A851293E6
free.LIBCMT ref: 0000021A851293F4
free.LIBCMT ref: 0000021A851293FE

Memory Dump Source

Source File: 00000003.00000002.1853403862.0000021A850F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A850F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21a850f1000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction ID: 9d2ad4b5e3424aa3eb4d5aea543cfa2175726f0641aec22bbf3a81f05163aef3
Opcode Fuzzy Hash: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction Fuzzy Hash: 83F04C3452DA88AFD6C8FB1CC595E9977E2FFA8300F811498B449C73A2DB24EC40CB12

Analysis Process: rundll32.exePID: 7824, Parent PID: 7800COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 000001D38B8A7CFC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001D38B8A7F80: malloc.LIBCMT ref: 000001D38B8A7F97

GetUserNameA.ADVAPI32 ref: 000001D38B8A7DAA

Part of subcall function 000001D38B8A00A4: WSASocketA.WS2_32 ref: 000001D38B8A00E0

strrchr.LIBCMT ref: 000001D38B8A7DF2
_snprintf.LIBCMT ref: 000001D38B8A7F0C

Strings

:, xrefs: 000001D38B8A7F4F

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID: :
API String ID: 1789932928-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 110b57a5cd811d7914c46092459dd239e4124b6e5e9583b423328f619c06bba5
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: 6F71CA70618B888FE794EF28C494B9ABBE1FBD9301F50596DB499C32A1CB74D941DB03

Function 000001D38B81D107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001D38B81D166
VirtualProtect.KERNELBASE ref: 000001D38B81D1AF

Strings

DCBA, xrefs: 000001D38B81D141

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: DCBA
API String ID: 544645111-2222620526
Opcode ID: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction ID: dd20b11e773b60bc7511c0c58c81a6ba4fd452fda5816f19ae452803e9a06e9e
Opcode Fuzzy Hash: 8f29a9ed39b750692e811b1f82c9dbcd5f6d1f936aceb2f7bdd09e353837e8a9
Instruction Fuzzy Hash: 4841F776302B858EDB24CF69D8807DC37A1F748BACF119216FA1D87B98DA34DA459740

Function 000001D38B8AD0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 000001D38B8AD1A3
0, xrefs: 000001D38B8AD1AB

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: 4167811511accef8891ecc47332018e5575a77d14fe76dd032e29df52ef65958
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: B7411230118786CFE7B8DB18D0547AAB7E1FB98305F605A2EB099C32A1DB74D945DB03

Function 000001D38B8A00A4 Relevance: 4.6, APIs: 3, Instructions: 93
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001D38B8A00E0
WSAIoctl.WS2_32 ref: 000001D38B8A013B
closesocket.WS2_32 ref: 000001D38B8A01CA

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: IoctlSocketclosesocket
String ID:
API String ID: 3445158922-0
Opcode ID: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction ID: 24a2d00feb2ba6bcd6c0b42d28e6b5723bc1c1ebbf4dbf830a1bc5355f7197a5
Opcode Fuzzy Hash: 2b1563ebb8b5cee2362f50e6a9862c7e044125dd490747691ac161b43e72dde1
Instruction Fuzzy Hash: C7310A70618785CFE354DF68C44479AFBE4FB88344F605A2EF49AC22A0D7B8D5459B03

Function 000001D38B89F9C0 Relevance: 1.6, APIs: 1, Instructions: 150
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000001D38B89FA7C

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction ID: 75e9cc4a69972c7644b4ea5f3484a4a6b50c8bd79e45e1ee004272074d4aeb31
Opcode Fuzzy Hash: 170dc46f2207cb387e16a0227af4bff50695bdbce6e0c670e9cf9a8f94b52204
Instruction Fuzzy Hash: 8C5169702186858FF79CEB28C8197AA77E1FB89305F50062EF196D32E1CB789941DB03

Non-executed Functions

Function 000001D38B83F9E4 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001D38B83FA3A
_errno.LIBCMT ref: 000001D38B83FA41
_invalid_parameter_noinfo.LIBCMT ref: 000001D38B83FA4C

Strings

U, xrefs: 000001D38B83FFAE

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction ID: a599add7f1017f25aa237cd8dc261db09062a84de536c03a3a7420d098c5aee9
Opcode Fuzzy Hash: d340c754f10613e6dc0e06c90a2eafc547d7bf11865777075d14712fd4a8a73b
Instruction Fuzzy Hash: 581203322146C686EB288F24D4443DE77A1F799744F400317FAAD476A5DB3ECB45EB22

Function 000001D38B83B3CC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D38B83B42D

Part of subcall function 000001D38B83B324: _getptd.LIBCMT ref: 000001D38B83B33A
Part of subcall function 000001D38B83B324: __updatetlocinfo.LIBCMT ref: 000001D38B83B36F
Part of subcall function 000001D38B83B324: __updatetmbcinfo.LIBCMT ref: 000001D38B83B396

_fileno.LIBCMT ref: 000001D38B83B45F

Part of subcall function 000001D38B83EA24: _errno.LIBCMT ref: 000001D38B83EA2D
Part of subcall function 000001D38B83EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B83EA38

write_multi_char.LIBCMT ref: 000001D38B83BA8F
write_string.LIBCMT ref: 000001D38B83BAAC
_errno.LIBCMT ref: 000001D38B83B432

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_errno.LIBCMT ref: 000001D38B83BD97
_invalid_parameter_noinfo.LIBCMT ref: 000001D38B83BDA2

Strings

-, xrefs: 000001D38B83BA40
@, xrefs: 000001D38B83B44B

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$@
API String ID: 3246410048-1222683799
Opcode ID: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction ID: bbc718a277f7f434cf0e2c95ef17c59eed2da63fb1c4154d7bd41bfa61d37dad
Opcode Fuzzy Hash: 4ec0c3fdefe748b4360ec292b4f3c1d7a4f271ecc1c53292c07100d3414dac0a
Instruction Fuzzy Hash: 72B1F5B2604EC289EB6DCB5594403EE7BA0F7C8790F140217FE6D476D9DB38CA40A752

Function 000001D38B8D0EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D38B8D0F1E

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

__doserrno.LIBCMT ref: 000001D38B8D0F15

Part of subcall function 000001D38B8CB6A4: _getptd_noexit.LIBCMT ref: 000001D38B8CB6A8

__doserrno.LIBCMT ref: 000001D38B8D0F7B
_errno.LIBCMT ref: 000001D38B8D0F82
_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8D0FE6

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: f438ee967c8b53bebbb98c77a74283165bffe5f99ce03f9c29c0cbe3ce0137d0
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: F231EA71108F8A4FE75CAF68D8527E936D0EB41360F29035BF436872E3D6709A019753

Function 000001D38B838F1C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

__crtCorExitProcess.LIBCMT ref: 000001D38B838F24
free.LIBCMT ref: 000001D38B838F62

Part of subcall function 000001D38B838828: _errno.LIBCMT ref: 000001D38B838848

free.LIBCMT ref: 000001D38B838F77
free.LIBCMT ref: 000001D38B838F98
free.LIBCMT ref: 000001D38B838FAD
free.LIBCMT ref: 000001D38B838FC1
free.LIBCMT ref: 000001D38B838FCD
free.LIBCMT ref: 000001D38B838FF8
free.LIBCMT ref: 000001D38B839019
free.LIBCMT ref: 000001D38B839032
free.LIBCMT ref: 000001D38B839063

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: free$ExitProcess__crt_errno
String ID:
API String ID: 1362684943-0
Opcode ID: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction ID: 54696564fb181883bbc3199714f1ad40143ee3d116ece3c531c75a7974305b99
Opcode Fuzzy Hash: 2cab59b5a68b187e6d78e7cea4af9017ef51927ae16ba3061b59f56144a0216f
Instruction Fuzzy Hash: 6B411031611ACB85FE5CAB11F8553E82350AB8E7A1F080717B93D062E2DF7DC644A323

Function 000001D38B8402EC Relevance: 16.6, APIs: 11, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B84031E

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

__doserrno.LIBCMT ref: 000001D38B840315

Part of subcall function 000001D38B83AAA4: _getptd_noexit.LIBCMT ref: 000001D38B83AAA8

__doserrno.LIBCMT ref: 000001D38B84037B
_errno.LIBCMT ref: 000001D38B840382
_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8403E6

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction ID: d203778542184dd9107b2f39279e76931a809526a22f8ba6ca50279d7cb87cdf
Opcode Fuzzy Hash: 9c62d4a9214b1d04db1b55005cc1b5354d5d9cc7472dc8ebe7b7b285c8c52e15
Instruction Fuzzy Hash: 3D31F2323102C687E70EAF659D813EE3A91AB847A0F454317BA35073E2C67CC741E726

Function 000001D38B8D1CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D38B8D1D03

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

__doserrno.LIBCMT ref: 000001D38B8D1CFB

Part of subcall function 000001D38B8CB6A4: _getptd_noexit.LIBCMT ref: 000001D38B8CB6A8

__lock_fhandle.LIBCMT ref: 000001D38B8D1D47
_lseeki64_nolock.LIBCMT ref: 000001D38B8D1D60
_unlock_fhandle.LIBCMT ref: 000001D38B8D1D83

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: 4bfcc0c563a3a4d48f758a79feb021b4a5f55ade09563ea6733bd372852d6262
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: 0E21F132608E8A4EF75CBB58D8527EA72D0EF81320F19035BF03AC71D3CB605A019663

Function 000001D38B8D1B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D38B8D1B8B

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

__doserrno.LIBCMT ref: 000001D38B8D1B83

Part of subcall function 000001D38B8CB6A4: _getptd_noexit.LIBCMT ref: 000001D38B8CB6A8

__lock_fhandle.LIBCMT ref: 000001D38B8D1BCF
_lseek_nolock.LIBCMT ref: 000001D38B8D1BE8
_unlock_fhandle.LIBCMT ref: 000001D38B8D1C09

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: c70b66e767ea24c3e7af2f1a9a12070489348f6721688f2d25c75d2ed8d877fc
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: 2A212472608A864FF35C7B58D8927FA72D0EF82360F19031BF176872D3D7645A41A663

Function 000001D38B8410D8 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B841103

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

__doserrno.LIBCMT ref: 000001D38B8410FB

Part of subcall function 000001D38B83AAA4: _getptd_noexit.LIBCMT ref: 000001D38B83AAA8

__lock_fhandle.LIBCMT ref: 000001D38B841147
_lseeki64_nolock.LIBCMT ref: 000001D38B841160
_unlock_fhandle.LIBCMT ref: 000001D38B841183

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction ID: aa6718443902801d3cbae6b2e36cac81a18d3a29f0a7e44df6499b7482739703
Opcode Fuzzy Hash: d5ad50827382f9f688de2ed4bc54a4a8806b0eb54b1b2836d37ae6c6a8c5fa9b
Instruction Fuzzy Hash: 9421DE327102C246FA0E6F159C013EE6A51BB95BF1F095716BA390B3D2CB3C8741A722

Function 000001D38B840F60 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B840F8B

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

__doserrno.LIBCMT ref: 000001D38B840F83

Part of subcall function 000001D38B83AAA4: _getptd_noexit.LIBCMT ref: 000001D38B83AAA8

__lock_fhandle.LIBCMT ref: 000001D38B840FCF
_lseek_nolock.LIBCMT ref: 000001D38B840FE8
_unlock_fhandle.LIBCMT ref: 000001D38B841009

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction ID: 1d7236472899c9a02bf12a773a0f6269cd1ce97a9307beee9760d7f5a21f4a54
Opcode Fuzzy Hash: 052f49f1f3ac851965df9e4e0a5fdcbb5dcdf50cc75db62ce82ed435f4083efc
Instruction Fuzzy Hash: 3321C3727106C285F71D6F2598423EE6A51BB947A1F194316BA390B3D2CB7C8B41E723

Function 000001D38B8D9EA0 Relevance: 13.7, APIs: 9, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8D9EC6
_errno.LIBCMT ref: 000001D38B8D9EBB

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction ID: 6155ab8d645250c9cf370b8d6fa481052102bef2f6747907f5b87118251a811b
Opcode Fuzzy Hash: 181d52bcb5af38a644f949309eae4e32f5a35df007ff24cdcce28bd57c8089db
Instruction Fuzzy Hash: 37512131114A8B8FEBACAB5884413F932D0EB143A1F68072BB4B5C31D6EB74CE41A253

Function 000001D38B8492A0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8492C6
_errno.LIBCMT ref: 000001D38B8492BB

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction ID: bb9dffecb8a2c220f005471cc184311022e6a90bc457ab05ffaa7f0b86d4ed8d
Opcode Fuzzy Hash: 5b111bad4e3ad25f6770f39b0e3242b50fe6952f5642632ac1ddf2be5ba068f0
Instruction Fuzzy Hash: 0741F3B16003D38AFF78AB5184403ED32D1E7A5BA4F904323FAB8676C5D728CB41A712

Function 000001D38B8D0504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000001D38B8D052F

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

__doserrno.LIBCMT ref: 000001D38B8D0527

Part of subcall function 000001D38B8CB6A4: _getptd_noexit.LIBCMT ref: 000001D38B8CB6A8

__lock_fhandle.LIBCMT ref: 000001D38B8D0573
_unlock_fhandle.LIBCMT ref: 000001D38B8D05AD

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: cc93cfd282800072d37edc4e1d9fb23f379a5ff3f840cb4dc5857ca7b7e74cbb
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: C5214972608A864FF35C6B58D8623F932E0DB45320F19030FF436871E3C7649A0196A7

Function 000001D38B8CF828 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8CF849

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

__doserrno.LIBCMT ref: 000001D38B8CF841

Part of subcall function 000001D38B8CB6A4: _getptd_noexit.LIBCMT ref: 000001D38B8CB6A8

__lock_fhandle.LIBCMT ref: 000001D38B8CF88D
_close_nolock.LIBCMT ref: 000001D38B8CF8A0
_unlock_fhandle.LIBCMT ref: 000001D38B8CF8B9

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 732e2a53eadd12a11b4b302f874418deeea58d2fe618c9e910c2ce79903b31e0
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: D121C3B2504E864FF79CAB64C8A53E876D0EB41320F25072FB42A871D3C6748A04976B

Function 000001D38B83F904 Relevance: 13.6, APIs: 9, Instructions: 67COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B83F92F

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

__doserrno.LIBCMT ref: 000001D38B83F927

Part of subcall function 000001D38B83AAA4: _getptd_noexit.LIBCMT ref: 000001D38B83AAA8

__lock_fhandle.LIBCMT ref: 000001D38B83F973
_unlock_fhandle.LIBCMT ref: 000001D38B83F9AD

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction ID: bb0d6a9f54f31b8f38172c13a9908f76f7194b6ac57568cb0e38e09d9f56af06
Opcode Fuzzy Hash: a867b8d974dbd67bb56dd808c41ec57ac3effed6eda6b108ef7744f06fd674b8
Instruction Fuzzy Hash: C921C2323102C256FA0D6F2598613ED6651A7C87A1F154317BE3D0B3D2CA7C8A41E772

Function 000001D38B83EC28 Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B83EC49

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

__doserrno.LIBCMT ref: 000001D38B83EC41

Part of subcall function 000001D38B83AAA4: _getptd_noexit.LIBCMT ref: 000001D38B83AAA8

__lock_fhandle.LIBCMT ref: 000001D38B83EC8D
_close_nolock.LIBCMT ref: 000001D38B83ECA0
_unlock_fhandle.LIBCMT ref: 000001D38B83ECB9

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction ID: 4541133a32e7a1b1eb78d64cd1793f5f5e6514a0e75eeb0a3d1f6030b314630d
Opcode Fuzzy Hash: d9d9f5fa8865f3dd61bc216fc8b25a2ffe8c7a834c42e0986ae58d894a3e4964
Instruction Fuzzy Hash: 0211E6323206C686F71D6F259C453EC6A51A7D87A2F1D0726B93D073D2C678CA42A336

Function 000001D38B8C9B34 Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001D38B8C9B62

Part of subcall function 000001D38B8C9428: RtlFreeHeap.NTDLL ref: 000001D38B8C943E
Part of subcall function 000001D38B8C9428: _errno.LIBCMT ref: 000001D38B8C9448

free.LIBCMT ref: 000001D38B8C9B77
free.LIBCMT ref: 000001D38B8C9B98
free.LIBCMT ref: 000001D38B8C9BAD
free.LIBCMT ref: 000001D38B8C9BC1
free.LIBCMT ref: 000001D38B8C9BCD
free.LIBCMT ref: 000001D38B8C9BF8
free.LIBCMT ref: 000001D38B8C9C19
free.LIBCMT ref: 000001D38B8C9C32
free.LIBCMT ref: 000001D38B8C9C63

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction ID: 205c9ef6cefccd68ff2c2302c793211bb2676ee3a84146171612cedc57158145
Opcode Fuzzy Hash: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction Fuzzy Hash: F941A570224D4FDFFBE9EB58D8E5BEC32D1F758311F5442A9A025C22D2CA2C9941D712

Function 000001D38B89460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8946A9

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

malloc.LIBCMT ref: 000001D38B8946B3

Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94FC
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C9501

malloc.LIBCMT ref: 000001D38B8946BE
free.LIBCMT ref: 000001D38B89487E
free.LIBCMT ref: 000001D38B894886
free.LIBCMT ref: 000001D38B89488E

Part of subcall function 000001D38B8954F0: malloc.LIBCMT ref: 000001D38B89553A
Part of subcall function 000001D38B8954F0: malloc.LIBCMT ref: 000001D38B895545
Part of subcall function 000001D38B8954F0: free.LIBCMT ref: 000001D38B89562C
Part of subcall function 000001D38B8954F0: free.LIBCMT ref: 000001D38B895634

free.LIBCMT ref: 000001D38B89489A
free.LIBCMT ref: 000001D38B8948A7
free.LIBCMT ref: 000001D38B8948B4

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: 62ffbe7cb90927f96cab7e0296cc2f8e0487c26ed82dc2bbce472ab0d1a5aa7a
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: 2591A770328B8F4BEB6DAA6C94517F973D5EB85700F54035FE49AD3283EE209D069683

Function 000001D38B803A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B803AA9

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

malloc.LIBCMT ref: 000001D38B803AB3

Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388FC
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B838901

malloc.LIBCMT ref: 000001D38B803ABE
free.LIBCMT ref: 000001D38B803C7E
free.LIBCMT ref: 000001D38B803C86
free.LIBCMT ref: 000001D38B803C8E

Part of subcall function 000001D38B8048F0: malloc.LIBCMT ref: 000001D38B80493A
Part of subcall function 000001D38B8048F0: malloc.LIBCMT ref: 000001D38B804945
Part of subcall function 000001D38B8048F0: free.LIBCMT ref: 000001D38B804A2C
Part of subcall function 000001D38B8048F0: free.LIBCMT ref: 000001D38B804A34

free.LIBCMT ref: 000001D38B803C9A
free.LIBCMT ref: 000001D38B803CA7
free.LIBCMT ref: 000001D38B803CB4

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction ID: 4e5a6f844676187256107d98e5efb2fc4ff3fcc4fcbf29b6fd0aa7c4fdb4b43a
Opcode Fuzzy Hash: 20bbb3d3feebccc814164c8c2da5a031c5bb9bc1d7db45e54f975c03fff4b992
Instruction Fuzzy Hash: BE71E5323147C646EB299B2794407EE7791F789BC8F404626FD5A87B86DB38C607E702

Function 000001D38B836C8C Relevance: 10.6, APIs: 7, Instructions: 145stringCOMMON

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001D38B836CA8
malloc.LIBCMT ref: 000001D38B836CF3
strtok.LIBCMT ref: 000001D38B836D5B
strtok.LIBCMT ref: 000001D38B836D9B
_time64.LIBCMT ref: 000001D38B836DB3
_time64.LIBCMT ref: 000001D38B836E6B
_time64.LIBCMT ref: 000001D38B836F2A

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _time64$strtok$malloc
String ID:
API String ID: 2141844861-0
Opcode ID: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction ID: 530e9288273eb6432d095f8997fd76f15849ca3b6bee9d0d354eac89d0c66803
Opcode Fuzzy Hash: 3ec86a168063cedbcd3a6d3fa6ff427ab04d0b3937c976a49be1e9dad73c97c2
Instruction Fuzzy Hash: 68911A31109ACB8AE768CB19E88839977A0F389754F24031BF5BD437A5CB7CC244EB12

Function 000001D38B83B198 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001D38B83B1B5

Part of subcall function 000001D38B83EA24: _errno.LIBCMT ref: 000001D38B83EA2D
Part of subcall function 000001D38B83EA24: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B83EA38

_errno.LIBCMT ref: 000001D38B83B1C5

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_errno.LIBCMT ref: 000001D38B83B1E1
_isatty.LIBCMT ref: 000001D38B83B242
_getbuf.LIBCMT ref: 000001D38B83B24E

Strings

, xrefs: 000001D38B83B1D0

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-3916222277
Opcode ID: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction ID: 896e9e07dbba1b763551760a112d7b1598249395cf1f7731d16d06f853c2550a
Opcode Fuzzy Hash: dd06a51d82cda53a533cef69c96422d32d0124e5c0f38170d00e86b5a0f363e2
Instruction Fuzzy Hash: D941F1B2610BC68AEB5C9F24C4913AC36A0E7D8B50F144317FA7E473C5DA78CA51E762

Function 000001D38B8D9D20 Relevance: 10.6, APIs: 7, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D38B8D9D54

Part of subcall function 000001D38B8CBF24: _getptd.LIBCMT ref: 000001D38B8CBF3A
Part of subcall function 000001D38B8CBF24: __updatetlocinfo.LIBCMT ref: 000001D38B8CBF6F
Part of subcall function 000001D38B8CBF24: __updatetmbcinfo.LIBCMT ref: 000001D38B8CBF96

_errno.LIBCMT ref: 000001D38B8D9D6F
_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8D9D7A

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction ID: ee4c53b31b1dfb1fc0610fab18de6854d1f87e37c31f3368c9b86ec658c0ba1e
Opcode Fuzzy Hash: 9aa24401b2afff689c0b0903031154c7b35a263849ab08805c315ffe4c7e00e0
Instruction Fuzzy Hash: 49319E71208B8A8FD798DF1890857A972E0FB58360F5903AFB469C72D2DB70CE40D786

Function 000001D38B8C99D8 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8C99FE

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8C9A0A
__crtIsPackagedApp.LIBCMT ref: 000001D38B8C9A1B
_dosmaperr.LIBCMT ref: 000001D38B8C9A65

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: bc406b51916c7f8ca3e974fc5913ebd73ec40ba520d7cf87fdcd4f950a48aa27
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: C031DB70614A4A8FFB98AF6994557A972D1FF88310F14439EF42AC32D1DB38C9419703

Function 000001D38B8D4818 Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8D4831

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

__lock_fhandle.LIBCMT ref: 000001D38B8D4879
__doserrno.LIBCMT ref: 000001D38B8D48AE
_errno.LIBCMT ref: 000001D38B8D48B5
_unlock_fhandle.LIBCMT ref: 000001D38B8D48C5

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction ID: 6adf046d6014b49591693d8823919fceefcfedd8be01a481359f23cbfd993ec5
Opcode Fuzzy Hash: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction Fuzzy Hash: 9321D332704BC74FF79CABA898953E876D0EB45390F1D031BF426872D3C6645A40A663

Function 000001D38B838DD8 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B838DFE

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B838E0A
__crtIsPackagedApp.LIBCMT ref: 000001D38B838E1B
_dosmaperr.LIBCMT ref: 000001D38B838E65

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction ID: ff00ddf89692a670c04eafd6d68c39dcb125b0b31d4807adaaf79ee6d0c37b1f
Opcode Fuzzy Hash: 4dc0a6a0ee47c2eadd5e88a02a6e6d0ec627a0b9d3dac7126e623028bf523029
Instruction Fuzzy Hash: 32318571700B868AFB18AB65D8043AD76E1BBC8B94F144726BA6D477D6DF3CC6009316

Function 000001D38B849120 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D38B849154

Part of subcall function 000001D38B83B324: _getptd.LIBCMT ref: 000001D38B83B33A
Part of subcall function 000001D38B83B324: __updatetlocinfo.LIBCMT ref: 000001D38B83B36F
Part of subcall function 000001D38B83B324: __updatetmbcinfo.LIBCMT ref: 000001D38B83B396

_errno.LIBCMT ref: 000001D38B84916F
_invalid_parameter_noinfo.LIBCMT ref: 000001D38B84917A

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction ID: c8a026f89e4c4c48895cd5fa65232467050b69b5a622740bb29e17de698b0bdc
Opcode Fuzzy Hash: 3cca304a7dfbdf6935d1adbb7e774f1f6628624d9bfd8baf126a75af7f7d8f8d
Instruction Fuzzy Hash: A8318F723047C68AE7259B1194887DDB6A4F799BE0F544222FE6817B85CB38CB41E711

Function 000001D38B8CA6D0 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8CA70C

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8CA717
memcpy_s.LIBCMT ref: 000001D38B8CA7DC
_fileno.LIBCMT ref: 000001D38B8CA847
_filbuf.LIBCMT ref: 000001D38B8CA875
_errno.LIBCMT ref: 000001D38B8CA8C5

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: 299089818d238c1706516cebcc6be376dbbcd4292788251a2987f666fdb5e9d7
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: CA61D470218F4B4BE7AC5A2C58652BA72D1F794720F24032FF4A6C36D9DA30DD52A6C7

Function 000001D38B8A2854 Relevance: 9.2, APIs: 6, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001D38B8A7F80: malloc.LIBCMT ref: 000001D38B8A7F97

Part of subcall function 000001D38B8CA1E8: _errno.LIBCMT ref: 000001D38B8CA13F
Part of subcall function 000001D38B8CA1E8: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B8CA14A

fseek.LIBCMT ref: 000001D38B8A2929
_ftelli64.LIBCMT ref: 000001D38B8A2933
fseek.LIBCMT ref: 000001D38B8A2947
fclose.LIBCMT ref: 000001D38B8A297E
fclose.LIBCMT ref: 000001D38B8A29D3
malloc.LIBCMT ref: 000001D38B8A29E2

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: 39d75bff0e89f8d3ad02754676a86c61c60e8622fe08b1e00a1d81d59aa141a8
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: 9D7114301187898FE798EF18C455B9AB7E1FBD8340F505B2EB099C32A2CA74DA45DB43

Function 000001D38B839AD0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B839B0C

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B839B17
memcpy_s.LIBCMT ref: 000001D38B839BDC
_fileno.LIBCMT ref: 000001D38B839C47
_filbuf.LIBCMT ref: 000001D38B839C75
_errno.LIBCMT ref: 000001D38B839CC5

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction ID: e64bb11118ff779e907d345797320cba9367979b6e2aafcb27f1d575a83985cc
Opcode Fuzzy Hash: ecd799a647894e1a7a20e5e3f128c4b9d353e91dff8985ebfeee713b4a510919
Instruction Fuzzy Hash: 805126717042D282FA2C9A2655007E966D1B3C8BF4F184713BE3F43BD5DB38C692A662

Function 000001D38B811C54 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 000001D38B817380: malloc.LIBCMT ref: 000001D38B817397

Part of subcall function 000001D38B8395E8: _errno.LIBCMT ref: 000001D38B83953F
Part of subcall function 000001D38B8395E8: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B83954A

fseek.LIBCMT ref: 000001D38B811D29
_ftelli64.LIBCMT ref: 000001D38B811D33
fseek.LIBCMT ref: 000001D38B811D47
fclose.LIBCMT ref: 000001D38B811D7E
fclose.LIBCMT ref: 000001D38B811DD3
malloc.LIBCMT ref: 000001D38B811DE2

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction ID: cde31aaeee21b970bd6d0f59f5d8248bf99af47a7525361c314bbb9e4f9ce4d8
Opcode Fuzzy Hash: dad127855c446f5c30b32346cc20f8ba9894d0a3e08f573577708a24a9af681f
Instruction Fuzzy Hash: 31610932219AC582EB64EB15E44139BBB61F7C9790F104216FAAE43BA9CF38C645DF41

Function 000001D38B8CA1E8 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8CA13F

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8CA14A
_getstream.LIBCMT ref: 000001D38B8CA16A
_errno.LIBCMT ref: 000001D38B8CA17C
_errno.LIBCMT ref: 000001D38B8CA18E
_openfile.LIBCMT ref: 000001D38B8CA1BC

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: c5e6b18b3144571e9179e69afa8a5b82a3a58701439bada18f836be54aef2720
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: 1821A7B0618B8F4FF7D8EB2854253A972D1EB59310F14075BB45AC3296EE34CE416753

Function 000001D38B8A1080 Relevance: 9.1, APIs: 6, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8A1097

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

free.LIBCMT ref: 000001D38B8A10E0

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: 001f0395953a40aa32d6c48aa90454e3ea54e0ca9730dea510750beba89dd2eb
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: BA313070518A89DFE788FB28C4557DA77E1FB98304F50172EB09AD32E2DA349A41DB43

Function 000001D38B8395E8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B83953F

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B83954A
_getstream.LIBCMT ref: 000001D38B83956A
_errno.LIBCMT ref: 000001D38B83957C
_errno.LIBCMT ref: 000001D38B83958E
_openfile.LIBCMT ref: 000001D38B8395BC

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction ID: 7eea34714114aa922cb239165f940643be176d1dfeae75074f74fb0f03230392
Opcode Fuzzy Hash: cc8f2cd6884705fde0d4f1a8c2f182f690a1ff23019d39bc98d417dc2c140732
Instruction Fuzzy Hash: 1921A5713157C345FF699B2198053DEA691A7CC7C0F044A22BDAE87796EB3CC681A732

Function 000001D38B810480 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B810497

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

free.LIBCMT ref: 000001D38B8104E0

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction ID: d61b2fa0b2bdc98f2fef13323f8fad9282fa612292bfa57fc66336604eced37d
Opcode Fuzzy Hash: 0af8098b402a1582bc2cea660397b660c0a575d4e31ad9d078db98f20780a169
Instruction Fuzzy Hash: 39212172519AC281EA24EB11E4513DE7760F7C8798F500317F6AE53AEADE3CC7419B42

Function 000001D38B83CE24 Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001D38B83CE41

Part of subcall function 000001D38B83ABEC: _set_error_mode.LIBCMT ref: 000001D38B83ABF5
Part of subcall function 000001D38B83ABEC: _set_error_mode.LIBCMT ref: 000001D38B83AC04
Part of subcall function 000001D38B83ABEC: _NMSG_WRITE.LIBCMT ref: 000001D38B83AC1B
Part of subcall function 000001D38B83ABEC: _NMSG_WRITE.LIBCMT ref: 000001D38B83AC25

_NMSG_WRITE.LIBCMT ref: 000001D38B83CE4B

Part of subcall function 000001D38B83AC60: _set_error_mode.LIBCMT ref: 000001D38B83ACA5
Part of subcall function 000001D38B83AC60: _set_error_mode.LIBCMT ref: 000001D38B83ACB6
Part of subcall function 000001D38B83AC60: __crtMessageBoxW.LIBCMT ref: 000001D38B83ADC9

Part of subcall function 000001D38B838F1C: __crtCorExitProcess.LIBCMT ref: 000001D38B838F24
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B838F62
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B838F77
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B838F98
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B838FAD
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B838FC1
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B838FCD
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B838FF8
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B839019
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B839032
Part of subcall function 000001D38B838F1C: free.LIBCMT ref: 000001D38B839063

_malloc_crt.LIBCMT ref: 000001D38B83CE77

Part of subcall function 000001D38B83D778: malloc.LIBCMT ref: 000001D38B83D7A3

_errno.LIBCMT ref: 000001D38B83CE84
_lock.LIBCMT ref: 000001D38B83CE98
free.LIBCMT ref: 000001D38B83CEB9

Part of subcall function 000001D38B838828: _errno.LIBCMT ref: 000001D38B838848

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_set_error_mode$__crt_errno$ExitMessageProcess_lock_malloc_crtmalloc
String ID:
API String ID: 2751257304-0
Opcode ID: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction ID: 0a75bef5b5e0b8f49a3e2aff74a68385d7b68c89b85d20fffd4582a92d668c97
Opcode Fuzzy Hash: 678e4a959376ceb353347c4c6683ca163f7139e42d5e898c0f83e718a8999621
Instruction Fuzzy Hash: B61173312157CA81F76CAB60E8453EA3251E7C8780F041623F57D466E2CF7C8654B723

Function 000001D38B894170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8941BD

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

malloc.LIBCMT ref: 000001D38B8941C8

Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94FC
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C9501

free.LIBCMT ref: 000001D38B8942AF
free.LIBCMT ref: 000001D38B8942B7
free.LIBCMT ref: 000001D38B8942BF
free.LIBCMT ref: 000001D38B8942CB
free.LIBCMT ref: 000001D38B8942D8

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: 0d281ac2b83b3a6caed81079182973c2de229d551c303fb584bdf80e94748368
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: 0351B730628F4B4BEB6D9B6894516F973D5FB49304F54036EE85BC3287EE50DD428682

Function 000001D38B803570 Relevance: 8.9, APIs: 7, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8035BD

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

malloc.LIBCMT ref: 000001D38B8035C8

Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388FC
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B838901

free.LIBCMT ref: 000001D38B8036AF
free.LIBCMT ref: 000001D38B8036B7
free.LIBCMT ref: 000001D38B8036BF
free.LIBCMT ref: 000001D38B8036CB
free.LIBCMT ref: 000001D38B8036D8

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction ID: 8242c09d79969c047c363355c1be9da34bf5ecf2c87c20f9458588aa1d2744ec
Opcode Fuzzy Hash: 5e7a048ee2cb6ce51b5ff79f866e9b97e29af1da38353bc06982188158118a3e
Instruction Fuzzy Hash: 1941AF313107D29BFA5D9B27D5542AA2790F749BC0F404A26EE7A07742DF38DA27E701

Function 000001D38B89CB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001D38B8A7F80: malloc.LIBCMT ref: 000001D38B8A7F97

malloc.LIBCMT ref: 000001D38B89CC4E

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

Part of subcall function 000001D38B8C8AEC: malloc.LIBCMT ref: 000001D38B8C8B27

Part of subcall function 000001D38B8C8AEC: realloc.LIBCMT ref: 000001D38B8C8B4E

malloc.LIBCMT ref: 000001D38B89CD82
_snprintf.LIBCMT ref: 000001D38B89CE10
_snprintf.LIBCMT ref: 000001D38B89CE4A
_snprintf.LIBCMT ref: 000001D38B89CE74
free.LIBCMT ref: 000001D38B89D07B

Part of subcall function 000001D38B8C9428: RtlFreeHeap.NTDLL ref: 000001D38B8C943E
Part of subcall function 000001D38B8C9428: _errno.LIBCMT ref: 000001D38B8C9448

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$FreeHeap_callnewhfreerealloc
String ID:
API String ID: 1397185943-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: e9d84a55020ce1aaf2c5bb7371322ee498c420b2a95930f35b351a3e78a35903
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: EAE11F742146868FF798EB28C4617EAB7E1FB84300F50462FB1A9C72D2DB749A45DB43

Function 000001D38B80BF50 Relevance: 7.8, APIs: 6, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 000001D38B817380: malloc.LIBCMT ref: 000001D38B817397

malloc.LIBCMT ref: 000001D38B80C04E

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

Part of subcall function 000001D38B837EEC: malloc.LIBCMT ref: 000001D38B837F27

Part of subcall function 000001D38B837EEC: realloc.LIBCMT ref: 000001D38B837F4E

malloc.LIBCMT ref: 000001D38B80C182
_snprintf.LIBCMT ref: 000001D38B80C210
_snprintf.LIBCMT ref: 000001D38B80C24A
_snprintf.LIBCMT ref: 000001D38B80C274
free.LIBCMT ref: 000001D38B80C47B

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction ID: b9fa9f9803c94fda85ecf4e165b6b7b33ed4ece3c57ca3c347f1d84331d7c37c
Opcode Fuzzy Hash: a8f35467ff893584f98e16b323471e84d8a89d8ed4578621f824f5b2abd654e3
Instruction Fuzzy Hash: 61D150712186C38AF758AF64E4513DE76A1F7C8380F104227F6AD876D6CF38CA05AB52

Function 000001D38B8D4424 Relevance: 7.7, APIs: 5, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001D38B8D4451

Part of subcall function 000001D38B8CDA24: _FF_MSGBANNER.LIBCMT ref: 000001D38B8CDA41
Part of subcall function 000001D38B8CDA24: _NMSG_WRITE.LIBCMT ref: 000001D38B8CDA4B

_lock.LIBCMT ref: 000001D38B8D4464
_lock.LIBCMT ref: 000001D38B8D44BF
_calloc_crt.LIBCMT ref: 000001D38B8D4576

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: 0a21c25f67ce513ed17c108636bdebb2d07fa4027e3d4d2171e269d49bf982af
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: D6510671514A4B8FE7A89F58C8813A5B3E0FB58350F18035FF85AC72A2D674DD429B83

Function 000001D38B8954F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B89553A

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

malloc.LIBCMT ref: 000001D38B895545

Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94FC
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C9501

free.LIBCMT ref: 000001D38B89562C
free.LIBCMT ref: 000001D38B895634
free.LIBCMT ref: 000001D38B895640
free.LIBCMT ref: 000001D38B89564D

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: 2f7538b25a390b90ee40bfec90fc19804d44f033266ca211d603f7e5731d5948
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: FE41EB30228F4E4BEB5E9B6884552FA37D5E795310F14426EE497C3243ED20E9079792

Function 000001D38B8CBD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001D38B8CBDB5

Part of subcall function 000001D38B8CF624: _errno.LIBCMT ref: 000001D38B8CF62D
Part of subcall function 000001D38B8CF624: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B8CF638

_errno.LIBCMT ref: 000001D38B8CBDC5

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

_errno.LIBCMT ref: 000001D38B8CBDE1
_isatty.LIBCMT ref: 000001D38B8CBE42
_getbuf.LIBCMT ref: 000001D38B8CBE4E

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: ae93fd7eff680dc44de180a529d557111396527b9a1dc64bb52e411d87c11d5b
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: AA51AFB0114E8E4FEB9CEF28C0A17A976D0EB44710F14035AF966CB2D6D734CB419B92

Function 000001D38B8ACF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8ACF18

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

_snprintf.LIBCMT ref: 000001D38B8ACF38

Part of subcall function 000001D38B8C9700: _errno.LIBCMT ref: 000001D38B8C9737
Part of subcall function 000001D38B8C9700: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B8C9742

free.LIBCMT ref: 000001D38B8ACF57

Part of subcall function 000001D38B8C9428: RtlFreeHeap.NTDLL ref: 000001D38B8C943E
Part of subcall function 000001D38B8C9428: _errno.LIBCMT ref: 000001D38B8C9448

malloc.LIBCMT ref: 000001D38B8ACFE0
_snprintf.LIBCMT ref: 000001D38B8AD007
free.LIBCMT ref: 000001D38B8AD045

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: 894693eeb91ff7b0a02ce2dc03c60b0f1ccdc40220eb89e880d87bab2b5d269a
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: 13418A3021CA89CFE794EB28C854FAA77F1FB99304F50066DF499C32A1DA65DA45DB03

Function 000001D38B8048F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B80493A

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

malloc.LIBCMT ref: 000001D38B804945

Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388FC
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B838901

free.LIBCMT ref: 000001D38B804A2C
free.LIBCMT ref: 000001D38B804A34
free.LIBCMT ref: 000001D38B804A40
free.LIBCMT ref: 000001D38B804A4D

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction ID: a5684794ee017d60d468dbd52aea9c33c897e5b9eda20b43f8874ac32fe6e2ff
Opcode Fuzzy Hash: a811918bd02154efe4651bb2500c9e1759e1a3ef0e0cb23a63cb8994a19cfb31
Instruction Fuzzy Hash: 984136323103C746FA0A9B2B54006DE6BA4F795BC8F484226FD254B742DE38CA07E306

Function 000001D38B8D9262 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 000001D38B8D910C
_malloc_crt.LIBCMT ref: 000001D38B8D912E
free.LIBCMT ref: 000001D38B8D91C4
_recalloc_crt.LIBCMT ref: 000001D38B8D9275

Part of subcall function 000001D38B8CE478: _recalloc.LIBCMT ref: 000001D38B8CE4A8

_calloc_crt.LIBCMT ref: 000001D38B8D92B1

Part of subcall function 000001D38B8CE2F8: _calloc_impl.LIBCMT ref: 000001D38B8CE326

_errno.LIBCMT ref: 000001D38B8D9301

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

free.LIBCMT ref: 000001D38B8D930F
free.LIBCMT ref: 000001D38B8D931C
free.LIBCMT ref: 000001D38B8D932E

Part of subcall function 000001D38B8D4FBC: _errno.LIBCMT ref: 000001D38B8D4FD4
Part of subcall function 000001D38B8D4FBC: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B8D4FE0

_invoke_watson.LIBCMT ref: 000001D38B8D934A

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$_errno_malloc_crt$_calloc_crt_calloc_impl_getptd_noexit_invalid_parameter_noinfo_invoke_watson_recalloc_recalloc_crt
String ID:
API String ID: 321378830-0
Opcode ID: 1af5591cc140629ef8a1eaab72b160ba28423dfa39d6b40620a42b0b9187e2b6
Instruction ID: ee01628a385174270883b0e2fb8198dc2c5de2d12f546dca4c94c1edf5a2fec5
Opcode Fuzzy Hash: 1af5591cc140629ef8a1eaab72b160ba28423dfa39d6b40620a42b0b9187e2b6
Instruction Fuzzy Hash: DE21B531314E8F4FE79CAF6998567E972C0FB84391F54426FA46AC31E2EA249A418643

Function 000001D38B8D963A Relevance: 7.6, APIs: 5, Instructions: 99COMMON

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 000001D38B8D94B9
_malloc_crt.LIBCMT ref: 000001D38B8D94DE
free.LIBCMT ref: 000001D38B8D957B
_recalloc_crt.LIBCMT ref: 000001D38B8D964D

Part of subcall function 000001D38B8CE478: _recalloc.LIBCMT ref: 000001D38B8CE4A8

_calloc_crt.LIBCMT ref: 000001D38B8D968C

Part of subcall function 000001D38B8CE2F8: _calloc_impl.LIBCMT ref: 000001D38B8CE326

_errno.LIBCMT ref: 000001D38B8D96D6

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

free.LIBCMT ref: 000001D38B8D96E4
free.LIBCMT ref: 000001D38B8D96F1
free.LIBCMT ref: 000001D38B8D9703

Part of subcall function 000001D38B8D2DD0: _errno.LIBCMT ref: 000001D38B8D2DEC
Part of subcall function 000001D38B8D2DD0: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B8D2DF8

_invoke_watson.LIBCMT ref: 000001D38B8D971F

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$_errno_malloc_crt$_calloc_crt_calloc_impl_getptd_noexit_invalid_parameter_noinfo_invoke_watson_recalloc_recalloc_crt
String ID:
API String ID: 321378830-0
Opcode ID: 8a2acd4545fb3e1ff377b7186d7311079e6a4c6a1743b8f02e9e066f6884292d
Instruction ID: c3ae7e47945ac2ef55d7d99598cb24d9b9fcda37ccbc20f29add95c54c92ca1d
Opcode Fuzzy Hash: 8a2acd4545fb3e1ff377b7186d7311079e6a4c6a1743b8f02e9e066f6884292d
Instruction Fuzzy Hash: 0C21D171318E4B8FF7986F18D4527ED32C1EB843A1F54032BE46AC32D6EB2499119783

Function 000001D38B8D95B9 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_recalloc_crt.LIBCMT ref: 000001D38B8D95D1

Part of subcall function 000001D38B8CE478: _recalloc.LIBCMT ref: 000001D38B8CE4A8

_calloc_crt.LIBCMT ref: 000001D38B8D968C
_errno.LIBCMT ref: 000001D38B8D96D6
free.LIBCMT ref: 000001D38B8D96E4
free.LIBCMT ref: 000001D38B8D96F1
free.LIBCMT ref: 000001D38B8D9703

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$_calloc_crt_errno_recalloc_recalloc_crt
String ID:
API String ID: 3700215360-0
Opcode ID: 5671fb06d6f05841401363cc8443e27ee7f0052eb4ca124240904de72179e6d7
Instruction ID: a2a6d7175ef5e3c08a9964f658f15b7b2ddb867ab4908f85f334fa1ce3f43798
Opcode Fuzzy Hash: 5671fb06d6f05841401363cc8443e27ee7f0052eb4ca124240904de72179e6d7
Instruction Fuzzy Hash: 4821A132718E5A4BF798AF18E4517ED72C1EB84391F48422BE46BC31D2EE2499019783

Function 000001D38B8D91FD Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_recalloc_crt.LIBCMT ref: 000001D38B8D9215

Part of subcall function 000001D38B8CE478: _recalloc.LIBCMT ref: 000001D38B8CE4A8

_calloc_crt.LIBCMT ref: 000001D38B8D92B1
_errno.LIBCMT ref: 000001D38B8D9301
free.LIBCMT ref: 000001D38B8D930F
free.LIBCMT ref: 000001D38B8D931C
free.LIBCMT ref: 000001D38B8D932E

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$_calloc_crt_errno_recalloc_recalloc_crt
String ID:
API String ID: 3700215360-0
Opcode ID: d21b9421d81b7aad527b41b40eb760196fdcb429390ac35a4901b8c372e18314
Instruction ID: d922a8d26a63e24670467ed3a3749431694fdad089c4fb84ca29f0bc8937d694
Opcode Fuzzy Hash: d21b9421d81b7aad527b41b40eb760196fdcb429390ac35a4901b8c372e18314
Instruction Fuzzy Hash: EA21C532314E8F4FF69CAB6998553E973C1EB84391F44426BB46AC31D2EE248A059243

Function 000001D38B8D46C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8D46D9

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

__doserrno.LIBCMT ref: 000001D38B8D46D1

Part of subcall function 000001D38B8CB6A4: _getptd_noexit.LIBCMT ref: 000001D38B8CB6A8

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: b2881899653bef5bfb149895e372c0baf54685db89f74d52e2177f74ac3ba815
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: 5901D131124DCF8EFADCAB24C8557D832E0EF16325F6C834BB42A870E2C7780640A623

Function 000001D38B8A33EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8A3404

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

_snprintf.LIBCMT ref: 000001D38B8A342E

Part of subcall function 000001D38B8C9700: _errno.LIBCMT ref: 000001D38B8C9737
Part of subcall function 000001D38B8C9700: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B8C9742

remove.LIBCMT ref: 000001D38B8A343F
remove.LIBCMT ref: 000001D38B8A344B
free.LIBCMT ref: 000001D38B8A3455

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: 6cd909421affb4df58697a5381db0f27d1ce6a83a8438f41c5bda71e8cf160a4
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: E001FFB0528B89DFE388EB18C455B99B7E1FBD4700F90166EB495C2291DB349644D743

Function 000001D38B843AC8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B843AD9

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

__doserrno.LIBCMT ref: 000001D38B843AD1

Part of subcall function 000001D38B83AAA4: _getptd_noexit.LIBCMT ref: 000001D38B83AAA8

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction ID: 6ebf012ae306265b105061872fc59def83bb44089f2de2925406671b30f4abf2
Opcode Fuzzy Hash: 69af7df2a7883d456bcc134dc4df00a852c2ddf9a1d90879d0859074316e13fb
Instruction Fuzzy Hash: 870169B2750AC685FE0D9B14C8813EC26919BA4BB1F594317F63E063D2C77C4600A223

Function 000001D38B8127EC Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B812804

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

_snprintf.LIBCMT ref: 000001D38B81282E

Part of subcall function 000001D38B838B00: _errno.LIBCMT ref: 000001D38B838B37
Part of subcall function 000001D38B838B00: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B838B42

remove.LIBCMT ref: 000001D38B81283F
remove.LIBCMT ref: 000001D38B81284B
free.LIBCMT ref: 000001D38B812855

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction ID: 7a4bddce0c0b47a69b358b00d244135e8656b8bf677c2c31d58f1accee2abe91
Opcode Fuzzy Hash: 760ecfd8c636994a04cd86e70f51933710fad854b9dafff484940356d921bfbf
Instruction Fuzzy Hash: 39F0EC72528AC286D644AB51F85139EA364F7C4780F401217F69E53B5ADF38C6119B41

Function 000001D38B8C68D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8C6917
free.LIBCMT ref: 000001D38B8C693C

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: 3f8b9efb04b3317ce23228cf72a236e245f84de0210c3e4b135dfc588d15d9c4
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: 24912B70218785CFE7A8EB68C4657DEB7E1FB84300F504A2EB09AC3291DB759A45D743

Function 000001D38B835CD4 Relevance: 6.4, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B835D17
free.LIBCMT ref: 000001D38B835D3C

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction ID: c6f70f3f0283934acc1e346a778cc782ee873e4bf56b486e1d66c342f759e7ac
Opcode Fuzzy Hash: c51b43109db90fd33d1ada2d315fcc84a1e87e059fcc81b7406d59bf9917b86e
Instruction Fuzzy Hash: 548195322086C68AE768DB24E4443DEB7A1F3C9340F500626F69D87AE9DF7DD644DB12

Function 000001D38B8C92BC Relevance: 6.3, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8C92D6

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

malloc.LIBCMT ref: 000001D38B8C92F5

Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94FC
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C9501

malloc.LIBCMT ref: 000001D38B8C932C
_snprintf.LIBCMT ref: 000001D38B8C9358

Part of subcall function 000001D38B8C9700: _errno.LIBCMT ref: 000001D38B8C9737
Part of subcall function 000001D38B8C9700: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B8C9742

malloc.LIBCMT ref: 000001D38B8C939B

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: 046dcced6a180eafca9fa47aca73ce94a928ead95a3356ef074dae0f7917400f
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: 7931E974518B489FDB88EF18C054A5AB7E1FB9C315F100A6EB48DD33A1CB34DA41CB42

Function 000001D38B8386BC Relevance: 6.3, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8386D6

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

malloc.LIBCMT ref: 000001D38B8386F5

Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388FC
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B838901

malloc.LIBCMT ref: 000001D38B83872C
_snprintf.LIBCMT ref: 000001D38B838758

Part of subcall function 000001D38B838B00: _errno.LIBCMT ref: 000001D38B838B37
Part of subcall function 000001D38B838B00: _invalid_parameter_noinfo.LIBCMT ref: 000001D38B838B42

malloc.LIBCMT ref: 000001D38B83879B

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction ID: 1d31473a1ed0315b178c203d6248c57f2e1ec648c8ef3e741903e4e92aa89221
Opcode Fuzzy Hash: a91d58c26d0a57bc794e59067ccea32def16148bb1a1b4aba4a4af629da6f414
Instruction Fuzzy Hash: 9D21A276608B8486DA64DB16E49025AB7A0F3CCB94F104216EFED53BA9CF3CC652CF40

Function 000001D38B8CA1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8CA22C

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8CA237
_flush.LIBCMT ref: 000001D38B8CA2E9
_fileno.LIBCMT ref: 000001D38B8CA30A

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: 42330c2842b02cb0a38b9f63f12248c58440cbcd45a33a9285cbbaeb8545325e
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: 0051F6B0208F4B4BE6AC5E6D54653B572C0E758310F14032FF4AAC31DAEA71DD429183

Function 000001D38B8395F4 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B83962C

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B839637
_flush.LIBCMT ref: 000001D38B8396E9
_fileno.LIBCMT ref: 000001D38B83970A

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction ID: 9a649ba6efafbf22a98a4c43f7531e64753588c9becac47851447418b4acc519
Opcode Fuzzy Hash: c6c5643f4c80cb2c6c3217124f929d6583e36cafa3d7826c52d13d0a973425dc
Instruction Fuzzy Hash: D94116313052C286FE6C5E269540399B681B7CCBD0F484326BE7F477D5E678C681A252

Function 000001D38B8910D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001D38B891117
clock.LIBCMT ref: 000001D38B891124
clock.LIBCMT ref: 000001D38B89112D
clock.LIBCMT ref: 000001D38B89113A

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: f04d4eff27f227221344d5a399c5ab83c54852bf6d4bc84bb4dc52c9d7309fd5
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: A521F63240C74A2AEB6CB9A894423A7B6C0E785350F15132FF8A683243E5509D4296C7

Function 000001D38B8D9728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D38B8D974C

Part of subcall function 000001D38B8CBF24: _getptd.LIBCMT ref: 000001D38B8CBF3A
Part of subcall function 000001D38B8CBF24: __updatetlocinfo.LIBCMT ref: 000001D38B8CBF6F
Part of subcall function 000001D38B8CBF24: __updatetmbcinfo.LIBCMT ref: 000001D38B8CBF96

_errno.LIBCMT ref: 000001D38B8D9758

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8D9763
strchr.LIBCMT ref: 000001D38B8D9779

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: 5bac68b110fdb7a4c5a97245c29a4ac807decbd3915eea5e1db033ef5d93f1c7
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: 3021DD72518AE78EE79CAF2840943BA76D1E745395F9C075BB0B6C71C1CB608A41E253

Function 000001D38B848B28 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001D38B848B4C

Part of subcall function 000001D38B83B324: _getptd.LIBCMT ref: 000001D38B83B33A
Part of subcall function 000001D38B83B324: __updatetlocinfo.LIBCMT ref: 000001D38B83B36F
Part of subcall function 000001D38B83B324: __updatetmbcinfo.LIBCMT ref: 000001D38B83B396

_errno.LIBCMT ref: 000001D38B848B58

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B848B63
strchr.LIBCMT ref: 000001D38B848B79

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction ID: c11455b89939a56ac17954cf50a6e34753f4ed8e735ffa29f2eae24313f73245
Opcode Fuzzy Hash: 2fda11324eeaf47a8ee3b41ffe9ccb24b03a26f89d14d92f7fadfdcc20f1c38e
Instruction Fuzzy Hash: CB2127F22042E649EB68561590503FD66D0E384BD4F1C5727FAB60BAC7CAACC741E712

Function 000001D38B8004D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 000001D38B800517
clock.LIBCMT ref: 000001D38B800524
clock.LIBCMT ref: 000001D38B80052D
clock.LIBCMT ref: 000001D38B80053A

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 05cbe19735d6a4722a0bf573421b196704e4bc28a5dae99128ad25e6c379327c
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: BB110632504BDB45F7789EA674802EBB690FB843D0F191227FE7463292E974CA82D602

Function 000001D38B8170FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001D38B817380: malloc.LIBCMT ref: 000001D38B817397

strrchr.LIBCMT ref: 000001D38B8171F2
_snprintf.LIBCMT ref: 000001D38B81730C

Strings

:, xrefs: 000001D38B81734F

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: :
API String ID: 3587327836-336475711
Opcode ID: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction ID: 3b151d7990a1addb7410c48346d7fd46e1239d8c5c5ecf5ddb7f587b2d55a060
Opcode Fuzzy Hash: 5042e97771ee50c8e95a1b01eede4ab7b041b3ed2cf5d813aa0aae0d836cddbb
Instruction Fuzzy Hash: 12612876219BC586E754DB15E88039ABBA0F3C9790F105226FAEE47BA9CF7CC541CB01

Function 000001D38B8AB940 Relevance: 5.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8AB9AA

Part of subcall function 000001D38B8C9468: _FF_MSGBANNER.LIBCMT ref: 000001D38B8C9498
Part of subcall function 000001D38B8C9468: _NMSG_WRITE.LIBCMT ref: 000001D38B8C94A2
Part of subcall function 000001D38B8C9468: _callnewh.LIBCMT ref: 000001D38B8C94D6
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94E1
Part of subcall function 000001D38B8C9468: _errno.LIBCMT ref: 000001D38B8C94EC

free.LIBCMT ref: 000001D38B8ABDE3

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: 074da69fc13e58fa7806523a5478ce0d814cbbead7764d375fa99eaa34f8d8dc
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: E6D1E870258BC6DFD7A4EB18C0547ABB7E1FB9A315F901A2EE58983250DB309981D707

Function 000001D38B8C9924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B8C9975

Part of subcall function 000001D38B8CB714: _getptd_noexit.LIBCMT ref: 000001D38B8CB718

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B8C9980

Strings

B, xrefs: 000001D38B8C99AC

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: 130b0f5f69734f52f7f69108ec72144e9d5fc0397c1f1735a179a2a53a44d483
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: D9118270218F498FD798EF5994857A5B7E1FB98325F1047AEB42DC32A1CB74CA44CB82

Function 000001D38B8412F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__crtCapturePreviousContext.LIBCMT ref: 000001D38B8417B5
__raise_securityfailure.LIBCMT ref: 000001D38B841857

Strings

sv-FI, xrefs: 000001D38B841850

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: CaptureContextPrevious__crt__raise_securityfailure
String ID: sv-FI
API String ID: 37250909-2947700294
Opcode ID: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction ID: 90ba8ce312e6c02c37c5b92d5f924c62babf46ebe3e1215a21032fb56d3a5101
Opcode Fuzzy Hash: 9f53ab00d13e9a342103fd536e2d944939a79712ef2d4f4aeda1767cd607b540
Instruction Fuzzy Hash: E721F234214B8A81EA189B18E8553D66BA4F385344F900327FAAD877A5EF3C9714E702

Function 000001D38B838D24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001D38B838D75

Part of subcall function 000001D38B83AB14: _getptd_noexit.LIBCMT ref: 000001D38B83AB18

_invalid_parameter_noinfo.LIBCMT ref: 000001D38B838D80

Strings

B, xrefs: 000001D38B838DAC

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction ID: d7ba0fdfd993d99315f88091a3445f3791f116ba158c945c2199118be5dd7d40
Opcode Fuzzy Hash: bd58f0530e0c488c71797034e25c9bf653429e439c692c434a90aaed543f7fa3
Instruction Fuzzy Hash: AE118EB2610A8086EB149B52E440399B6A1F798FE4F584322BB6C07B96CF38C240CB11

Function 000001D38B8010C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001D38B80116A

Part of subcall function 000001D38B848358: _calloc_impl.LIBCMT ref: 000001D38B848368
Part of subcall function 000001D38B848358: _errno.LIBCMT ref: 000001D38B84837B
Part of subcall function 000001D38B848358: _errno.LIBCMT ref: 000001D38B848385

free.LIBCMT ref: 000001D38B8012F3
free.LIBCMT ref: 000001D38B8012FD
free.LIBCMT ref: 000001D38B80130F

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction ID: e884ddbb4d4d4f646e4a735860c4dd304b6e586a697e84d7291a6dcc17ce134e
Opcode Fuzzy Hash: 8ca7377d6160abed60e61000ef39786ff8db9ad75b6d968bcb858b8998d5a5ab
Instruction Fuzzy Hash: 02C10932604B85CAE768DF65E48039E77B4F788B94F10422AEB8D87B58DF38C555DB01

Function 000001D38B81AD40 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B81ADAA

Part of subcall function 000001D38B838868: _FF_MSGBANNER.LIBCMT ref: 000001D38B838898
Part of subcall function 000001D38B838868: _NMSG_WRITE.LIBCMT ref: 000001D38B8388A2
Part of subcall function 000001D38B838868: _callnewh.LIBCMT ref: 000001D38B8388D6
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388E1
Part of subcall function 000001D38B838868: _errno.LIBCMT ref: 000001D38B8388EC

free.LIBCMT ref: 000001D38B81B1E3

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction ID: 4ab8bd08549144ee23af024517bf957da70b963a844895d5ed0bd069c284d3f3
Opcode Fuzzy Hash: 9f3e12b26db61c15565dc3452f0e8a98f6bb8c253c0c8c62c771028bca80e689
Instruction Fuzzy Hash: ACC1D8B6219AC1CAD7B4CA15E08039FB7A0F789795F50112AFBDA43B58DB39C940DF06

Function 000001D38B89FBEC Relevance: 5.2, APIs: 4, Instructions: 221COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001D38B89FCA9
_snprintf.LIBCMT ref: 000001D38B89FCC9
_snprintf.LIBCMT ref: 000001D38B89FD9A

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: 0e55fdf1e31888e8e5bc92a8df16bf82ac996fd54d4380c4a09cf591a53735a1
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: 13913470118B898FE7A8EF18D455B9BB7E1FB99301F50062EE49EC32A1DB749541CB43

Function 000001D38B894300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B894363

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: 09a5690258138e636d06e6ab824a9d52c24d98e3f0d8ca1af3454f84f6dc696c
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: 1351B87022CA474BEF6CDF2894916AA73D1FB94300F14466EF86BC3287EE30DD529642

Function 000001D38B80EFEC Relevance: 5.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001D38B80F0A9
_snprintf.LIBCMT ref: 000001D38B80F0C9
_snprintf.LIBCMT ref: 000001D38B80F19A

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction ID: 94fdfe4ff6f794a7247da60b1db598034ba8f0f357a923d3f15b2da3885544e2
Opcode Fuzzy Hash: 964770dd05ef821e2aacc901c70c6f38254c4cd412dbff5c462cae5e6ebdf0b1
Instruction Fuzzy Hash: 2981E636208BC686E7249B51F8503DAB761F3897A4F504327EAAD43BA9DF3CC645DB01

Function 000001D38B803700 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B803763

Memory Dump Source

Source File: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction ID: 47094b354730f14013c54c470a47150f6f6180dcf37076753b45a733c9f283d3
Opcode Fuzzy Hash: 1a305bbe9122f1aaabfb9c066298554f52a7825b389ea4342c2348e755cda45b
Instruction Fuzzy Hash: 18418C327047C287EB5DDB27A4006AD67A0F388BC4F444A26EE3A47785EF34DA06D701

Function 000001D38B8C7594 Relevance: 5.1, APIs: 4, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001D38B8C761F
_snprintf.LIBCMT ref: 000001D38B8C7644
_snprintf.LIBCMT ref: 000001D38B8C76A4
_snprintf.LIBCMT ref: 000001D38B8C76C9

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 40ff0c962953611e2ec08158fa3c2d936975316577c874da240df1d1ec0b2656
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: CC417F74118A89CFE799EB18D855BDA77E0F798310F60066AB49AC32E0DB38DA45C743

Function 000001D38B8C7D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B8C7D4E
strtok.LIBCMT ref: 000001D38B8C7DAC
strtok.LIBCMT ref: 000001D38B8C7DBE
free.LIBCMT ref: 000001D38B8C7DD7

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: 4fc1f3f0bfd8718c1c98ad807f8bcbd273e3e2fa2db6744d2b4af121444cceea
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: E5317E70528B8D9FE7D4FB18C454BA97BE1FB99315F500A1EB09AC32A1DB34D942DB02

Function 000001D38B836994 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001D38B836A1F
_snprintf.LIBCMT ref: 000001D38B836A44
_snprintf.LIBCMT ref: 000001D38B836AA4
_snprintf.LIBCMT ref: 000001D38B836AC9

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 7c656a0e0e11e5a9d1cef21bf46a2f8c2e218e92ea7bd51e6aab4ca9baf33152
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 63314B31118AC782E6298B15E8443DAA760F3C97A4F544327FABD43BE5DB3CC641DB12

Function 000001D38B837104 Relevance: 5.0, APIs: 4, Instructions: 50stringCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001D38B83714E
strtok.LIBCMT ref: 000001D38B8371AC
strtok.LIBCMT ref: 000001D38B8371BE
free.LIBCMT ref: 000001D38B8371D7

Memory Dump Source

Source File: 00000004.00000003.1858149447.000001D38B81D000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001D38B800000, based on PE: true

Associated: 00000004.00000003.1858125731.000001D38B800000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.1858149447.000001D38B85C000.00000020.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d38b800000_rundll32.jbxd

Yara matches

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction ID: 6cf61d18785f40ebb780965641574c11d3facc04edb0dcc46e836a3c6f8fd560
Opcode Fuzzy Hash: 80ab93629553fc5d6cc24c753a0247cda557e51b81ee1ac9acc78e4d89c7d1cf
Instruction Fuzzy Hash: 0F21F936115BCA85EA689F15F88439E6760F3CA7A4F501306FABE427E9CF3CC2409B01

Function 000001D38B8C93B8 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000001D38B8C93D8

Part of subcall function 000001D38B8C9428: RtlFreeHeap.NTDLL ref: 000001D38B8C943E
Part of subcall function 000001D38B8C9428: _errno.LIBCMT ref: 000001D38B8C9448

free.LIBCMT ref: 000001D38B8C93E6
free.LIBCMT ref: 000001D38B8C93F4
free.LIBCMT ref: 000001D38B8C93FE

Memory Dump Source

Source File: 00000004.00000002.1861894923.000001D38B891000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001D38B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1d38b891000_rundll32.jbxd

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction ID: e9ad9d5aa18d8e2b596e2083b12bffa39559969404e868b63045cac40e1060f6
Opcode Fuzzy Hash: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction Fuzzy Hash: ABF0457422CD89AFD6C9FB18C8A5E9977E1FF98300F801599B059C73A2DA24E940DB12

Analysis Process: rundll32.exePID: 7932, Parent PID: 7748COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Executed Functions

Function 0000021A31B9D0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 0000021A31B9D1A3
0, xrefs: 0000021A31B9D1AB

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: ac993ae998990f084226b803f2a2ac8bd0a5ea572e049315fbf0d56f22183ffb
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: B14183301197458FE7A8DF29C4987AAB7E0FBA8355F9049BDE099C32A1DB74C845CB03

Non-executed Functions

Function 0000021A31BC0EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BC0F1E

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

__doserrno.LIBCMT ref: 0000021A31BC0F15

Part of subcall function 0000021A31BBB6A4: _getptd_noexit.LIBCMT ref: 0000021A31BBB6A8

__doserrno.LIBCMT ref: 0000021A31BC0F7B
_errno.LIBCMT ref: 0000021A31BC0F82
_invalid_parameter_noinfo.LIBCMT ref: 0000021A31BC0FE6

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: 980d9ceb90e58cd5ec4f6f1f09dbe45919e3773f8ff62e116b73510a36f689b5
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: 6E31E17420A7454FE71CBF68888A3E93694EBA6320F154299E472872D3D670AC428763

Function 0000021A31BC1CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BC1D03

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

__doserrno.LIBCMT ref: 0000021A31BC1CFB

Part of subcall function 0000021A31BBB6A4: _getptd_noexit.LIBCMT ref: 0000021A31BBB6A8

__lock_fhandle.LIBCMT ref: 0000021A31BC1D47
_lseeki64_nolock.LIBCMT ref: 0000021A31BC1D60
_unlock_fhandle.LIBCMT ref: 0000021A31BC1D83

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: 64e513cee7787355f0a88c446a8305f2fe0370b2e10e505d309f6b007b8c4876
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: 1F21E23161AA008FF71CBF5CD88A3E972D4EBA6321F1546D9E03A871D3C664580286A7

Function 0000021A31BC1B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BC1B8B

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

__doserrno.LIBCMT ref: 0000021A31BC1B83

Part of subcall function 0000021A31BBB6A4: _getptd_noexit.LIBCMT ref: 0000021A31BBB6A8

__lock_fhandle.LIBCMT ref: 0000021A31BC1BCF
_lseek_nolock.LIBCMT ref: 0000021A31BC1BE8
_unlock_fhandle.LIBCMT ref: 0000021A31BC1C09

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: 360bae6c78c7b610593a7943f443a78230709464e4768afa8d3bd8a90d00ed02
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: 7B21063160A6008FF71C6F5CD88A3FD7698EBA2321F250698F1768B2D3D66458428663

Function 0000021A31BC0504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BC052F

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

__doserrno.LIBCMT ref: 0000021A31BC0527

Part of subcall function 0000021A31BBB6A4: _getptd_noexit.LIBCMT ref: 0000021A31BBB6A8

__lock_fhandle.LIBCMT ref: 0000021A31BC0573
_unlock_fhandle.LIBCMT ref: 0000021A31BC05AD

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: e6aa23e8b9a315fcf05bcb049deddfcb918b5b9c5a4fc7fa8b047f77a1518a8f
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: 7421F43560A6000FF71CAF68D9CA3F97298EBB5321F15029DE076872D3D6A45C0286A7

Function 0000021A31BBF828 Relevance: 13.6, APIs: 9, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BBF849

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

__doserrno.LIBCMT ref: 0000021A31BBF841

Part of subcall function 0000021A31BBB6A4: _getptd_noexit.LIBCMT ref: 0000021A31BBB6A8

__lock_fhandle.LIBCMT ref: 0000021A31BBF88D
_close_nolock.LIBCMT ref: 0000021A31BBF8A0
_unlock_fhandle.LIBCMT ref: 0000021A31BBF8B9

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 395762b8a1893c1ae26ca75fc4b85ca0ddb46cd2fbd99f5a35f34e72f6cbadd8
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: 7421D532506A108FF71CAFA9CCCD3E87690EB61320F25459DE036875D3C67488018763

Function 0000021A31BB9B34 Relevance: 12.6, APIs: 10, Instructions: 116
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 0000021A31BB9B62

Part of subcall function 0000021A31BB9428: _errno.LIBCMT ref: 0000021A31BB9448

free.LIBCMT ref: 0000021A31BB9B77
free.LIBCMT ref: 0000021A31BB9B98
free.LIBCMT ref: 0000021A31BB9BAD
free.LIBCMT ref: 0000021A31BB9BC1
free.LIBCMT ref: 0000021A31BB9BCD
free.LIBCMT ref: 0000021A31BB9BF8
free.LIBCMT ref: 0000021A31BB9C19
free.LIBCMT ref: 0000021A31BB9C32
free.LIBCMT ref: 0000021A31BB9C63

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction ID: 545943f7218dccfe0dd9debce3310ba1db3cc798e234d09c36822e8f90fcc52f
Opcode Fuzzy Hash: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction Fuzzy Hash: E741F47016AD099FFBB8EF58D8D9BED32D1F768311F9480A89015C2691DA2CD845C712

Function 0000021A31B8460C Relevance: 11.6, APIs: 9, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 0000021A31B846A9

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

malloc.LIBCMT ref: 0000021A31B846B3

Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94FC
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB9501

malloc.LIBCMT ref: 0000021A31B846BE
free.LIBCMT ref: 0000021A31B8487E
free.LIBCMT ref: 0000021A31B84886
free.LIBCMT ref: 0000021A31B8488E

Part of subcall function 0000021A31B854F0: malloc.LIBCMT ref: 0000021A31B8553A
Part of subcall function 0000021A31B854F0: malloc.LIBCMT ref: 0000021A31B85545
Part of subcall function 0000021A31B854F0: free.LIBCMT ref: 0000021A31B8562C
Part of subcall function 0000021A31B854F0: free.LIBCMT ref: 0000021A31B85634

free.LIBCMT ref: 0000021A31B8489A
free.LIBCMT ref: 0000021A31B848A7
free.LIBCMT ref: 0000021A31B848B4

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: c64cac615b44380853d74bf087746519f0c0b833d34c35ed10c9fa2a89324b7d
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: CB91E970329B8C4BE76DAF6C94457FA73D1EBA5700F50429ED49AC3287EE24DC068683

Function 0000021A31BB99D8 Relevance: 10.6, APIs: 7, Instructions: 107
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BB99FE

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A31BB9A0A
__crtIsPackagedApp.LIBCMT ref: 0000021A31BB9A1B
_dosmaperr.LIBCMT ref: 0000021A31BB9A65

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: 4e24beb58b138c86fe2c217026c2078d8ad88b31db0a51280d4592f350db7a13
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: 7831EA70615B098FFB5CAF6994897A976D1FFA8310F14819DE06AC32E2DB78C8418703

Function 0000021A31BC4818 Relevance: 10.6, APIs: 7, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BC4831

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

__lock_fhandle.LIBCMT ref: 0000021A31BC4879
__doserrno.LIBCMT ref: 0000021A31BC48AE
_errno.LIBCMT ref: 0000021A31BC48B5
_unlock_fhandle.LIBCMT ref: 0000021A31BC48C5

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction ID: da06243e5d70793a5e4ae0fb0fb35447e9a941156400e72c1747c1d2ba6ed8b7
Opcode Fuzzy Hash: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction Fuzzy Hash: F221C530606A804FF71CAFA898D93EA7694EBA5310F1506D8E427872D3D6645A02C663

Function 0000021A31BBA6D0 Relevance: 9.3, APIs: 6, Instructions: 257
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BBA70C

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A31BBA717
memcpy_s.LIBCMT ref: 0000021A31BBA7DC
_fileno.LIBCMT ref: 0000021A31BBA847
_filbuf.LIBCMT ref: 0000021A31BBA875
_errno.LIBCMT ref: 0000021A31BBA8C5

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: 390c52647d3b6414c8544522300ef4838b198d5b8f5ef9b0b26f9c9fd7d92ea8
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: 8661C730619F058BE76C5E3D888D3B97AD1E7A4720F1493AED466C3AD1DA60DC5386C3

Function 0000021A31B92854 Relevance: 9.2, APIs: 6, Instructions: 202
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000021A31B97F80: malloc.LIBCMT ref: 0000021A31B97F97

Part of subcall function 0000021A31BBA1E8: _errno.LIBCMT ref: 0000021A31BBA13F
Part of subcall function 0000021A31BBA1E8: _invalid_parameter_noinfo.LIBCMT ref: 0000021A31BBA14A

fseek.LIBCMT ref: 0000021A31B92929
_ftelli64.LIBCMT ref: 0000021A31B92933
fseek.LIBCMT ref: 0000021A31B92947
fclose.LIBCMT ref: 0000021A31B9297E
fclose.LIBCMT ref: 0000021A31B929D3
malloc.LIBCMT ref: 0000021A31B929E2

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: 353536a48b636134a3515f7fa8e0098e46aa6af8c10eeacbd8cb2d1c6fd9363f
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: 0E7101305197888FD398EF18C499B9AB7E1FBEC354F5049ADB09AC32A1DA34D945CB43

Function 0000021A31BBA1E8 Relevance: 9.1, APIs: 6, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000021A31BBA13F

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A31BBA14A
_getstream.LIBCMT ref: 0000021A31BBA16A
_errno.LIBCMT ref: 0000021A31BBA17C
_errno.LIBCMT ref: 0000021A31BBA18E
_openfile.LIBCMT ref: 0000021A31BBA1BC

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: 4b8ebeb334777386d8df049470b511a526c9b391257fae913884b3940d6a3c0c
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: 8B210A30A0AB4A8FF7D8FF3D84893AA76D1EBA9340F0489D99455C3692EE34CC414753

Function 0000021A31B91080 Relevance: 9.1, APIs: 6, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 0000021A31B91097

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

free.LIBCMT ref: 0000021A31B910E0

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: 9ce68da67f8786968efb386266a90e6b61cb5c0ea4854021bd258cb9d0acf3d7
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: C7313070529B489FE388EF28C4997DA77E1FBA8314F504A5DB09AD32A1DA34D942C743

Function 0000021A31B84170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31B841BD

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

malloc.LIBCMT ref: 0000021A31B841C8

Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94FC
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB9501

free.LIBCMT ref: 0000021A31B842AF
free.LIBCMT ref: 0000021A31B842B7
free.LIBCMT ref: 0000021A31B842BF
free.LIBCMT ref: 0000021A31B842CB
free.LIBCMT ref: 0000021A31B842D8

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: e4b5cb1036e9006efae2439113f002ca23e62b81d2d35b2bbc7efc82262dff60
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: 1F51D53062DE4A4BE75DEF2894597F973D1FB69704F5042ADD85AC3287EE20DC428682

Function 0000021A31B8CB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021A31B97F80: malloc.LIBCMT ref: 0000021A31B97F97

malloc.LIBCMT ref: 0000021A31B8CC4E

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

Part of subcall function 0000021A31BB8AEC: malloc.LIBCMT ref: 0000021A31BB8B27

Part of subcall function 0000021A31BB8AEC: realloc.LIBCMT ref: 0000021A31BB8B4E

malloc.LIBCMT ref: 0000021A31B8CD82
_snprintf.LIBCMT ref: 0000021A31B8CE10
_snprintf.LIBCMT ref: 0000021A31B8CE4A
_snprintf.LIBCMT ref: 0000021A31B8CE74
free.LIBCMT ref: 0000021A31B8D07B

Part of subcall function 0000021A31BB9428: _errno.LIBCMT ref: 0000021A31BB9448

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$_callnewhfreerealloc
String ID:
API String ID: 3710081536-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: b3e565feac6dd4861e41f6dd0cc44c45d9640862b8fefe426416dc31fe295993
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: 2AE12C702166848FF758FF24C4997EAB7E1FBA8300F5045ADA1AAC76D2DB349845CB43

Function 0000021A31BC4424 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 0000021A31BC4451

Part of subcall function 0000021A31BBDA24: _FF_MSGBANNER.LIBCMT ref: 0000021A31BBDA41
Part of subcall function 0000021A31BBDA24: _NMSG_WRITE.LIBCMT ref: 0000021A31BBDA4B

_lock.LIBCMT ref: 0000021A31BC4464
_lock.LIBCMT ref: 0000021A31BC44BF
_calloc_crt.LIBCMT ref: 0000021A31BC4576

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: baf52b1fa3e20fece15de7bfd186b9f11e08fd826e3d265323eacc64b9d91c00
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: 30510470519A098BE7189F18C8893A5B7D4FB78310F1146ADD85BC72A2DA38DD43CB83

Function 0000021A31B854F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31B8553A

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

malloc.LIBCMT ref: 0000021A31B85545

Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94FC
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB9501

free.LIBCMT ref: 0000021A31B8562C
free.LIBCMT ref: 0000021A31B85634
free.LIBCMT ref: 0000021A31B85640
free.LIBCMT ref: 0000021A31B8564D

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: c9283680e46430cb8dec6fc8662aad560be0e98a35866e808ce473c59f4112f8
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: E2410330219F4D4BE76DAF2898493FA37D5EBA6714F1441ADE897C3283ED24D8078792

Function 0000021A31BBBD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0000021A31BBBDB5

Part of subcall function 0000021A31BBF624: _errno.LIBCMT ref: 0000021A31BBF62D
Part of subcall function 0000021A31BBF624: _invalid_parameter_noinfo.LIBCMT ref: 0000021A31BBF638

_errno.LIBCMT ref: 0000021A31BBBDC5

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

_errno.LIBCMT ref: 0000021A31BBBDE1
_isatty.LIBCMT ref: 0000021A31BBBE42
_getbuf.LIBCMT ref: 0000021A31BBBE4E

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: 6cb584ca9e65b99a86defbaf83a97f809139bd120bee45cdd4a77204f269db81
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: C151E570115A084FEB9CEF28C5CA7E977D0FB68310F5486D9D866CB2D6D674C841CB92

Function 0000021A31B9CF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31B9CF18

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

_snprintf.LIBCMT ref: 0000021A31B9CF38

Part of subcall function 0000021A31BB9700: _errno.LIBCMT ref: 0000021A31BB9737
Part of subcall function 0000021A31BB9700: _invalid_parameter_noinfo.LIBCMT ref: 0000021A31BB9742

free.LIBCMT ref: 0000021A31B9CF57

Part of subcall function 0000021A31BB9428: _errno.LIBCMT ref: 0000021A31BB9448

malloc.LIBCMT ref: 0000021A31B9CFE0
_snprintf.LIBCMT ref: 0000021A31B9D007
free.LIBCMT ref: 0000021A31B9D045

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: ad34c25ce0cba9026de47f96ab830fcba17cd9730660a9d6a661bde1a0fba1bc
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: 71417B31218A444FE744FF28C899BAA77F1FBAE340F50456DE499C32A1EA25D945C703

Function 0000021A31BC46C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A31BC46D9

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

__doserrno.LIBCMT ref: 0000021A31BC46D1

Part of subcall function 0000021A31BBB6A4: _getptd_noexit.LIBCMT ref: 0000021A31BBB6A8

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: 8d5b97a65d31d6f54459bb488fd5d710edb9987791d34a4084fab8c3d78c7b8b
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: B001F4302269484FFA5CAF24CE8D7D43690EF36325FA482C9E02B874E2C67C0842C623

Function 0000021A31B933EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31B93404

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

_snprintf.LIBCMT ref: 0000021A31B9342E

Part of subcall function 0000021A31BB9700: _errno.LIBCMT ref: 0000021A31BB9737
Part of subcall function 0000021A31BB9700: _invalid_parameter_noinfo.LIBCMT ref: 0000021A31BB9742

remove.LIBCMT ref: 0000021A31B9343F
remove.LIBCMT ref: 0000021A31B9344B
free.LIBCMT ref: 0000021A31B93455

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: e61463b57cd9eef539fca791fb2001d4c5cd8af4100cb1d111e36bf64d20dc0b
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: 6901FBB0528B489FE388EF28C499B99B7E1FBE8700F80596DB499C23A1DB349544C743

Function 0000021A31BB68D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31BB6917
free.LIBCMT ref: 0000021A31BB693C

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: 8f1b48fed87441f64c06f504cfa5d65829894850bb789267fc45402d978a39d1
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: 0D910A701197848FEBA8EF28C4997EEB7E1FBA4300F50896DE09AC3691DB759845C743

Function 0000021A31BB92BC Relevance: 6.3, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31BB92D6

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

malloc.LIBCMT ref: 0000021A31BB92F5

Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94FC
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB9501

malloc.LIBCMT ref: 0000021A31BB932C
_snprintf.LIBCMT ref: 0000021A31BB9358

Part of subcall function 0000021A31BB9700: _errno.LIBCMT ref: 0000021A31BB9737
Part of subcall function 0000021A31BB9700: _invalid_parameter_noinfo.LIBCMT ref: 0000021A31BB9742

malloc.LIBCMT ref: 0000021A31BB939B

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: 61e8a35267fc0d42b2564f80114ca838c4b4c63caa45d851992986142daccc88
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: DB31E974518B489FDB88EF18C084B5AB7E1FBAC315F104A6DA48DD33A1CB38D941CB42

Function 0000021A31BBA1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A31BBA22C

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A31BBA237
_flush.LIBCMT ref: 0000021A31BBA2E9
_fileno.LIBCMT ref: 0000021A31BBA30A

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: 7c7554a04818e7130cc0e0e67cf5076fd113120fb8ebaa9d9a83550c2317d860
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: 79510B3071AF098FE66C6E7D54CD3B576C1E779310F1492ADD4AAC39D2EAA1DC424183

Function 0000021A31B810D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 0000021A31B81117
clock.LIBCMT ref: 0000021A31B81124
clock.LIBCMT ref: 0000021A31B8112D
clock.LIBCMT ref: 0000021A31B8113A

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 5ac208e2595b1a4b060cc1cb817a18e808d2232176cbef351ac60f4fcc98607c
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: F721273140F7490EE76CBEA9A48A3B6B7C0E7A5750F1512ADE8A6C3243E9509C4286C7

Function 0000021A31BC9728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021A31BC974C

Part of subcall function 0000021A31BBBF24: _getptd.LIBCMT ref: 0000021A31BBBF3A
Part of subcall function 0000021A31BBBF24: __updatetlocinfo.LIBCMT ref: 0000021A31BBBF6F
Part of subcall function 0000021A31BBBF24: __updatetmbcinfo.LIBCMT ref: 0000021A31BBBF96

_errno.LIBCMT ref: 0000021A31BC9758

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A31BC9763
strchr.LIBCMT ref: 0000021A31BC9779

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: 4e70e9b2bd9f09bb677040abefff4d6ecb8d318333cb35b203935007965ca0a6
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: 4721077061B6654BF7ACAF28C08C3BA76D5E765315F1406EAA0F6C75C1CB648842C253

Function 0000021A31BB9CB4 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 0000021A31BB9CD1

Part of subcall function 0000021A31BBE110: _FindPESection.LIBCMT ref: 0000021A31BBE139

_initp_misc_cfltcvt_tab.LIBCMT ref: 0000021A31BB9CE2
_initterm_e.LIBCMT ref: 0000021A31BB9CF5
_IsNonwritableInCurrentImage.LIBCMT ref: 0000021A31BB9D3E

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 20d8fef81f8701dc950607fd9be9d74995b121df42281fa78a048c32d55c9c51
Instruction ID: fc0a713253209b8d190cb8ba2db665b24c28d20a8f551dcb8d2f59595cc8dc9e
Opcode Fuzzy Hash: 20d8fef81f8701dc950607fd9be9d74995b121df42281fa78a048c32d55c9c51
Instruction Fuzzy Hash: EE119131112A094BF71EAF25ECCD7E672A4FB68301F4089A6A413C68B2EF389954C746

Function 0000021A31B9B940 Relevance: 5.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31B9B9AA

Part of subcall function 0000021A31BB9468: _FF_MSGBANNER.LIBCMT ref: 0000021A31BB9498
Part of subcall function 0000021A31BB9468: _NMSG_WRITE.LIBCMT ref: 0000021A31BB94A2
Part of subcall function 0000021A31BB9468: _callnewh.LIBCMT ref: 0000021A31BB94D6
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94E1
Part of subcall function 0000021A31BB9468: _errno.LIBCMT ref: 0000021A31BB94EC

free.LIBCMT ref: 0000021A31B9BDE3

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: 07ed59943d4235ec9bba2e3eca960349985bcc43571219076fe8396ba3a4bb23
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: AFD1F9B02597859FD7B4DF18C048BABB7E1FBAA315F90196DA5C9C3290DB309881CB17

Function 0000021A31BB9924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021A31BB9975

Part of subcall function 0000021A31BBB714: _getptd_noexit.LIBCMT ref: 0000021A31BBB718

_invalid_parameter_noinfo.LIBCMT ref: 0000021A31BB9980

Strings

B, xrefs: 0000021A31BB99AC

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: a785bea3863d21dc7564336e985d52ff5227e0a940f56ef6262f155ff2e4a4d1
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: D711C430218B084FD748EF5CD4897A5B3D1FBA8324F1087AEA069C32A1CB74C840CB82

Function 0000021A31B84300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31B84363

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: 60fb2d5199b249e7f4e8c047ea77c9d48234191a8f49ce7333d69ed9d6e87726
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: 7B51B77021DA454BEB5CDF2CD4897BA73D1FBA5700F1445ADE8ABC3286EE30EC428642

Function 0000021A31BB7594 Relevance: 5.1, APIs: 4, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000021A31BB761F
_snprintf.LIBCMT ref: 0000021A31BB7644
_snprintf.LIBCMT ref: 0000021A31BB76A4
_snprintf.LIBCMT ref: 0000021A31BB76C9

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: a2a340f4b51eb104534c09a96cdc3bde5f12c0c25e27c1dd73717b88114bec29
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: A9417230118A488FF799EF18D898BDA77E0F7A8310F60456EA49AC36E0DB38D945C743

Function 0000021A31BB7D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000021A31BB7D4E
strtok.LIBCMT ref: 0000021A31BB7DAC
strtok.LIBCMT ref: 0000021A31BB7DBE
free.LIBCMT ref: 0000021A31BB7DD7

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: ce4dc2144313a671e82e881ebbac28aaf2a930326208a12d0a5733bc56be394a
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: 30314F70528B4C9FE7A4EF18C488BA977E1FBA9315F50465EA49AC37A1D734D841CB02

Function 0000021A31BB93B8 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000021A31BB93D8

Part of subcall function 0000021A31BB9428: _errno.LIBCMT ref: 0000021A31BB9448

free.LIBCMT ref: 0000021A31BB93E6
free.LIBCMT ref: 0000021A31BB93F4
free.LIBCMT ref: 0000021A31BB93FE

Memory Dump Source

Source File: 00000006.00000002.1932212303.0000021A31B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021A31B81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21a31b81000_rundll32.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction ID: b8647eb4cd895413e67ce1dc1e4123912332ec95b2387b4f1105cdaa38678505
Opcode Fuzzy Hash: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction Fuzzy Hash: 1AF02274239948AFD698FF18C895F9977E1FBA8300F805498B059C76A2DA24E840CB12

Analysis Process: rundll32.exePID: 7964, Parent PID: 7748COMMON

Executed Functions

Function 000002220BB8D0FC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 000002220BB8D1A3
0, xrefs: 000002220BB8D1AB

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID:
String ID: ($0
API String ID: 0-506339136
Opcode ID: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction ID: ac790934a1e23912c924c4f4a2b63b0a0c48ff661b75880b9e10cbf7ba4b14ca
Opcode Fuzzy Hash: 10f7719d3d1d9079ceea84ceb22c18dc226f4ec162cd41ad22bc9bfc0006c88d
Instruction Fuzzy Hash: CA412F30118B45EFEBB4DF68D05876AB7E1FBA8305F50493EA489C76A1EB75C944CB02

Non-executed Functions

Function 000002220BBB0EEC Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBB0F1E

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

__doserrno.LIBCMT ref: 000002220BBB0F15

Part of subcall function 000002220BBAB6A4: _getptd_noexit.LIBCMT ref: 000002220BBAB6A8

__doserrno.LIBCMT ref: 000002220BBB0F7B
_errno.LIBCMT ref: 000002220BBB0F82
_invalid_parameter_noinfo.LIBCMT ref: 000002220BBB0FE6

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction ID: 03dbc5ed486738a7d48e8edd860001edd3788ba3e5b22dc535e2f80b9a98c0c2
Opcode Fuzzy Hash: 8b77052a01e43cc8588673f458940c1df443eb567674aad5d151068f2fd19b3d
Instruction Fuzzy Hash: C531EC70618744FFE7347FD8984AB7936A0EB62320F55025DE812472D3F6B29A098751

Function 000002220BBB1CD8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBB1D03

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

__doserrno.LIBCMT ref: 000002220BBB1CFB

Part of subcall function 000002220BBAB6A4: _getptd_noexit.LIBCMT ref: 000002220BBAB6A8

__lock_fhandle.LIBCMT ref: 000002220BBB1D47
_lseeki64_nolock.LIBCMT ref: 000002220BBB1D60
_unlock_fhandle.LIBCMT ref: 000002220BBB1D83

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction ID: fc44bc650d2b39ca39246e6ad55f467bceb7e6cadb3062c96ccf60a34b2cf78d
Opcode Fuzzy Hash: 999453a1ef7c5f2640f1125fecbe9f88979d53729486d554a8b4362df668ee0b
Instruction Fuzzy Hash: 3D213E31528600BFF7346FDCDC5A7BD72E0EB62320F15025DE825C71D3E6A159058661

Function 000002220BBB1B60 Relevance: 15.1, APIs: 10, Instructions: 88
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBB1B8B

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

__doserrno.LIBCMT ref: 000002220BBB1B83

Part of subcall function 000002220BBAB6A4: _getptd_noexit.LIBCMT ref: 000002220BBAB6A8

__lock_fhandle.LIBCMT ref: 000002220BBB1BCF
_lseek_nolock.LIBCMT ref: 000002220BBB1BE8
_unlock_fhandle.LIBCMT ref: 000002220BBB1C09

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction ID: 3eed3dfb0f1c4a817ff74e0ce5d8769289e3f034d54a9d5d67095f3038689c81
Opcode Fuzzy Hash: 707e15bab0769dba6d0b9335517ebf2423601970b522f0f318b6a6f7e10e06ca
Instruction Fuzzy Hash: 59213831A18600BFF3386FDCD85E77C72A0EB62320F15021CE8668B2D3F6E5594582A2

Function 000002220BBB0504 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBB052F

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

__doserrno.LIBCMT ref: 000002220BBB0527

Part of subcall function 000002220BBAB6A4: _getptd_noexit.LIBCMT ref: 000002220BBAB6A8

__lock_fhandle.LIBCMT ref: 000002220BBB0573
_unlock_fhandle.LIBCMT ref: 000002220BBB05AD

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction ID: 3f638a6d1270455e3e21b4dee9d0772426e759ff2272a16eef40774b7fd3095a
Opcode Fuzzy Hash: f1a07466abc0a1e4497666e3c48621111a436463e24d1ce96ef7aa2bb6ff0d0b
Instruction Fuzzy Hash: 9C212931608600BFF3347F98D88EB7D72A0EB66320F55025DE866872E3E6E5590586A5

Function 000002220BBAF828 Relevance: 13.6, APIs: 9, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBAF849

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

__doserrno.LIBCMT ref: 000002220BBAF841

Part of subcall function 000002220BBAB6A4: _getptd_noexit.LIBCMT ref: 000002220BBAB6A8

__lock_fhandle.LIBCMT ref: 000002220BBAF88D
_close_nolock.LIBCMT ref: 000002220BBAF8A0
_unlock_fhandle.LIBCMT ref: 000002220BBAF8B9

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction ID: 5f2a0ae47955663fb015bdf72fd67f614ac2db50ed82829b864ac524b8949b16
Opcode Fuzzy Hash: 9968854b850682f536c71446a658fcc7f3a984cbfa2ab25a029aaa246f596a45
Instruction Fuzzy Hash: 1321D832D04A00FFF734AFE4988D3B8B690EB63310F15056DE816C72D3E67699098761

Function 000002220BBA9B34 Relevance: 12.6, APIs: 10, Instructions: 116
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 000002220BBA9B62

Part of subcall function 000002220BBA9428: _errno.LIBCMT ref: 000002220BBA9448

free.LIBCMT ref: 000002220BBA9B77
free.LIBCMT ref: 000002220BBA9B98
free.LIBCMT ref: 000002220BBA9BAD
free.LIBCMT ref: 000002220BBA9BC1
free.LIBCMT ref: 000002220BBA9BCD
free.LIBCMT ref: 000002220BBA9BF8
free.LIBCMT ref: 000002220BBA9C19
free.LIBCMT ref: 000002220BBA9C32
free.LIBCMT ref: 000002220BBA9C63

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction ID: 24b3fc5ade0dc93838ad476c679f8bd745f569741fb79b19a4a102b159abca88
Opcode Fuzzy Hash: 93bfaf5764d7773b193cf5a5c99babc78185830d1e8edeb9aa307ccd339b6462
Instruction Fuzzy Hash: 1F416030618E0AFFFBB4EF98D8D9BAD32D5F769311F9400289845C22D1EE2D9949DB10

Function 000002220BB7460C Relevance: 11.6, APIs: 9, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 000002220BB746A9

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

malloc.LIBCMT ref: 000002220BB746B3

Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94FC
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA9501

malloc.LIBCMT ref: 000002220BB746BE
free.LIBCMT ref: 000002220BB7487E
free.LIBCMT ref: 000002220BB74886
free.LIBCMT ref: 000002220BB7488E

Part of subcall function 000002220BB754F0: malloc.LIBCMT ref: 000002220BB7553A
Part of subcall function 000002220BB754F0: malloc.LIBCMT ref: 000002220BB75545
Part of subcall function 000002220BB754F0: free.LIBCMT ref: 000002220BB7562C
Part of subcall function 000002220BB754F0: free.LIBCMT ref: 000002220BB75634

free.LIBCMT ref: 000002220BB7489A
free.LIBCMT ref: 000002220BB748A7
free.LIBCMT ref: 000002220BB748B4

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction ID: cc3a6358231421808b1678eca9bdf5e7f3fc31325294be2008039392776cb2dd
Opcode Fuzzy Hash: c75b0a1d2e19df20c265fda1f1b61241464f7f19ba4f0f6e1f0497372b703070
Instruction Fuzzy Hash: B191FB30718B4CABD739AE9C94557BA73D5E7A5301F50025ED88AC37C3FE21DD0A8682

Function 000002220BBA99D8 Relevance: 10.6, APIs: 7, Instructions: 107
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBA99FE

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

_invalid_parameter_noinfo.LIBCMT ref: 000002220BBA9A0A
__crtIsPackagedApp.LIBCMT ref: 000002220BBA9A1B
_dosmaperr.LIBCMT ref: 000002220BBA9A65

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction ID: 3cfae486f041617215923a20e5ba5c6d234ac40ccdde8636cb74ad95b869b018
Opcode Fuzzy Hash: 2de4b52953f98cf2f78611d97d2a60e8fea6ab52800e27ce238f3726801f7295
Instruction Fuzzy Hash: 5431F830A14A08EFFB64AFACD40936972D1FFAA310F14016EE84AC32E1EB79C945C701

Function 000002220BBB4818 Relevance: 10.6, APIs: 7, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBB4831

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

__lock_fhandle.LIBCMT ref: 000002220BBB4879
__doserrno.LIBCMT ref: 000002220BBB48AE
_errno.LIBCMT ref: 000002220BBB48B5
_unlock_fhandle.LIBCMT ref: 000002220BBB48C5

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction ID: 4d641ed88e3e6768680906e9d7bb2716d10863a1849e372757ccdb84afdf28d1
Opcode Fuzzy Hash: 606be4c0390d073f90be112aacc7631162c60430743b6131d582dd7324473647
Instruction Fuzzy Hash: F921D320A04A80FFF634AFE89C8977976A0FB66310F15025CE816873D3E6E65A088661

Function 000002220BBAA6D0 Relevance: 9.3, APIs: 6, Instructions: 257
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBAA70C

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

_invalid_parameter_noinfo.LIBCMT ref: 000002220BBAA717
memcpy_s.LIBCMT ref: 000002220BBAA7DC
_fileno.LIBCMT ref: 000002220BBAA847
_filbuf.LIBCMT ref: 000002220BBAA875
_errno.LIBCMT ref: 000002220BBAA8C5

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction ID: 2a86049e54493819b89a1db324ec9793e45e467e2c3ba441a275caee73803543
Opcode Fuzzy Hash: c54c4921bb8379a399a2f22ab2fbfb724ef235ff3910e4ccc073ad148f491759
Instruction Fuzzy Hash: E961D830A18F09BBE77C5EAC444D23AB6D1E7A6720F14031ED856C32D1FA62ED5AC6D1

Function 000002220BB82854 Relevance: 9.2, APIs: 6, Instructions: 202
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002220BB87F80: malloc.LIBCMT ref: 000002220BB87F97

Part of subcall function 000002220BBAA1E8: _errno.LIBCMT ref: 000002220BBAA13F
Part of subcall function 000002220BBAA1E8: _invalid_parameter_noinfo.LIBCMT ref: 000002220BBAA14A

fseek.LIBCMT ref: 000002220BB82929
_ftelli64.LIBCMT ref: 000002220BB82933
fseek.LIBCMT ref: 000002220BB82947
fclose.LIBCMT ref: 000002220BB8297E
fclose.LIBCMT ref: 000002220BB829D3
malloc.LIBCMT ref: 000002220BB829E2

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: fclosefseekmalloc$_errno_ftelli64_invalid_parameter_noinfo
String ID:
API String ID: 1929176045-0
Opcode ID: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction ID: 6f224aca16f927357825b8c9d2bf5237fd6fa98fd1e5d86e2b388319da9330bb
Opcode Fuzzy Hash: 2dbb8156d7e1450895b0831729246a29cec170c1605d5564cf2a09c383d44b35
Instruction Fuzzy Hash: AD714070118748EFE7A4EF58C448B5AB7E1FFA9340F50492DB48AC36A1DB35DA49CB42

Function 000002220BBAA1E8 Relevance: 9.1, APIs: 6, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 000002220BBAA13F

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

_invalid_parameter_noinfo.LIBCMT ref: 000002220BBAA14A
_getstream.LIBCMT ref: 000002220BBAA16A
_errno.LIBCMT ref: 000002220BBAA17C
_errno.LIBCMT ref: 000002220BBAA18E
_openfile.LIBCMT ref: 000002220BBAA1BC

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction ID: 1c22da0a4cf6125f811077196a74ee577cb52ae9289a89fbed467baaa5b35e35
Opcode Fuzzy Hash: 5822b292a46ad52fbba60e80c73f126c512aa3bbfad26addc6a572f3e42640c2
Instruction Fuzzy Hash: 65219B30A18B4EFFF7B0EFA8540936976D1EB6B310F04055A9C45C3292FE65DE4587A1

Function 000002220BB81080 Relevance: 9.1, APIs: 6, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 000002220BB81097

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

free.LIBCMT ref: 000002220BB810E0

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction ID: a73b20b826ce5c0d9335d38a015503a307bd0d754de5836fb61d7f46db5413f4
Opcode Fuzzy Hash: be35bbba0d4894c2760315db9577ab2653c93394a1aa741eec404816c6ed7138
Instruction Fuzzy Hash: A7315230518A44FFD764FF68C45975E77E1FBAC304F500A1DB88AD32A1EA359A49C742

Function 000002220BB74170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BB741BD

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

malloc.LIBCMT ref: 000002220BB741C8

Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94FC
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA9501

free.LIBCMT ref: 000002220BB742AF
free.LIBCMT ref: 000002220BB742B7
free.LIBCMT ref: 000002220BB742BF
free.LIBCMT ref: 000002220BB742CB
free.LIBCMT ref: 000002220BB742D8

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction ID: 9d32f90e242cd6254bc470e25b83111258b45dc1772acb4977e184fd5c95433e
Opcode Fuzzy Hash: 695452f4ce591794a7dd27ab3daecb023a1ec355a28974067ff4d1f9e76553f2
Instruction Fuzzy Hash: 3951E730728E09BFE769AFA894596B973D5FB59301F50012DDC8AC3387FE21DD5A8680

Function 000002220BB7CB50 Relevance: 7.8, APIs: 6, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002220BB87F80: malloc.LIBCMT ref: 000002220BB87F97

malloc.LIBCMT ref: 000002220BB7CC4E

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

Part of subcall function 000002220BBA8AEC: malloc.LIBCMT ref: 000002220BBA8B27

Part of subcall function 000002220BBA8AEC: realloc.LIBCMT ref: 000002220BBA8B4E

malloc.LIBCMT ref: 000002220BB7CD82
_snprintf.LIBCMT ref: 000002220BB7CE10
_snprintf.LIBCMT ref: 000002220BB7CE4A
_snprintf.LIBCMT ref: 000002220BB7CE74
free.LIBCMT ref: 000002220BB7D07B

Part of subcall function 000002220BBA9428: _errno.LIBCMT ref: 000002220BBA9448

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: malloc$_errno_snprintf$_callnewhfreerealloc
String ID:
API String ID: 3710081536-0
Opcode ID: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction ID: fcc3f0a4cabaa30de5c0e72ed07c9268b45ff8d4de219bc1c951ca0283aa8776
Opcode Fuzzy Hash: d21ad2a056178d292e578f576ebe5e2de7529cb5147e9b122ccfa2b8bfc6f6a7
Instruction Fuzzy Hash: 5FE16370614644FFF764EFA4C4597AAB7E1FBA5300F40042DA986C76D2EF369A09CB42

Function 000002220BBB4424 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000002220BBB4451

Part of subcall function 000002220BBADA24: _FF_MSGBANNER.LIBCMT ref: 000002220BBADA41
Part of subcall function 000002220BBADA24: _NMSG_WRITE.LIBCMT ref: 000002220BBADA4B

_lock.LIBCMT ref: 000002220BBB4464
_lock.LIBCMT ref: 000002220BBB44BF
_calloc_crt.LIBCMT ref: 000002220BBB4576

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction ID: 99d4bdafd6318c6e2d8db41ffdb8f1fe461cef9d4d117ff128baf690a6a56236
Opcode Fuzzy Hash: 0ae305d5a56d4f5fc965a78ca540d5d1c79cefd7c21b0e4f89b429e8ada4dcd0
Instruction Fuzzy Hash: 8F511770514E09EFE7289F98C889B65B3E0FB68310F15056DDC4AC72A3E6B5DD46C782

Function 000002220BB754F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BB7553A

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

malloc.LIBCMT ref: 000002220BB75545

Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94FC
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA9501

free.LIBCMT ref: 000002220BB7562C
free.LIBCMT ref: 000002220BB75634
free.LIBCMT ref: 000002220BB75640
free.LIBCMT ref: 000002220BB7564D

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction ID: fe4fe60d019e12c43980159159a9271163146840afd1f76a0e03ada97d1dafaa
Opcode Fuzzy Hash: bf64667b48beb023399457ef1e960719e952a42bf42d0b155e32a9186485f1aa
Instruction Fuzzy Hash: 1B41E930268B0DABE779DEA8444967A36D5E7B6310F14012DDCC7C3243FD22DA0B8791

Function 000002220BBABD98 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000002220BBABDB5

Part of subcall function 000002220BBAF624: _errno.LIBCMT ref: 000002220BBAF62D
Part of subcall function 000002220BBAF624: _invalid_parameter_noinfo.LIBCMT ref: 000002220BBAF638

_errno.LIBCMT ref: 000002220BBABDC5

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

_errno.LIBCMT ref: 000002220BBABDE1
_isatty.LIBCMT ref: 000002220BBABE42
_getbuf.LIBCMT ref: 000002220BBABE4E

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction ID: 62b82cfcd1006e4a1bfabe70c7833395d1d17437ff74731395ca83403c0f92f2
Opcode Fuzzy Hash: a379163105278670e5afc3e45665132b2485eaccacc1b866912359b1c472c8f6
Instruction Fuzzy Hash: E551E630914A08FFEB78DFA8C08976577E0FB66310F140659DC65CB2D6E676DA49C780

Function 000002220BB8CF00 Relevance: 7.6, APIs: 6, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BB8CF18

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

_snprintf.LIBCMT ref: 000002220BB8CF38

Part of subcall function 000002220BBA9700: _errno.LIBCMT ref: 000002220BBA9737
Part of subcall function 000002220BBA9700: _invalid_parameter_noinfo.LIBCMT ref: 000002220BBA9742

free.LIBCMT ref: 000002220BB8CF57

Part of subcall function 000002220BBA9428: _errno.LIBCMT ref: 000002220BBA9448

malloc.LIBCMT ref: 000002220BB8CFE0
_snprintf.LIBCMT ref: 000002220BB8D007
free.LIBCMT ref: 000002220BB8D045

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction ID: ec116ade9a736686390a4bb3a7fe0ec04b6aea6db6b72557d74716cd5e73212a
Opcode Fuzzy Hash: 4b7488ccfcf92dff4a44f31d12171449a63be8ff974c4bbada150586fabccd75
Instruction Fuzzy Hash: 67417B3021CA48EFEB50EF68C459F6A77F1FBA9344F50052DE4C9C32A1EA25D949C711

Function 000002220BBB46C8 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002220BBB46D9

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

__doserrno.LIBCMT ref: 000002220BBB46D1

Part of subcall function 000002220BBAB6A4: _getptd_noexit.LIBCMT ref: 000002220BBAB6A8

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction ID: 7a2c0652cd9f50f47fd8323c043b3dbae70296efa8aba9fc7807a7ed4cae78e2
Opcode Fuzzy Hash: 025aeaa454097c1032dff6ea7fff23be1e1841866692d4dd75f2ef8b742b5775
Instruction Fuzzy Hash: 4601D630614944FFF674AFA8C949B9431B0FF37325F5442489815872E3E6BA4549C621

Function 000002220BB833EC Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BB83404

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

_snprintf.LIBCMT ref: 000002220BB8342E

Part of subcall function 000002220BBA9700: _errno.LIBCMT ref: 000002220BBA9737
Part of subcall function 000002220BBA9700: _invalid_parameter_noinfo.LIBCMT ref: 000002220BBA9742

remove.LIBCMT ref: 000002220BB8343F
remove.LIBCMT ref: 000002220BB8344B
free.LIBCMT ref: 000002220BB83455

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintffreemalloc
String ID:
API String ID: 929232287-0
Opcode ID: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction ID: 21ee17542fa15a85429f8f00ec58e5816b8c5a705e50a9901508fd4aaaac6475
Opcode Fuzzy Hash: e10366be0be48da8ec2d1efe495d4130c24eed7f3ffc37a29e9978efec4970be
Instruction Fuzzy Hash: 9401FF70528744FFE794EF58C459B69B7E1FBE4700F80052DB889C2291EB359648C742

Function 000002220BBA68D4 Relevance: 6.5, APIs: 5, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BBA6917
free.LIBCMT ref: 000002220BBA693C

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction ID: ded07954fa7e447e82db6e32e2f74d24300b55f6e9a94ff0849d4cba33745593
Opcode Fuzzy Hash: e8cb766a1f708f6ad2c8040cda47f382cfa7383439f6add59f3ae7b1adecd00b
Instruction Fuzzy Hash: 64915170508744EFE7B4EFA8C44979EB7E1FBA5300F54092DE48AC3291EB769A49C742

Function 000002220BBA92BC Relevance: 6.3, APIs: 5, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BBA92D6

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

malloc.LIBCMT ref: 000002220BBA92F5

Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94FC
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA9501

malloc.LIBCMT ref: 000002220BBA932C
_snprintf.LIBCMT ref: 000002220BBA9358

Part of subcall function 000002220BBA9700: _errno.LIBCMT ref: 000002220BBA9737
Part of subcall function 000002220BBA9700: _invalid_parameter_noinfo.LIBCMT ref: 000002220BBA9742

malloc.LIBCMT ref: 000002220BBA939B

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction ID: f344b8507d952d58e8dac7ea66744303ec71e71bbd04cb21274130cd54715899
Opcode Fuzzy Hash: 4a88a70e9d050a255cec614ea314018cd5afcce58f1384e82783e2fcc1a691ac
Instruction Fuzzy Hash: 4C31E974518B48AFDB94EF18C044A5AB7E1FBAC315F100A6DA4CDD73A1DB34EA41CB42

Function 000002220BBAA1F4 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002220BBAA22C

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

_invalid_parameter_noinfo.LIBCMT ref: 000002220BBAA237
_flush.LIBCMT ref: 000002220BBAA2E9
_fileno.LIBCMT ref: 000002220BBAA30A

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction ID: 050b9a236047af52626b9ac317c138f3c59db328aa4a5caf77a1ab5c921f10ed
Opcode Fuzzy Hash: 3724e7ae47d0555e82954cf94b1352b58e40b663c144e16cde101d0b22e5a577
Instruction Fuzzy Hash: 1351D530A18F09ABE6786EAD545D33572D1E77A310F14022EDC9AC31D2FA62DD5AC191

Function 000002220BB710D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000002220BB71117
clock.LIBCMT ref: 000002220BB71124
clock.LIBCMT ref: 000002220BB7112D
clock.LIBCMT ref: 000002220BB7113A

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction ID: 2539a7d902c9da71e31172430ffd05efda55f66eb4d2e153f69d84b2b772717e
Opcode Fuzzy Hash: 52dbf759540b59de5f5951ee9cf1365415fde72d11341a4ad9c6f9647c7b1738
Instruction Fuzzy Hash: 3D215B3144C708BFE778ADEC944A776B3D0D7A5350F15022DEC86D7943F9528E4A82E2

Function 000002220BBB9728 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000002220BBB974C

Part of subcall function 000002220BBABF24: _getptd.LIBCMT ref: 000002220BBABF3A
Part of subcall function 000002220BBABF24: __updatetlocinfo.LIBCMT ref: 000002220BBABF6F
Part of subcall function 000002220BBABF24: __updatetmbcinfo.LIBCMT ref: 000002220BBABF96

_errno.LIBCMT ref: 000002220BBB9758

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

_invalid_parameter_noinfo.LIBCMT ref: 000002220BBB9763
strchr.LIBCMT ref: 000002220BBB9779

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction ID: f2e1d0b617930ff43c583436359036bd188c5dfa1f2606f8b8da947d23338de5
Opcode Fuzzy Hash: 078fbef60442204fefacc1113914627e5534cb2c2b17e97d4d3604c38646f191
Instruction Fuzzy Hash: A2219120518664FFE7B49FA9409CB3A36F0E765311F84055DEAD6C30D1EBE18A49C350

Function 000002220BBA9CB4 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 000002220BBA9CD1

Part of subcall function 000002220BBAE110: _FindPESection.LIBCMT ref: 000002220BBAE139

_initp_misc_cfltcvt_tab.LIBCMT ref: 000002220BBA9CE2
_initterm_e.LIBCMT ref: 000002220BBA9CF5
_IsNonwritableInCurrentImage.LIBCMT ref: 000002220BBA9D3E

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 20d8fef81f8701dc950607fd9be9d74995b121df42281fa78a048c32d55c9c51
Instruction ID: c66ed46484e8be53a1e54394ea7310311183084516ed68bee066483d25e033eb
Opcode Fuzzy Hash: 20d8fef81f8701dc950607fd9be9d74995b121df42281fa78a048c32d55c9c51
Instruction Fuzzy Hash: AE11C830510909FBF725AFA4DC9D7D572A0F76A300F5049269882C60A1FF358A8CD744

Function 000002220BB8B940 Relevance: 5.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BB8B9AA

Part of subcall function 000002220BBA9468: _FF_MSGBANNER.LIBCMT ref: 000002220BBA9498
Part of subcall function 000002220BBA9468: _NMSG_WRITE.LIBCMT ref: 000002220BBA94A2
Part of subcall function 000002220BBA9468: _callnewh.LIBCMT ref: 000002220BBA94D6
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94E1
Part of subcall function 000002220BBA9468: _errno.LIBCMT ref: 000002220BBA94EC

free.LIBCMT ref: 000002220BB8BDE3

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno$_callnewhfreemalloc
String ID:
API String ID: 3099215566-0
Opcode ID: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction ID: c7e34e45548f05a02c99d951c8861d70df7c132a9a474f3d09e59119d694aa05
Opcode Fuzzy Hash: 02173545e05a84c9264574fa8afe8a9a8e664c3501bd964f3948135e520a17a9
Instruction Fuzzy Hash: 1DD10970248785EFDBB0DF68C0547ABB7E1FB9A314F90192DA989C3650DB329844CB07

Function 000002220BBA9924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002220BBA9975

Part of subcall function 000002220BBAB714: _getptd_noexit.LIBCMT ref: 000002220BBAB718

_invalid_parameter_noinfo.LIBCMT ref: 000002220BBA9980

Strings

B, xrefs: 000002220BBA99AC

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction ID: e6cc2e9d793c5d46248daa991e986095e2d5f2f6c4fe9a08a023848d874b9af3
Opcode Fuzzy Hash: dfff7db8d8a75928eb3056cb64617ae28a34f3a6f2aa6637d9c29ae3215ba4d9
Instruction Fuzzy Hash: A411C430618B08AFD764EF5CD489765B7D1FBA8324F1047AEA459C32A1DB74C944CB82

Function 000002220BB74300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BB74363

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction ID: fb12fff4c6e9b4f10bde0ee9d1f48d0416b57f011f0b3f87e124d1bd8db57716
Opcode Fuzzy Hash: 0fca5248a8da2211dc422f8e372dab47ed3a9ffe4740c211d34fb45fef0fccd2
Instruction Fuzzy Hash: 9251D83061CA05ABEB68DF6C949927973D1FBA5301F10456DEC9BC3786FE31DD0A8641

Function 000002220BBA7594 Relevance: 5.1, APIs: 4, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000002220BBA761F
_snprintf.LIBCMT ref: 000002220BBA7644
_snprintf.LIBCMT ref: 000002220BBA76A4
_snprintf.LIBCMT ref: 000002220BBA76C9

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction ID: 5397e6d456d51d97b014cbba1d03d9ff13df33a02cd6019b236e5793be4bd5c0
Opcode Fuzzy Hash: e2b5329c93648b9f23ade1c9bb210d2789aefad62375947c65960709d8e77631
Instruction Fuzzy Hash: 3A41423051CA48EFE765EF5DD858B9A77E0F7A9310F500529A88AC32E0EB35DE49C742

Function 000002220BBA7D04 Relevance: 5.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000002220BBA7D4E
strtok.LIBCMT ref: 000002220BBA7DAC
strtok.LIBCMT ref: 000002220BBA7DBE
free.LIBCMT ref: 000002220BBA7DD7

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: strtok$freemalloc
String ID:
API String ID: 3145456250-0
Opcode ID: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction ID: ec5dc4f6d390c2c1d305dac269d98188e7b403b2e595e213c5e0379a322e8c97
Opcode Fuzzy Hash: cc5c2709471a9d062e74d135495815655ac884716402f97f549632d6e6adb14d
Instruction Fuzzy Hash: 9E31F17091CB4CFFE7A0EF18C448B6977E1FBAA315F50061DA48AC32A1EB359945CB01

Function 000002220BBA93B8 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000002220BBA93D8

Part of subcall function 000002220BBA9428: _errno.LIBCMT ref: 000002220BBA9448

free.LIBCMT ref: 000002220BBA93E6
free.LIBCMT ref: 000002220BBA93F4
free.LIBCMT ref: 000002220BBA93FE

Memory Dump Source

Source File: 00000007.00000002.1935017877.000002220BB71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002220BB71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2220bb71000_rundll32.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction ID: 95ae49148fb847bdfd8d958ec2bf3f35a870c02c8aa97f800edfc8909afd7fba
Opcode Fuzzy Hash: 1c646a249a85c78f16f0867a465f9e1b54ef229f6325fa69fa7df30955489616
Instruction Fuzzy Hash: 5AF0A53462C948BFD6D8FF58C895E9977E1FFA9300F801458B489C73A2EA21E944CB02

Analysis Process: rundll32.exePID: 7560, Parent PID: 7748COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF8E7D9F9C5 Relevance: 22.4, APIs: 2, Strings: 8, Instructions: 4854nativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL ref: 00007FF8E7DA3C87
NtMapViewOfSection.NTDLL ref: 00007FF8E7DA3F2E

Strings

s>F, xrefs: 00007FF8E7DA2E39
t>F, xrefs: 00007FF8E7DA179A
t>F, xrefs: 00007FF8E7DA4871
74?t, xrefs: 00007FF8E7DA24B7
74?t, xrefs: 00007FF8E7DA4ACD
t>F, xrefs: 00007FF8E7DA164F
64?t, xrefs: 00007FF8E7DA4721
74?t, xrefs: 00007FF8E7DA1266

Memory Dump Source

Source File: 0000000B.00000002.3531355107.00007FF8E7D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8E7D70000, based on PE: true

Associated: 0000000B.00000002.3531105903.00007FF8E7D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3532072918.00007FF8E7DCD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3532072918.00007FF8E7E29000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.3532797771.00007FF8E7E59000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff8e7d70000_rundll32.jbxd

Similarity

API ID: Section$OpenView
String ID: 64?t$74?t$74?t$74?t$s>F$t>F$t>F$t>F
API String ID: 2380476227-1607135101
Opcode ID: cdd7cb33f92d3cd4137b229b801e8123ff88596f322070d37470624a74b11fb1
Instruction ID: 78531e20d1a8a7a5f91a287f691863bd3a2a2aeaf577cddf419f80d783472bb6
Opcode Fuzzy Hash: cdd7cb33f92d3cd4137b229b801e8123ff88596f322070d37470624a74b11fb1
Instruction Fuzzy Hash: 5CB36072B04A868AEB658F69D8903EC33A5FB44BC8F104535DA5D8B798DF3CE641C706

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KzHndnydSG.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
KzHndnydSG.dll